Describe an Event Log

GET /workspace/logs/{log}

Describe an Event Log

cURL

curl --request GET \
  --url https://wks-a1b2c3d4.provisionr.io/api/v1/workspace/logs/{log} \
  --header 'Authorization: Bearer <token>'

200

{
  "id": "<string>",
  "workspace_id": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "occurred_at": "2023-11-07T05:31:56Z",
  "level": "info",
  "event_type": "<string>",
  "method": "<string>",
  "message": "<string>",
  "errors": [
    "<string>"
  ],
  "metadata": [
    "<string>"
  ],
  "actor_type": "<string>",
  "actor_id": "<string>",
  "actor_name": "<string>",
  "actor_handle": "<string>",
  "actor_session_id": "<string>",
  "actor_source": "system",
  "attribute_key": "<string>",
  "attribute_value_old": "<string>",
  "attribute_value_new": "<string>",
  "parent_type": "<string>",
  "parent_id": "<string>",
  "record_type": "<string>",
  "record_id": "<string>",
  "record_provider_id": "<string>",
  "related_id": "<string>",
  "related_type": "<string>",
  "subject_id": "<string>",
  "subject_type": "<string>",
  "count_records": 123,
  "job_batch": "<string>",
  "job_id": "<string>",
  "job_platform": "<string>",
  "job_pipeline_id": "<string>",
  "job_timestamp": "2023-11-07T05:31:56Z",
  "job_transaction_id": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

log · string · required

Workspace Log ID

Response

200

application/json

WorkspaceLogDetailedResponseData

id · string · required

Example:

"wslog_01hq8xyzabc123def456ghi789"

workspace_id · string | null · required

The ID of the workspace tenant

Example:

"hqwks_01hq8xyzabc123def456ghi789"

created_at · string<date-time> · required

The timestamp when the audit log was created

Example:

"2024-01-15T10:30:00Z"

occurred_at · string<date-time> | null · required

The timestamp when the event occurred

Example:

"2024-01-15T10:30:00Z"

level · enum<string> | null · required

The industry standard log severity level

Available options: emergency, alert, critical, error, warning, notice, info, debug

Example:

"info"

event_type · string | null · required

The type of event (e.g., namespace.resource.child_resource?.action.result?.context?)

Example:

"policy.user.create.success"

method · string | null · required

The method or action that triggered the log entry and line number

Example:

"\\App\\Actions\\V1\\PolicyUser\\CreatePolicyUser::handle:33"

message · string | null · required

The log message describing the action

Example:

"Policy User Qualified and Added to Manifest"

errors · string[] | null · required

Error messages associated with the action

Example:

{
  "key1": "Value 1",
  "message": "Invalid input"
}

metadata · string[] | null · required

Additional metadata associated with the log entry. This provides context that the ID and type may not cover

Example:

{ "key1": "value1", "key2": "value2" }

actor_type · string | null · required

The type of actor (e.g., workspace_user, workspace_service, workspace_integration)

Example:

"workspace_user"

actor_id · string | null · required

The ID of the actor who performed the action

Example:

"wsusr_01hq8xyzabc123def456ghi789"

actor_name · string | null · required

The name of the actor who performed the action

Example:

"Dade Murphy"

actor_handle · string | null · required

The alphadash handle of the actor that performed the action

Example:

"dmurphy"

actor_session_id · string | null · required

The session ID of the actor

Example:

"A1b2c3D4e5f6G7h8I9J0k1l2m3n4o5p6q7r8s9t0"

actor_source · enum<string> · required

The source of the actor

system System Artisan commands or queued jobs
cli CLI Authenticated via a token with an associated device
api API Authenticated via a token without a device (PAT, service token, etc.) or unauthenticated request to API routes
web Web Session-based web UI requests

Available options: system, cli, api, web

attribute_key · string | null · required

The snake_case or camelCase key in the database table (or API response) that was modified. This provides a before and after snapshot for database column or array values that are changed

Example:

"name"

attribute_value_old · string | null · required

The old database or API response value of the attribute before modification. Null for created records

Example:

"IT Team"

attribute_value_new · string | null · required

The new value of the attribute after modification

Example:

"Security Team"

parent_type · string | null · required

The type of the parent resource

Example:

"google_workspace_group"

parent_id · string | null · required

The ID of the parent resource

Example:

"gwgrp_01hq8xyzabc123def456ghi789"

record_type · string | null · required

The type of the record being acted upon

Example:

"policy_user"

record_id · string | null · required

The ID of the record being acted upon

Example:

"pousr_01hq8xyzabc123def456ghi789"

record_provider_id · string | null · required

The Integration Provider API identifier of the record (if applicable)

Example:

"a1b2c3d4-e5f6-a7b8-c9d0-e1f2g3h4i5j6"

related_id · string | null · required

The ID of the related resource

Example:

"porul_01hq8xyzabc123def456ghi789"

related_type · string | null · required

The type of the related resource

Example:

"policy_rule"

subject_id · string | null · required

The ID of the subject related to the action

Example:

"drusr_01hq8xyzabc123def456ghi789"

subject_type · string | null · required

The type of the subject. The record type is the action that was performed. The subject is on behalf of who

Examples:

"directory_user"

"workspace_service"

"workspace_user"

count_records · integer | null · required

The count of records affected by this action (if applicable for bulk operations)

Example:

5

job_batch · string | null · required

The batch identifier for grouped job operations

Example:

"xxxxx_01hq8xyzabc123def456ghi789"

job_id · string | null · required

The job ID associated with this log entry

Example:

"xxxxx_01hq8xyzabc123def456ghi789"

job_platform · string | null · required

The platform where the job was executed

job_pipeline_id · string | null · required

The pipeline ID for CI/CD operations

Example:

"123456789"

job_timestamp · string<date-time> | null · required

The timestamp when the job was executed

Example:

"2024-01-15T10:30:00Z"

job_transaction_id · string | null · required

The transaction ID for the job

Example:

"xxxxx_01hq8xyzabc123def456ghi789"