Audit Logs

The Audit Log Service API allows customers to query and export their audit logs.

Audit logs track all actions performed on customer accounts, including resource creation, modification, and deletion. The API provides filtering, pagination, and export capabilities.

All endpoints require HTTP Basic authentication using UpCloud account credentials.

List audit logs

GET

https://api.upcloud.com

/1.3/audit-logs

Returns a list of audit log rows according to the query parameters. Note that this endpoint is paginated by default and the list is limited in results.

Pagination Upcloud-Total-Count header is included in the response to indicate the total number of audit logs available with the current query parameters (excluding limit and offset). The total count can be used for a number of pagination strategies. limit and offset query parameters can be used to finally paginate the results.

List audit logs › query Parameters

q

auditLogsQueryParameter

Filter audit logs using a keyword such as account username, resource ID or IP address.

Search string

Example: my_account

limit

auditLogsLimitParameter · int32 · min: 1 · max: 200

Number of results to return (max 100, default 50)

Number of results to return

Example: 50

Default: 50

offset

auditLogsOffsetParameter · int32 · min: 0

Offset for retrieved results. (default 0)

Page for retrieved results. Note: 0 and 1 retrieve the same first page results. (default 0)

Example: 0

Default: 0

actions

string[]

List of actions to filter by

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: ["create","update","delete"]

origins

string[]

List of origins to filter by

Enum values:

api

gui

upcloud_internal

Example: ["api","gui"]

resource_types

string[]

List of resource types to filter by

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: ["server","storage","network"]

created_after

auditLogsCreatedAfterParameter · date-time

List audit logs created after the given timestamp (including the time of timestamp). Format: ISO timestamp eg. 2024-01-01T23:45:56Z

Example: 2024-01-01T00:00:00Z

created_before

auditLogsCreatedBeforeParameter · date-time

List audit logs created before the given timestamp (including the time of timestamp). Format: ISO timestamp eg. 2024-01-01T23:45:56Z

Example: 2024-12-31T23:59:59Z

List audit logs › Responses

Successful response

Response schema for a list of audit logs

auditLogsResponse

auditLogsAuditLog[] · required

List of audit log events

Export audit logs

GET

https://api.upcloud.com

/1.3/audit-logs/export

Export all audit logs for the authenticated account as CSV or JSON (up to 180 day limit). Note: Use the format parameter to specify output format; only JSON schema is documented here.

Export audit logs › query Parameters

format

auditLogsFormatParameter · enum

Export format: 'csv' or 'json' (default: csv)

Export format

Enum values:

csv

json

Example: csv

Default: csv

Export audit logs › Responses

File download. Returns JSON array of audit logs when format=json, or CSV when format=csv.

Response schema for a list of audit logs

auditLogsResponse

auditLogsAuditLog[] · required

List of audit log events

Get event details

GET

https://api.upcloud.com

/1.3/audit-logs/{cloudEventID}

Returns details of a single audit log event by its cloud event ID.

Get event details › path Parameters

cloudEventID

auditLogsCloudEventIDParameter · pattern: ^[0-9A-HJKMNP-TV-Z]{… · required

Cloud event ID (ULID format)

Example: 01HQXYZ123456789ABCDEFGHJK

Get event details › Responses

Successful response

A single audit log event

auditLogsAuditLog

time

string · date-time · required

Timestamp of the event

Example: 2024-03-05T14:30:00Z

auth_type

string · required

Authentication type used (e.g., 'gui', 'api', 'basic_auth')

Example: api

cloud_event_id

string · pattern: ^[0-9A-HJKMNP-TV-Z]{… · required

Cloud event ID in ULID format

Example: 01HQXYZ123456789ABCDEFGHJK

upcloud_correlation_id

string · required

UpCloud correlation ID for request tracing

Example: 550e8400-e29b-41d4-a716-446655440000

resource_type

string · enum · required

Type of resource affected

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: server

action

string · enum · required

Action performed

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: create

origin

string · enum · required

Origin of the request

Enum values:

api

gui

upcloud_internal

Example: api

account_username

string · required

Username that performed the action

Example: john.doe

resource_sub_type

string

Subtype of resource affected (e.g., 'session-api-token')

Example: session-api-token

ip_address

string

IP address of the request origin (IPv4 or IPv6). May be masked for internal UpCloud services.

Example: 192.168.1.100

resource_id

string

ID of the affected resource. May be hidden for sensitive resources like auth and account.

Example: 00000000-0000-4000-8000-000000000000

object

Current state of the resource after the action (only present for create/update actions). Structure varies by resource_type.

object

Previous state of the resource before the action (only present for update/delete actions). Structure varies by resource_type.

GET

https://api.upcloud.com

/1.3/audit-logs/filter-options

Returns lists of available resource types, actions, and origins for filtering.

Successful response

Available filter options for audit logs

auditLogsFilterOptionsResponse

resource_types

string[] · required

List of available resource types

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: ["server","storage","network-gateway"]

actions

string[] · required

List of available actions

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: ["create","update","delete"]

origins

string[] · required

List of available origins

Enum values:

api

gui

upcloud_internal

Example: ["api","gui","upcloud_internal"]

Account Account Tokens

List audit logs

GET

https://api.upcloud.com

/1.3/audit-logs

Returns a list of audit log rows according to the query parameters. Note that this endpoint is paginated by default and the list is limited in results.

