Get audit-trail events API

Overview

Each event, such as log in, Flow execution, etc., is captured in Etlworks audit trail log. Audit trail API can retrieve the last 1,000 events and filter events by type, user, timestamp, etc.

Authentication

Before making a call to the built-in API, the user must receive a JWT token from the authentication API.

Step 1. Use any user with the Administrator role to call Etlworks authentication endpoint and receive an access token.

Step 2. Use the access token received in Step 1 to call Etlworks API endpoints. The access token must be submitted as a header parameter, as in: Authorization:Bearer access-token.

Access tokens in Etlworks are short-lived and self-expiring. An access token gives you access to the APIs for approximately 10 minutes. It is recommended that you refresh the access token before each call to the API.

Get the last 1,000 events

To retrieve the last 1,000 events, use the following endpoint.

The API endpoint parameters

• PATH: /rest/v1/audit?optional_parameters.

EXAMPLE: https://app.etlworks.com/rest/v1/audit.

• LEGACY PATH (we keep it for backward compatibility): /plugins/audit/rest/v1/audit?optional_parameters.

• METHOD: GET.
• HEADER: Authorization:Bearer access-token.
• PARAMETERS: exception=false|true.

EXAMPLE: https://app.etlworks.com/rest/v1/audit?exception=true. If the value of the optional parameter exception is true, the exception stack trace will be included in the response.

• REQUEST BODY: none.
• REQUEST CONTENT TYPE: none.

Response

The response is a JSON document in the following Format:

[
    {
        "id": number, the audit record id
        "an": string, the application name
        "md": string, the event name
        "ur": string, the user name
        "tn": string, the tenant name
        "rt": boolean, if true the event was successful
        "in": boolean, if true the record has additional information
        "ex": string, the exception stack trace
        "hip": string, the host IP
        "cip": string, the client IP
        "dn": long, the duration in milliseconds
        "dt": string, the start date+time in milliseconds
    },
] 

Example:

[
    {
        "id": 12177,
        "an": "connections",
        "md": "editConnection",
        "ur": "admin",
        "tn": null,
        "rt": true,
        "in": false,
        "ex": null,
        "hip": "localhost:8080",
        "cip": "0:0:0:0:0:0:0:1",
        "dn": 7,
        "dt": "1522160520345"
    },
    {
        "id": 12176,
        "an": "flows",
        "md": "runFlow",
        "ur": "admin",
        "tn": null,
        "rt": false,
        "in": true,
        "ex": "com.toolsverse.etl.exception.EtlException: Attempted read from closed stream.",
        "hip": "localhost:8080",
        "cip": "0:0:0:0:0:0:0:1",
        "dn": 215086,
        "dt": "1522160093479"
    }    
]    

Response Codes

• 200 for success
• 401 and 403 for not authorized
• 500 for an internal error

Filter audit trail events

To filter audit trail events, use the following endpoint:

The endpoint can return up to 1,000 events.

To access this API, an Administrator user must make the authorization request.

The API endpoint parameters

• PATH: /rest/v1/audit?optional_parameters.

EXAMPLE: https://app.etlworks.com/rest/v1/audit.

• LEGACY PATH (we keep it for backward compatibility): /plugins/audit/rest/v1/audit?optional_parameters.
• METHOD: POST.
• HEADER: Authorization:Bearer access-token.
• PARAMETERS: exception=false|true.

EXAMPLE: https://app.etlworks.com/rest/v1/audit?exception=true. If the value of the optional parameter exception is true, the exception stack trace will be included in the response.

• REQUEST BODY: JSON document in the following Format:

• {
      "app": string, the application name
      "method": string, the event name
      "login": string, the user name
      "fromDate": string, the start date for the filter in Unix epoch format 
      "toDate": string, the end date for the filter in Unix epoch format 
      "duration": long, the duration in milliseconds
      "clientIp": string, the client IP
  }
  

• REQUEST CONTENT TYPE: application/json.

Response

The response is a JSON document in the following Format:

[
    {
        "id": number, the audit record id
        "an": string, the application name
        "md": string, the event name
        "ur": string, the user name
        "tn": string, the tenant name
        "rt": boolean, if true the event was successful
        "in": boolean, if true the record has additional information
        "ex": string, the exception stack trace
        "hip": string, the host IP
        "cip": string, the client IP
        "dn": long, the duration in milliseconds
        "dt": string, the start date+time in milliseconds
    },
] 

Example:

[
    {
        "id": 12177,
        "an": "connections",
        "md": "editConnection",
        "ur": "admin",
        "tn": null,
        "rt": true,
        "in": false,
        "ex": null,
        "hip": "localhost:8080",
        "cip": "0:0:0:0:0:0:0:1",
        "dn": 7,
        "dt": "1522160520345"
    },
    {
        "id": 12176,
        "an": "flows",
        "md": "runFlow",
        "ur": "admin",
        "tn": null,
        "rt": false,
        "in": true,
        "ex": "com.toolsverse.etl.exception.EtlException: Attempted read from closed stream.",
        "hip": "localhost:8080",
        "cip": "0:0:0:0:0:0:0:1",
        "dn": 215086,
        "dt": "1522160093479"
    }    
]    

Response Codes

• 200 for success
• 401 and 403 for not authorized
• 500 for an internal error