Domain Audit Events

Resource Description
GET /api/domainaudit All recorded events
GET /api/domainaudit/all/{num} Returns the last {num} number of events of all types
GET /api/domainaudit/{id} Returns all recorded events for a specified event ID. You can optionally put a limit on the amount of messages returned
GET /api/domainaudit/user/{user} Returns all related events for a given user
GET /api/domainaudit/outcome/{outcome} Returns all recorded events with the given success or failure outcome
GET /api/domainaudit/users Returns all User related events. You can optionally put a limit on the amount of messages returned
GET /api/domainaudit/organisations Returns all Organisation related events. You can optionally put a limit on the amount of messages returned
GET /api/domainaudit/applications Returns all Application related events. You can optionally put a limit on the amount of messages returned
GET /api/domainaudit/search Querystring search for Domain Audit events. Optional parameters are count, beginId, endId, beginTimestamp, endTimestamp and ago

Note that the API can be called on each API Server instance using the Routing API

Refer to Domain Audit Settings for audit events and off-load settings.

The Domain Audit API allows you to see audit event messages for the NodeManager and API Server Instances.
Each message consist is returned as a JSON string in the following format:

{
    "events": [
        {
            "message": "Admin user 'admin' connected",
            "eventId": 112,
            "user": "admin",
            "outcome": "success",
            "additionalInfo": "",
            "timeStamp": 1435766509641,
            "metaData": {
                "userID": "admin"
            }
        }
    ]
}

"events" is the main object containing an array of event objects.

Each event object consists of the following fields:

We will examine each of these fields in turn.

message

The message component of the Domain Audit event

eventId

This is a unique integer representing the specific type of event. A list of the current Event IDs is:

