Kentik has joined Infoblox! Read the blog post

Press CTRL+K to open search

Audit APIs

  • Updated on Sep 4, 2026
  • Published on Sep 4, 2026
  • 2 minute(s) read
  • Ben F
  • AC
 Prev Next

This document provides programmatic specifications for retrieving and reviewing audit events, user actions, and API request details from your Kentik environment.

  • API Version: /audit/v202601

  • Protocol: HTTPS

  • Format: JSON

Notes:

  • Audit logs retrieved via the Audit APIs support internal security policies and serve as compensating controls during compliance audits.

  • See Kentik APIs for base URLs, authentication specifications, and rate limits.

API Endpoints

List Audit Events

Returns a list of audit events. For details on the returned payload structure, see List Response.

HTTP Request:

GET /audit/v202601/events

Query Parameters

Parameter

Type

Description

startTime

string

UTC date-time string. Defaults to 30 days before endTime if not provided.

endTime

string

Date time in UTC. Defaults to current date/time if not provided.

offset

uint64

Pagination offset. Default is 0.

limit

uint64

Number of results to return per page. Default is 100.

TIPS:

  • Combine limit and offset to page through results (for example, set offset=100, then offset=200, until the response array is empty).

  • The API returns events from the last 30 days by default. To optimize query performance, explicitly set both startTime and endTime.

cURL Example

The following is a sample request to the List Audit Events endpoint.

curl -X GET "https://grpc.api.kentik.com/audit/v202601/events?limit=10&startTime=2026-09-01T12:00:00Z&endTime=2026-09-05T12:00:00Z" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"

Get an Audit Event by ID

Returns a specific audit event by its unique identifier. See Get Response for payload structure details.

HTTP Request:

GET /audit/v202601/events/{id}

Path and Query Parameters

Parameter

Placement

Type

Required

Description

id

path

int64

Yes

Unique identifier of the event.

ctime

query

date-time

Optional

Timestamp when the event was produced.

cURL Example

The following is a sample request to the Get an Audit Event (By ID) endpoint.

curl -X GET "https://grpc.api.kentik.com/audit/v202601/events/123456" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"

Get an Audit Event by ID and Time

Returns a specific audit event using both its unique identifier and creation time in the request path.

HTTP Request:

GET /audit/v202601/events/{id}/{ctime}

Path Parameters

Parameter

Type

Required

Description

id

int64

Yes

Unique identifier of the event.

ctime

date-time

Yes

Timestamp when the event was produced.

Standard API Responses & Errors

List Response

When calling the List Audit Events endpoint, the returned JSON wraps the result set in an events array:

{
  "events": [
    { /* AuditEvent Object 1 */ },
    { /* AuditEvent Object 2 */ }
  ]
}

Get Response

When calling a Get Audit Event endpoint, the returned JSON wraps the single result in an event object:

{
  "event": { /* AuditEvent Object */ }
}

Error Response

If an API request fails, Kentik returns a standard error object containing an error code and message.

Field

Type

Description

code

integer (int32)

The numeric error code

message

string

A human-readable error description

details

array (protobufAny)

An array of additional error details, if applicable

Response Fields

Audit Event Object

The Audit Event object defines the attributes returned for audit log entries.

Field

Type

Description

userId

string

ID of the user that produced the event.

id

string (uint64)

Unique identifier of the event.

ctime

string (date-time)

Timestamp when the event was produced.

apiMethod

string

HTTP method of the request (GET, POST, PUT, PATCH, DELETE)

apiPath

string

URL path of the request.

ipAddress

string

Client IP Address.

authority

string

Authority header from the request.

kentikUserId

string

Kentik user ID extracted from request metadata.

kentikUserEmail

string

Kentik user email extracted from request metadata.

objectType

string

The type of object affected by the action.

objectName

string

Human-readable name of the affected object.

apiAction

string

The action performed on the object.

source

string

The source of the request.

objectId

string

The ID of the affected object.

parentId

string

The ID of the parent object.

portalPath

string

Path to view the affected object in the Kentik portal.

eventPayload

string

Request Payload details.

userAgent

string

User agent string from the request header.

titleField

string

Specific title associated with the route or event, if applicable.

generic

object

Flexible event metadata (see Generic Event Object).

Generic Event Object

The Generic Event object appears inside the generic field of an Audit Event object to provide additional contextual metadata.

Field

Type

Description

eventSource

string

Attribute source of the audit log.

action

string

Attribute action of the audit log.

eventType

string

Attribute type of the audit log.

owner

string

Attribute user of the audit log.

metadata

object

A dictionary of key-value pairs containing additional event metadata.

Related articles