API reference

Audit log

Read an organization's audit log.

GET/v1/orgs/:orgId/audit

One page of the audit log, newest first. Filter by action (an action or a category), actor or target. The first page also returns retentionDays.

Auth: A person's token or an API key, as Authorization: Bearer.
Scope: audit:read

Get an API key

Path parameters

orgId
Organization id (org_…).

Query parameters

cursorstring
Up to 4,096 characters.
actionstring
Matches ^[a-z_]{1,32}(\.[a-z_]{1,32})?$.
actorstring
1–512 characters.
targetstring
Matches ^[a-z_]{1,32}:[^\s]{1,512}$.
limitinteger
Default 50. 1–100. Coerced from a string.

Errors

400Invalid cursor

curl 'https://api.cactive.com.au/v1/orgs/{orgId}/audit' \
  -H "Authorization: Bearer $CACTIVE_TOKEN"

Send it from this page with your session or a key.

Response 200

{
  events: {
    eventId: string
    orgId: string
    action: string
    actor: {
      type: "user" | "key" | "device" | "system"
      id: string
      label?: string
    }
    target: {
      type: string
      id: string
      label?: string
    }
    metadata?: {
      [key: string]: unknown
    }
    ip?: string
    userAgent?: string
    createdAt: number
  }[]
  cursor: null | string
  retentionDays?: number
}

GET/v1/orgs/:orgId/audit/export

Daily JSON Lines export of the audit log into one of the org's buckets (audit/<yyyy-mm-dd>.jsonl).

Auth: A person's token or an API key, as Authorization: Bearer.
Scope: audit:read

Get an API key

Path parameters

orgId
Organization id (org_…).

Errors

404Organization not found

curl 'https://api.cactive.com.au/v1/orgs/{orgId}/audit/export' \
  -H "Authorization: Bearer $CACTIVE_TOKEN"

Send it from this page with your session or a key.

Response 200

{
  export: {
    bucketId: null | string
    bucket: null | {
      name: string
      region: string
      prefix: string
    }
    pendingDays: string[]
  }
}

PUT/v1/orgs/:orgId/audit/export

Turns the daily export on (bucketId: an active bucket of the org) or off (null). Owners and admins.

Auth: A person's token or an API key, as Authorization: Bearer.
Scopes: audit:read, org:write

Get an API key

Path parameters

orgId
Organization id (org_…).

Request body

bucketIdstringrequiredor null
1–64 characters.

Errors

400Choose an active bucket of this organization.
404Organization not found

curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/audit/export' \
  -H "Authorization: Bearer $CACTIVE_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "bucketId": "<bucketId>"
  }'

Send it from this page with your session or a key.

Response 200

{
  export: {
    bucketId: null | string
    bucket: null | {
      name: string
      region: string
      prefix: string
    }
    pendingDays: string[]
  }
}