Service Events
Description Event Id
Service Started 2
Service Clean Shutdown Failed 5
Service Stopped 6
API Request Made 9
Audit Event Configuration Updated 10
Audit Log Files Off-loaded 11
Audit External Location Settings Updated 12
User Specific Events
Description Event Id
User Created 100
User Modified 101
User Password Updated 102
User Password Reset Request 103
User Password Reset 104
User Disabled 105
User Deleted 106
User Logged In 107
User Logged Out 108
User Activated 109
User Registration Sent 110
User Registration Validated 111
User Admin Logged In 112
User Registration Email Failed 113
User Password Reset Email Failed 114
User Password Reset Failed 115
User Password Admin Reset 116
User Create Approval Sent 117
User Create Approval Failed 118
User Validation Email Sent 119
User Validation Email Failed 120
User Approval Required 121
User Validation Required 122
User Validation Complete 123
User Password Reset Email Sent 124
User Registration Disabled 125
User Registration Organization Disabled 126
User Admin Logged Out 127
Organization Specific Events
Description Event Id
Organization Created 300
Organization Modified 301
Organization Disabled 305
Organization Deleted 306
Organization Registration Token Created 307
Organization Registration Token Deleted 308
Application Specific Events
Description Event Id
Application Created 500
Application Modified 501
Application Disabled 505
Application Deleted 506
Application Oauth Created 510
Application Oauth Modified 511
Application Oauth Disabled 515
Application Oauth Deleted 516
Application Import 517
Application Export 518
Application Apikey Created 520
Application Apikey Modified 521
Application Apikey Disabled 525
Application Apikey Deleted 526
Application Approval Email Sent 527
Application Approval Email Failed 528
Application Quota Created 529
Application Quota Modified 530
Application Quota Deleted 531
Application Permission Created 532
Application Permission Modified 533
Application Permission Deleted 534
Api Application Approval Email Sent 535
Api Application Approval Email Failed 536
Application Approval Required 537
Api Application Approval Required 538
Api Application Approved 539
Application Approved 540
Application Apiaccess Created 541
Application Apiaccess Modified 542
Application Apiaccess Deleted 543
Application Oauth Resource Created 544
Application Oauth Resource Modified 545
Application Oauth Resource Deleted 546
Application Passport Connection Pass 547
Application Passport Connection Fail 548
Application OAuth Scope Created 550
Application OAuth Scope Updated 551
Application OAuth Scope Deleted 552
Application External Client Created 553
Application External Client Updated 554
Application External Client Deleted 555
Portal Admin Events
Description Event Id
Abstract Controller Webserver Error 1 700
Abstract Controller Webserver Error 2 701
Abstract Controller Webserver Error 3 702
API Manager Configuration Updated 703
API Manager System Configuration Updated 704
API Manager Alert Configuration Updated 705
Configuration Events
Description Event Id
Config Replication Started 1000
Config Writing 1001
Config Replication Complete 1002
Config Deployment Starting 1003
Config Deployment Complete 1004
Config Deployment Failed 1005
Config Deployment Purge Failed 1006
Config Deployment Purge Success 1007
Config Deployment Purge Started 1008
Config Deployment Purge Finished 1009
Config Write Policy Archive 1010
Config Replication Failed Streaming 1011
Config Create Deployment Arc Success 1012
Config Create Deployment Arc Failed 1013
Config Deployment Saved 1014
Config Deployment Save Fail 1015
Config Group Passphrase Update 1016
Config Group Passphrase Update Fail 1017
Config Update Archive Passphrase Trigger 1018
Config Update Archive Passphrase Pass 1019
Config Update Archive Passphrase Fail 1020
Config Update Service Passphrase Trigger 1021
Config Update Service Passphrase Pass 1022
Config Update Service Passphrase Fail 1023
Config Update Nm Passphrase Trigger 1024
Config Update Nm Passphrase Pass 1025
Config Update Nm Passphrase Fail 1026
Config Update Deployment Archive Trigger 1027
Config Update Deployment Archive Pass 1028
Config Update Deployment Archive Fail 1029
Config Load Success 1030
Config Load Fail 1031
Config Load Rollback Success 1032
Config Load Rollback Fail 1033
Config Update Inmem Passphrase Trigger 1034
Config Update Inmem Passphrase Pass 1035
Config Update Inmem Passphrase Fail 1036
Config Domain Deployments Read 1037
Config Policy Archive Read 1038
Config Environment Archive Read 1039
Config Deployment Archive Read 1040
Config Domain Deployments With Pending Read 1041
Config Local Deployments Read 1042
Config Env Settings Read 1043
Config Group File Read 1044
Policy Created 1045
Policy Updated 1046
Policy Deleted 1047
Policy Received 1048
Policy Transmitted 1049
Deployment Transaction Created 1100
Deployment Transaction File Added 1101
Deployment Transaction Tag Added 1102
Deployment Transaction Committed 1103
Deployment Transaction Creation Failed 1104
Deployment Transaction Accepted 1105
Deployment Transaction Accept Failed 1106
Deployment Transaction Executed 1107
Deployment Transaction Execution Failed 1108
Deployment Transaction Purged 1109
KPS Events
Description Event Id
Kps Object Read 1200
Kps Object Write 1201
Kps Object Update 1202
Kps Object Delete 1203
Kps Iterator Start 1204
Kps Iterator Next 1205
Kps Query Read 1206
Kps Store Read 1207
Kps Model Read 1208
Topology Events
Description Event Id
Topology Host Added 1400
Topology Host Removed 1401
Topology Host Modified 1402
Topology Group Added 1403
Topology Group Removed 1404
Topology Group Modified 1405
Topology Server Added 1406
Topology Server Removed 1407
Topology Server Modified 1408
Topology Group Locked 1410
Topology Group Unlocked 1411
User Store Events
Description Event Id
Userstore Admin Created 1600
Userstore Admin Modified 1601
Userstore Admin Password Modified 1602
Userstore Admin Removed 1603
Userstore Admin Role Removed 1604
Userstore Password Policy Created 1609
Userstore Password Policy Updated 1610
Userstore Password Policy Deleted 1611
Userstore Authentication Threshold Breached 1612
Userstore Authentication Threshold Reset 1613
Userstore Administrator User Authenticated 1614
Analytics Events
Description Event Id
Analytics Report Created 1800
Analytics Report Deleted 1801
Analytics Report Generated 1802
Analytics Viewed 1803
Management Events
Description Event Id
API Publish Request Sent 2000
API Publish Request Send Failed 2001
API Publish Approval Sent 2002
API Publish Approval Send Failed 2003
API Publish Rejection Sent 2004
API Publish Rejection Send Failed 2005
Communication Events
Description Event Id
Node Manager Client Connection 2200
Node Manager Connection Failed 2201
Gateway Instance Client Connection 2202
Gateway Instance Connection Failed 2203
Session Events
Description Event Id
Session TLS Established 2400
Session HTTPS Established 2401
Session TLS Establishment Failed 2402
Session HTTPS Establishment Failed 2403
Session Establishment Denied 2404
Session Terminated 2406

user

The user component of the Domain Audit event

outcome

The success or failure component of the Domain Audit event

additionalInfo

Optional additional information related to the Domain Audit event, such as extra details in case of failure

timestamp

This is a timestamp in format of number of milliseconds since the epoch (Jan 1st 1970)

metadata

Optional extra data related to the event, userID perhaps or a given configuration ID.