Search Audit Events

SearchAuditEvents returns audit events for paper secrets. Can filter by vault_id, actor (user ID or email), client IP.

POST /api/v1/search/secrets-admin/audit_events

SearchAuditEvents

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.PaperSecretAdmin.SearchAuditEvents(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.PaperSecretAdminServiceSearchAuditEventsResponse != nil {
        // handle response
    }
}

import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript";

const conductoroneSDKTypescript = new ConductoroneSDKTypescript({
  security: {
    bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
    oauth: "<YOUR_OAUTH_HERE>",
  },
});

async function run() {
  const result = await conductoroneSDKTypescript.paperSecretAdmin.searchAuditEvents();

  console.log(result);
}

run();

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "actorEmail": "<string>",
  "actorUserId": "<string>",
  "clientIp": "<string>",
  "pageSize": 123,
  "pageToken": "<string>",
  "vaultId": "<string>"
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events"

payload = {
    "actorEmail": "<string>",
    "actorUserId": "<string>",
    "clientIp": "<string>",
    "pageSize": 123,
    "pageToken": "<string>",
    "vaultId": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    actorEmail: '<string>',
    actorUserId: '<string>',
    clientIp: '<string>',
    pageSize: 123,
    pageToken: '<string>',
    vaultId: '<string>'
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'actorEmail' => '<string>',
    'actorUserId' => '<string>',
    'clientIp' => '<string>',
    'pageSize' => 123,
    'pageToken' => '<string>',
    'vaultId' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"actorEmail\": \"<string>\",\n  \"actorUserId\": \"<string>\",\n  \"clientIp\": \"<string>\",\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"vaultId\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/search/secrets-admin/audit_events")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"actorEmail\": \"<string>\",\n  \"actorUserId\": \"<string>\",\n  \"clientIp\": \"<string>\",\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"vaultId\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "list": [
    {}
  ],
  "nextPageToken": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The PaperSecretAdminServiceSearchAuditEventsRequest message.

actorEmail · string | null

Filter by external email (partial match via full-text search)

actorUserId · string | null

Filter by C1 user ID (internal users)

clientIp · string | null

Filter by client IP (exact match)

pageSize · integer<int32> | null

The pageSize field.

pageToken · string | null

The pageToken field.

vaultId · string | null

Filter by specific vault

Response

200 - application/json

Successful response

The PaperSecretAdminServiceSearchAuditEventsResponse message.

list · object[] | null

List contains OCSF events directly as JSON structs. Follows the same pattern as SystemLogServiceListEventsResponse.

nextPageToken · string | null

The nextPageToken field.