Documentation Index

Fetch the complete documentation index at: https://kb.kentik.com/llms.txt

Use this file to discover all available pages before exploring further.

Kentik has joined Infoblox! Read the blog post

Audit APIs

New
  • Published on Sep 4, 2026
  • 2 minute(s) read
  • Ben F
 Prev Next

The Audit APIs provide programmatic access to retrieve and review audit events from your Kentik environment. These APIs enable you to list audit logs and fetch specific event details, including enriched contextual information about user actions and API requests.

  • API Version: /audit/v202601

  • Protocol: HTTPS

  • Format: JSON

Notes:

  • For an overview of Kentik API usage, including base URLs, auth, rate limiting, etc, see Kentik APIs.

  • Audit logs retrieved via this API can support your organization's internal security policies and serve as compensating controls during compliance audits.

API Endpoints

List Audit Events

This endpoint returns a list of audit events. See List Response.

Endpoint: GET /audit/v202601/events

Query Parameters

  • startTime (string): Date time in UTC. Defaults to 30 days before end_time if not provided.

  • endTime (string): Date time in UTC. Defaults to current date/time if not provided.

  • offset (uint64): Pagination offset. Default is 0.

  • limit (uint64): Number of results to return. Default is 100.

TIPS:

  • Use a combination of limit and offset to page through results, e.g., set offset=100, then offset=200, until the response returns empty.

  • The API returns events from the last 30 days by default. To improve response times, always explicitly set both the startTime and endTime.

cURL Example

The following is a sample request to the List Audit Events endpoint.

curl -X GET "https://grpc.api.kentik.com/audit/v202601/events?limit=10&startTime=2026-09-01T12:00:00Z&endTime=2026-09-05T12:00:00Z" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"

Get an Audit Event (By ID)

This endpoint returns a specific audit event.

Endpoint: GET /audit/v202601/events/{id}

Query Parameters

  • id (path, int64, required): Unique identifier of the event.

  • ctime (query, date-time, optional): Timestamp when the event was produced.

cURL Example

The following is a sample request to the Get an Audit Event (By ID) endpoint.

curl -X GET "https://grpc.api.kentik.com/audit/v202601/events/123456" \
  -H "X-CH-Auth-Email: your-email@company.com" \
  -H "X-CH-Auth-API-Token: your-api-token"

Get an Audit Event (By ID and Time)

This endpoint returns a specific audit event using both ID and creation time in the path.

Endpoint: GET /audit/v202601/events/{id}/{ctime}

Path Parameters

  • id (int64, required): Unique identifier of the event.

  • ctime (date-time, required): Timestamp when the event was produced.

Standard API Responses & Errors

List Response

When calling the List Audit Events endpoint, the returned JSON wraps the results in an events array:

{
  "events": [
    { /* AuditEvent Object 1 */ },
    { /* AuditEvent Object 2 */ }
  ]
}

Get Response

When calling a Get Audit Event endpoint, the returned JSON wraps the single result in an event object:

{
  "event": { /* AuditEvent Object */ }
}

Error Response

If an API request fails, Kentik returns a standard error object containing a status code and message.

Field

Type

Description

code

integer (int32)

The numeric error code

message

string

A human-readable error description

details

array (protobufAny)

An array of additional error details, if applicable

Response Fields

AuditEvent Object

Field

Type

Description

userId

string

ID of the user that produced the event

id

string (uint64)

Unique identifier of the event

ctime

string (date-time)

Timestamp when the event was produced

apiMethod

string

HTTP method of the request (GET, POST, PUT, PATCH, DELETE)

apiPath

string

URL path of the request

ipAddress

string

Client IP Address

authority

string

Authority header from the request

kentikUserId

string

Kentik user ID extracted from request metadata

kentikUserEmail

string

Kentik user email extracted from request metadata

objectType

string

The type of object that was affected

objectName

string

Human-readable name of the affected object

apiAction

string

The action performed on the object

source

string

The source of the request

objectId

string

The ID of the affected object

parentId

string

The ID of the parent object

portalPath

string

Path to view the affected object

eventPayload

string

Request Payload

userAgent

string

User agent

titleField

string

Specific title associated with the route or event, if applicable.

generic

object

Flexible event metadata (see Generic Event Object).

Generic Event Object

This object appears inside the generic field of an AuditEvent and provides flexible metadata for the event.

Field

Type

Description

eventSource

string

Attribute Source of Audit log

action

string

Attribute Action of Audit log

eventType

string

Attribute Type of Audit log

owner

string

Attribute User of Audit log

metadata

object

A generic dictionary of string key/value pairs containing additional event metadata

Related articles