---
title: "Audit APIs"
slug: "audit-apis"
description: "Access Kentik's Audit APIs to retrieve and review audit events, enhancing security and compliance with detailed logs and contextual user action data."
tags: ["Audit APIs", "Audit Events"]
updated: 2026-09-04T19:04:45Z
published: 2026-09-04T19:04:45Z
canonical: "kb.kentik.com/audit-apis"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit APIs

This document provides programmatic specifications for retrieving and reviewing audit events, user actions, and API request details from your Kentik environment.

- **API Version:** `/audit/v202601`
- **Protocol:** HTTPS
- **Format:** JSON

> [!NOTE]
> **Notes:**
> 
> - Audit logs retrieved via the Audit APIs support internal security policies and serve as compensating controls during compliance audits.
> - See [**Kentik APIs**](/v1/docs/apis-overview) for base URLs, authentication specifications, and rate limits.

## API Endpoints

### List Audit Events

Returns a list of audit events. For details on the returned payload structure, see [**List Response**](/v1/docs/audit-apis#list-response-v202601listauditeventsresponse).

**HTTP Request**:

`GET /audit/v202601/events`

#### Query Parameters

| Parameter | Type | Description |
| --- | --- | --- |
| `startTime` | string | UTC date-time string. Defaults to 30 days before `endTime` if not provided. |
| `endTime` | string | Date time in UTC. Defaults to current date/time if not provided. |
| `offset` | uint64 | Pagination offset. Default is `0`. |
| `limit` | uint64 | Number of results to return per page. Default is `100`. |

> [!TIP]
> **TIPS**:
> 
> - Combine `limit` and `offset` to page through results (for example, set `offset=100`, then `offset=200`, until the response array is empty).
> - The API returns events from the last 30 days by default. To optimize query performance, explicitly set both `startTime` and `endTime`.

#### cURL Example

The following is a sample request to the List Audit Events endpoint.

```bash
curl -X GET "https://grpc.api.kentik.com/audit/v202601/events?limit=10&startTime=2026-09-01T12:00:00Z&endTime=2026-09-05T12:00:00Z" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"
```

### Get an Audit Event by ID

Returns a specific audit event by its unique identifier. See [**Get Response**](/v1/docs/audit-apis#get-response-v202601getauditeventresponse) for payload structure details.

**HTTP Request**:

`GET /audit/v202601/events/{id}`

#### Path and Query Parameters

| Parameter | Placement | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | int64 | Yes | Unique identifier of the event. |
| `ctime` | query | date-time | Optional | Timestamp when the event was produced. |

#### cURL Example

The following is a sample request to the Get an Audit Event (By ID) endpoint.

```bash
curl -X GET "https://grpc.api.kentik.com/audit/v202601/events/123456" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"
```

### Get an Audit Event by ID and Time

Returns a specific audit event using both its unique identifier and creation time in the request path.

**HTTP Request**:

`GET /audit/v202601/events/{id}/{ctime}`

#### Path Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | int64 | Yes | Unique identifier of the event. |
| `ctime` | date-time | Yes | Timestamp when the event was produced. |

## **Standard API Responses & Errors**

### **List Response**

When calling the List Audit Events endpoint, the returned JSON wraps the result set in an `events` array:

```json
{
  "events": [
    { /* AuditEvent Object 1 */ },
    { /* AuditEvent Object 2 */ }
  ]
}
```

### Get Response

When calling a Get Audit Event endpoint, the returned JSON wraps the single result in an `event` object:

```json
{
  "event": { /* AuditEvent Object */ }
}
```

### Error Response

If an API request fails, Kentik returns a standard error object containing an error code and message.

| Field | **Type** | **Description** |
| --- | --- | --- |
| `code` | integer (int32) | The numeric error code |
| `message` | string | A human-readable error description |
| `details` | array (protobufAny) | An array of additional error details, if applicable |

## Response Fields

### `Audit Event` Object

The `Audit Event` object defines the attributes returned for audit log entries.

| **Field** | **Type** | Description |
| --- | --- | --- |
| `userId` | string | ID of the user that produced the event. |
| `id` | string (uint64) | Unique identifier of the event. |
| `ctime` | string (date-time) | Timestamp when the event was produced. |
| `apiMethod` | string | HTTP method of the request (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`) |
| `apiPath` | string | URL path of the request. |
| `ipAddress` | string | Client IP Address. |
| `authority` | string | Authority header from the request. |
| `kentikUserId` | string | Kentik user ID extracted from request metadata. |
| `kentikUserEmail` | string | Kentik user email extracted from request metadata. |
| `objectType` | string | The type of object affected by the action. |
| `objectName` | string | Human-readable name of the affected object. |
| `apiAction` | string | The action performed on the object. |
| `source` | string | The source of the request. |
| `objectId` | string | The ID of the affected object. |
| `parentId` | string | The ID of the parent object. |
| `portalPath` | string | Path to view the affected object in the Kentik portal. |
| `eventPayload` | string | Request Payload details. |
| `userAgent` | string | User agent string from the request header. |
| `titleField` | string | Specific title associated with the route or event, if applicable. |
| `generic` | object | Flexible event metadata (see [**Generic Event Object**](/v1/docs/audit-apis#generic-event-object)). |

### `Generic Event` Object

The `Generic Event` object appears inside the `generic` field of an [**Audit Event**](/v1/docs/audit-apis#auditevent-object1) object to provide additional contextual metadata.

| **Field** | **Type** | **Description** |
| --- | --- | --- |
| `eventSource` | string | Attribute source of the audit log. |
| `action` | string | Attribute action of the audit log. |
| `eventType` | string | Attribute type of the audit log. |
| `owner` | string | Attribute user of the audit log. |
| `metadata` | object | A dictionary of key-value pairs containing additional event metadata. |

## Related

- [AI Advisor APIs](/ai-advisor-api.md)
- [Kentik APIs](/apis-overview.md)
- [My Kentik API](/my-kentik-api.md)