List audit logs › query Parameters

q

auditLogsQueryParameter

Filter audit logs using a keyword such as account username, resource ID or IP address.

Search string

Example: my_account

limit

auditLogsLimitParameter · int32 · min: 1 · max: 200

Number of results to return (max 100, default 50)

Number of results to return

Example: 50

Default: 50

offset

auditLogsOffsetParameter · int32 · min: 0

Offset for retrieved results. (default 0)

Page for retrieved results. Note: 0 and 1 retrieve the same first page results. (default 0)

Example: 0

Default: 0

actions

string[]

List of actions to filter by

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: ["create","update","delete"]

origins

string[]

List of origins to filter by

Enum values:

api

gui

upcloud_internal

Example: ["api","gui"]

resource_types

string[]

List of resource types to filter by

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: ["server","storage","network"]

created_after

auditLogsCreatedAfterParameter · date-time

List audit logs created after the given timestamp (including the time of timestamp). Format: ISO timestamp eg. 2024-01-01T23:45:56Z

Example: 2024-01-01T00:00:00Z

created_before

auditLogsCreatedBeforeParameter · date-time

List audit logs created before the given timestamp (including the time of timestamp). Format: ISO timestamp eg. 2024-01-01T23:45:56Z

Example: 2024-12-31T23:59:59Z

List audit logs › Responses

Successful response

Response schema for a list of audit logs

auditLogsResponse

auditLogsAuditLog[] · required

List of audit log events

Export audit logs

GET

https://api.upcloud.com

/1.3/audit-logs/export

Export all audit logs for the authenticated account as CSV or JSON (up to 180 day limit). Note: Use the format parameter to specify output format; only JSON schema is documented here.

Export audit logs › query Parameters

format

auditLogsFormatParameter · enum

Export format: 'csv' or 'json' (default: csv)

Export format

Enum values:

csv

json

Example: csv

Default: csv

Export audit logs › Responses

File download. Returns JSON array of audit logs when format=json, or CSV when format=csv.

Response schema for a list of audit logs

auditLogsResponse

auditLogsAuditLog[] · required

List of audit log events

Get event details

GET

https://api.upcloud.com

/1.3/audit-logs/{cloudEventID}

Returns details of a single audit log event by its cloud event ID.

Get event details › path Parameters

cloudEventID

auditLogsCloudEventIDParameter · pattern: ^[0-9A-HJKMNP-TV-Z]{… · required

Cloud event ID (ULID format)

Example: 01HQXYZ123456789ABCDEFGHJK

Get event details › Responses

Successful response

A single audit log event

auditLogsAuditLog

time

string · date-time · required

Timestamp of the event

Example: 2024-03-05T14:30:00Z

auth_type

string · required

Authentication type used (e.g., 'gui', 'api', 'basic_auth')

Example: api

cloud_event_id

string · pattern: ^[0-9A-HJKMNP-TV-Z]{… · required

Cloud event ID in ULID format

Example: 01HQXYZ123456789ABCDEFGHJK

upcloud_correlation_id

string · required

UpCloud correlation ID for request tracing

Example: 550e8400-e29b-41d4-a716-446655440000

resource_type

string · enum · required

Type of resource affected

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: server

action

string · enum · required

Action performed

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: create

origin

string · enum · required

Origin of the request

Enum values:

api

gui

upcloud_internal

Example: api

account_username

string · required

Username that performed the action

Example: john.doe

resource_sub_type

string

Subtype of resource affected (e.g., 'session-api-token')

Example: session-api-token

ip_address

string

IP address of the request origin (IPv4 or IPv6). May be masked for internal UpCloud services.

Example: 192.168.1.100

resource_id

string

ID of the affected resource. May be hidden for sensitive resources like auth and account.

Example: 00000000-0000-4000-8000-000000000000

object

Current state of the resource after the action (only present for create/update actions). Structure varies by resource_type.

object

Previous state of the resource before the action (only present for update/delete actions). Structure varies by resource_type.

Get filter options

GET

https://api.upcloud.com

/1.3/audit-logs/filter-options

Returns lists of available resource types, actions, and origins for filtering.

Successful response

Available filter options for audit logs

auditLogsFilterOptionsResponse

resource_types

string[] · required

List of available resource types

Enum values:

account

auth

init-script

managed-database

managed-loadbalancer

managed-loadbalancer-certificate-bundle

managed-object-storage

network-gateway

Example: ["server","storage","network-gateway"]

actions

string[] · required

List of available actions

Enum values:

create

read

update

delete

access-granted

access-granted-kubeconfig

access-modified

access-update

Example: ["create","update","delete"]

origins

string[] · required

List of available origins

Enum values:

api

gui

upcloud_internal

Example: ["api","gui","upcloud_internal"]

Audit Logs

List audit logs

List audit logs › query Parameters

List audit logs › Responses

Export audit logs

Export audit logs › query Parameters

Export audit logs › Responses

Get event details

Get event details › path Parameters

Get event details › Responses

Get filter options

Get filter options › Responses

Audit Logs

List audit logs

List audit logs › query Parameters

List audit logs › Responses

Export audit logs

Export audit logs › query Parameters

Export audit logs › Responses

Get event details

Get event details › path Parameters

Get event details › Responses

Get filter options

Get filter options › Responses