Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Audit Logs

Aero2 automatically logs security-relevant events. Use the audit API to investigate activity, monitor for suspicious behavior, and meet compliance requirements.

Query Audit Logs

# Recent events (default: 50 per page)
curl https://aero2.dev/api/audit \
  -H "Authorization: Bearer <admin_token>"
 
# Filter by event type
curl "https://aero2.dev/api/audit?event_type=user_login" \
  -H "Authorization: Bearer <admin_token>"
 
# Filter by user
curl "https://aero2.dev/api/audit?user_id=<user_id>" \
  -H "Authorization: Bearer <admin_token>"
 
# Filter by date range
curl "https://aero2.dev/api/audit?start_date=2026-02-01&end_date=2026-02-07" \
  -H "Authorization: Bearer <admin_token>"
 
# Combine filters with pagination
curl "https://aero2.dev/api/audit?event_type=user_login&page=2&limit=25" \
  -H "Authorization: Bearer <admin_token>"

View Available Event Types

curl https://aero2.dev/api/audit/events \
  -H "Authorization: Bearer <admin_token>"

Returns event types with counts, useful for building dashboards:

{
  "event_types": [
    { "event_type": "user_login", "count": 150 },
    { "event_type": "session_revoked", "count": 12 },
    { "event_type": "client_created", "count": 3 }
  ]
}

View Event Details

curl https://aero2.dev/api/audit/<event_id> \
  -H "Authorization: Bearer <admin_token>"

User-Specific Audit History

View all events for a specific user:

curl https://aero2.dev/api/users/<user_id>/audit \
  -H "Authorization: Bearer <admin_token>"

Common Event Types

EventTrigger
user_loginSuccessful authentication
user_logoutUser signed out
user_createdNew user registered
user_updatedUser profile modified
user_deletedUser account removed
session_revokedSingle session revoked
session_revoked_allAll user sessions revoked
client_createdOAuth client registered
client_updatedClient configuration changed
client_deletedClient removed
client_secret_rotatedClient secret regenerated
role_assignedRole given to user
role_removedRole taken from user
idp_createdIdentity provider configured
idp_updatedIdP configuration changed
idp_deletedIdP removed
identity_linkedExternal identity linked
identity_unlinkedExternal identity removed

See Also