Get audit logs

Gets a list of audit logs that match the search criteria.

Required Permissions

Requires a cluster administrator account. Audit logs are retrieved by querying the internal system table (sonar_audits), so accounts that are not cluster administrators receive a table read permission error.

HTTP Request

GET /api/sonar/audit-logs

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/audit-logs?keywords=login&from=2026-06-18%2000:00:00+0900&to=2026-06-18%2023:59:59+0900&limit=50"

Request Parameters

Key	Required	Type	Description	Notes
offset	No	64-bit integer	Number of records to skip	Default: 0
limit	No	64-bit integer	Maximum number of records to load	No limit if unspecified
keywords	No	String list	Search keywords (matched across the entire audit log content)	Multiple keywords allowed
categories	No	String list	Category filter	-
actions	No	String list	Action filter	-
from	No	Date	Start time	Format: `yyyy-MM-dd HH:mm:ssZ`
to	No	Date	End time	Format: `yyyy-MM-dd HH:mm:ssZ`
locale	No	String	Locale for the category and action labels	For example, `ko`, `en`

Success Response

{
  "audit_logs": [
    {
      "id": 0,
      "user_guid": "a1b2c3d4-1111-2222-3333-444455556666",
      "user_name": "admin",
      "remote_ip": "192.0.2.50",
      "module": null,
      "method": "com.logpresso.sonar.msgbus.LoginPlugin.login",
      "params": {"login": "admin"},
      "msg_params": null,
      "error": null,
      "created_at": 1718668800000,
      "user": "admin",
      "time": 1718668800000,
      "result": "Success",
      "category": "Authentication",
      "action": "Login",
      "msg": "\"admin\" has logged in."
    }
  ],
  "total": 1,
  "categories": ["Authentication", "Settings"],
  "actions": ["Login", "Logout"]
}

audit_logs (Array): List of audit log entries that match the search criteria. Each entry includes fields such as category, action, and message localized to the requested locale
- id (32-bit integer): Audit log identifier
- user_guid (String, optional): User GUID
- user_name (String): User name
- remote_ip (String): Source IP address of the request
- module (String, optional): Module name. Always null for this endpoint
- method (String): Method name
- params (Map, optional): Request parameters
- msg_params (Map, optional): Message parameters
- error (String, optional): Error content
- created_at (Date): Creation time. The value is expressed in epoch milliseconds (64-bit integer)
- user (String): User name
- time (Date): Creation time. The value is expressed in epoch milliseconds (64-bit integer)
- result (String): Processing result (localized string)
- category (String, optional): Category (localized string). Included only when an action definition exists
- action (String, optional): Action (localized string). Included only when an action definition exists
- msg (String, optional): Localized log message. Included only when an action definition exists
total (64-bit integer): Total number of records that match the search criteria
categories (Array): Category labels available for building filters (localized strings)
actions (Array): Action labels available for building filters (localized strings)

Error Responses

from or to value has an invalid date format

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "java.text.ParseException: Unparseable date: \"2026-06-18\""
}

offset or limit value is not an integer

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'offset' parameter should be long type"
}

No cluster administrator privileges

HTTP status code 500

{
  "error_code": "general-error",
  "error_msg": "org.araqne.logdb.QueryParseException, type=10606, offset=0, note=null, params={table=sonar_audits}"
}