Skip to content
Console(the OVHcloud Console, opens in a new tab)

Audit Logs

All operations require authentication.

8 operationsv1/me/logs
OpenAPI
Agent setup

Get your audit logsAlpha

GET
/1.0/me/logs/audit

Response

200Log[]successful operation
authDetails
read-only
LogAuthDetails

authentication details

createdAt
read-only
stringdate-time

event's date

groupCreatedDetails
read-only
LogGroupCreatedDetails

specific fields for GROUP_CREATED events

groupDeletedDetails
read-only
LogGroupDeletedDetails

specific fields for GROUP_DELETED events

groupModifiedDetails
read-only
LogGroupModifiedDetails

specific fields for GROUP_MODIFIED events

ip
read-only
ip

IP associated to this event

loginSuccessDetails
read-only
LogLoginSuccessDetails

specific fields for LOGIN_SUCCESS events

policyCreatedDetails
read-only
LogPolicyCreatedDetails

specific fields for POLICY_CREATED events

policyDeletedDetails
read-only
LogPolicyDeletedDetails

specific fields for POLICY_DELETED events

policyModifiedDetails
read-only
LogPolicyModifiedDetails

specific fields for POLICY_MODIFIED events

providerCreatedDetails
read-only
LogProviderCreatedDetails

specific fields for PROVIDER_CREATED events

providerDeletedDetails
read-only
LogProviderDeletedDetails

specific fields for PROVIDER_DELETED events

providerModifiedDetails
read-only
LogProviderModifiedDetails

specific fields for PROVIDER_MODIFIED events

resourceGroupCreatedDetails
read-only
LogResourceGroupCreatedDetails

specific fields for RESOURCE_GROUP_CREATED events

resourceGroupDeletedDetails
read-only
LogResourceGroupDeletedDetails

specific fields for RESOURCE_GROUP_DELETED events

resourceGroupModifiedDetails
read-only
LogResourceGroupModifiedDetails

specific fields for RESOURCE_GROUP_MODIFIED events

tokenCreatedDetails
read-only
LogTokenCreatedDetails

specific fields for TOKEN_CREATED events

tokenDeletedDetails
read-only
LogTokenDeletedDetails

specific fields for TOKEN_DELETED events

tokenModifiedDetails
read-only
LogTokenModifiedDetails

specific fields for TOKEN_MODIFIED events

type
read-only
LogTypeEnum

type of event

ValuesACCOUNT_PASSWORD_CHANGEDGROUP_CREATEDGROUP_DELETEDGROUP_MODIFIEDLOGIN_SUCCESSPOLICY_CREATEDPOLICY_DELETEDPOLICY_MODIFIEDPROVIDER_CREATEDPROVIDER_DELETEDPROVIDER_MODIFIEDRESOURCE_GROUP_CREATEDRESOURCE_GROUP_DELETEDRESOURCE_GROUP_MODIFIEDTOKEN_CREATEDTOKEN_DELETEDTOKEN_MODIFIEDUSER_CREATEDUSER_DELETEDUSER_MODIFIEDUSER_PASSWORD_CHANGED
userCreatedDetails
read-only
LogUserCreatedDetails

specific fields for USER_CREATED events

userDeletedDetails
read-only
LogUserDeletedDetails

specific fields for USER_DELETED events

userModifiedDetails
read-only
LogUserModifiedDetails

specific fields for USER_MODIFIED events

userPasswordChangedDetails
read-only
LogUserPasswordChangedDetails

specific fields for USER_PASSWORD_CHANGED events

Reads your token from $OVH_TOKEN

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
[  {    "authDetails": {      "userDetails": {        "type": "ACCOUNT",        "user": "string"      }    },    "createdAt": "2024-01-01T12:00:00Z",    "groupCreatedDetails": {      "group": "string",      "new": {        "description": "string",        "name": "string",        "role": "string"      }    },    "groupDeletedDetails": {      "group": "string",      "old": {        "description": "string",        "name": "string",        "role": "string"      }    },    "groupModifiedDetails": {      "group": "string",      "new": {        "description": "string",        "name": "string",        "role": "string"      },      "old": {        "description": "string",        "name": "string",        "role": "string"      }    },    "ip": "192.0.2.0",    "loginSuccessDetails": {      "mfaType": "BACKUP_CODE",      "userAgent": "string"    },    "policyCreatedDetails": {      "added": {        "identities": [          "string"        ],        "resources": [          "string"        ]      },      "new": {        "description": "string",        "name": "string"      },      "policyId": "00000000-0000-0000-0000-000000000000",      "policyName": "string"    },    "policyDeletedDetails": {      "old": {        "description": "string",        "name": "string"      },      "policyId": "00000000-0000-0000-0000-000000000000",      "policyName": "string",      "removed": {        "identities": [          "string"        ],        "resources": [          "string"        ]      }    },    "policyModifiedDetails": {      "added": {        "identities": [          "string"        ],        "resources": [          "string"        ]      },      "new": {        "description": "string",        "name": "string"      },      "old": {        "description": "string",        "name": "string"      },      "policyId": "00000000-0000-0000-0000-000000000000",      "policyName": "string",      "removed": {        "identities": [          "string"        ],        "resources": [          "string"        ]      }    },    "providerCreatedDetails": {      "new": {        "groupAttributeName": "string",        "requestSignatureEnabled": true,        "userAttributeName": "string",        "usersDisabled": true      },      "ssoServiceURL": "string"    },    "providerDeletedDetails": {      "old": {        "groupAttributeName": "string",        "requestSignatureEnabled": true,        "userAttributeName": "string",        "usersDisabled": true      },      "ssoServiceURL": "string"    },    "providerModifiedDetails": {      "new": {        "groupAttributeName": "string",        "requestSignatureEnabled": true,        "userAttributeName": "string",        "usersDisabled": true      },      "old": {        "groupAttributeName": "string",        "requestSignatureEnabled": true,        "userAttributeName": "string",        "usersDisabled": true      },      "ssoServiceURL": "string"    },    "resourceGroupCreatedDetails": {      "added": {        "resources": [          "string"        ]      },      "new": {        "name": "string"      },      "resourceGroupId": "00000000-0000-0000-0000-000000000000",      "resourceGroupName": "string"    },    "resourceGroupDeletedDetails": {      "old": {        "name": "string"      },      "removed": {        "resources": [          "string"        ]      },      "resourceGroupId": "00000000-0000-0000-0000-000000000000",      "resourceGroupName": "string"    },    "resourceGroupModifiedDetails": {      "added": {        "resources": [          "string"        ]      },      "new": {        "name": "string"      },      "old": {        "name": "string"      },      "removed": {        "resources": [          "string"        ]      },      "resourceGroupId": "00000000-0000-0000-0000-000000000000",      "resourceGroupName": "string"    },    "tokenCreatedDetails": {      "new": {        "description": "string",        "expiresAt": "2024-01-01T12:00:00Z"      },      "tokenCreatedAt": "2024-01-01T12:00:00Z",      "tokenName": "string",      "user": "string"    },    "tokenDeletedDetails": {      "old": {        "description": "string",        "expiresAt": "2024-01-01T12:00:00Z"      },      "tokenCreatedAt": "2024-01-01T12:00:00Z",      "tokenName": "string",      "user": "string"    },    "tokenModifiedDetails": {      "new": {        "description": "string",        "expiresAt": "2024-01-01T12:00:00Z"      },      "old": {        "description": "string",        "expiresAt": "2024-01-01T12:00:00Z"      },      "tokenCreatedAt": "2024-01-01T12:00:00Z",      "tokenName": "string",      "user": "string"    },    "type": "ACCOUNT_PASSWORD_CHANGED",    "userCreatedDetails": {      "new": {        "description": "string",        "group": "string",        "passwordRecoveryEmail": "string",        "userType": "ROOT"      },      "user": "string",      "userCreatedAt": "2024-01-01T12:00:00Z",      "userType": "ROOT"    },    "userDeletedDetails": {      "old": {        "description": "string",        "group": "string",        "passwordRecoveryEmail": "string",        "userType": "ROOT"      },      "user": "string",      "userCreatedAt": "2024-01-01T12:00:00Z",      "userType": "ROOT"    },    "userModifiedDetails": {      "new": {        "description": "string",        "group": "string",        "passwordRecoveryEmail": "string",        "userType": "ROOT"      },      "old": {        "description": "string",        "group": "string",        "passwordRecoveryEmail": "string",        "userType": "ROOT"      },      "user": "string",      "userCreatedAt": "2024-01-01T12:00:00Z"    },    "userPasswordChangedDetails": {      "user": "string",      "userCreatedAt": "2024-01-01T12:00:00Z"    }  }]

List available log kindsProduction

GET
/1.0/me/logs/audit/log/kind

Response

200string[]successful operation

Reads your token from $OVH_TOKEN

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/kind \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
[  "string"]

Get a log kindProduction

GET
/1.0/me/logs/audit/log/kind/{name}

Path parameters

name
required
string

Name

Response

200LogKindsuccessful operation
additionalReturnedFields
read-only
string[]

List of additional log fields managed in this log kind

createdAt
read-only
stringdate-time

Creation date of the log kind

displayName
read-only
string

Log kind display name

kindId
read-only
stringuuid

Log kind ID

name
read-only
string

Log kind name

updatedAt
read-only
stringdate-time

Last update date of the log kind

Example uses name = string

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/kind/{name} \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
{  "additionalReturnedFields": [    "string"  ],  "createdAt": "2024-01-01T12:00:00Z",  "displayName": "string",  "kindId": "00000000-0000-0000-0000-000000000000",  "name": "string",  "updatedAt": "2024-01-01T12:00:00Z"}

List subscription IDs for a clusterProduction

GET
/1.0/me/logs/audit/log/subscription

Query parameters

kind
string

Filter on a specific kind (e.g., audit)

Response

200string[]successful operation

Reads your token from $OVH_TOKEN

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/subscription \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
[  "00000000-0000-0000-0000-000000000000"]

Create a subscription from logs to a pre-existing LDP streamProduction

POST
/1.0/me/logs/audit/log/subscription

Request body (required)

kind
required
string

Log kind name to subscribe to

streamId
required
stringuuid

Customer log stream ID

Response

200LogSubscriptionResponsesuccessful operation
operationId
read-only
stringuuid

Identifier of the operation

serviceName
read-only
string

Operation owner's service name

Reads your token from $OVH_TOKEN

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/subscription \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
{  "operationId": "00000000-0000-0000-0000-000000000000",  "serviceName": "string"}

Get subscription detailsProduction

GET
/1.0/me/logs/audit/log/subscription/{subscriptionId}

Path parameters

subscriptionId
required
stringuuid

Subscription ID

Response

200LogSubscriptionsuccessful operation
createdAt
read-only
stringdate-time

Creation date of the subscription

kind
read-only
string

Log kind name of this subscription

resource
read-only
SubscriptionResource

Subscribed resource, where the logs come from

serviceName
read-only
string

Name of the destination log service

streamId
read-only
string

Id of the destination log stream

subscriptionId
read-only
stringuuid

Subscription ID

updatedAt
read-only
stringdate-time

Last update date of the subscription

Example uses subscriptionId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/subscription/{subscriptionId} \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
{  "createdAt": "2024-01-01T12:00:00Z",  "kind": "string",  "resource": {    "name": "string",    "type": "string"  },  "serviceName": "string",  "streamId": "string",  "subscriptionId": "00000000-0000-0000-0000-000000000000",  "updatedAt": "2024-01-01T12:00:00Z"}

Delete a subscriptionProduction

DELETE
/1.0/me/logs/audit/log/subscription/{subscriptionId}

Path parameters

subscriptionId
required
stringuuid

Subscription ID

Response

200LogSubscriptionResponsesuccessful operation
operationId
read-only
stringuuid

Identifier of the operation

serviceName
read-only
string

Operation owner's service name

Example uses subscriptionId = 00000000-0000-0000-0000-000000000000

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/subscription/{subscriptionId} \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
{  "operationId": "00000000-0000-0000-0000-000000000000",  "serviceName": "string"}

Generate a temporary URL to retrieve logsProduction

POST
/1.0/me/logs/audit/log/url

Request body (required)

kind
required
string

Log kind name

Response

200TemporaryLogsLinksuccessful operation
expirationDate
read-only
stringdate-time

Temporary url expiration date

url
read-only
string

Temporary url

Reads your token from $OVH_TOKEN

$ curl https://api.eu.ovhcloud.com/1.0/me/logs/audit/log/url \
  -H "authorization: Bearer $OVH_TOKEN"
ResponseExample
{  "expirationDate": "2024-01-01T12:00:00Z",  "url": "string"}