检索审计日志

按时间范围返回游标分页的操作审计日志列表。

POST /audit/search

检索审计日志

cURL

curl --request POST \
  --url 'https://api.flashcat.cloud/audit/search?app_key=' \
  --header 'Content-Type: application/json' \
  --data '
{
  "start_time": 1712620800,
  "end_time": 1712707200,
  "limit": 20,
  "operations": [
    "template:write:create",
    "template:write:delete"
  ]
}
'

import requests

url = "https://api.flashcat.cloud/audit/search?app_key="

payload = {
    "start_time": 1712620800,
    "end_time": 1712707200,
    "limit": 20,
    "operations": ["template:write:create", "template:write:delete"]
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    start_time: 1712620800,
    end_time: 1712707200,
    limit: 20,
    operations: ['template:write:create', 'template:write:delete']
  })
};

fetch('https://api.flashcat.cloud/audit/search?app_key=', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flashcat.cloud/audit/search?app_key=",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'start_time' => 1712620800,
    'end_time' => 1712707200,
    'limit' => 20,
    'operations' => [
        'template:write:create',
        'template:write:delete'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flashcat.cloud/audit/search?app_key="

	payload := strings.NewReader("{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/audit/search?app_key=")
  .header("Content-Type", "application/json")
  .body("{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.flashcat.cloud/audit/search?app_key=")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}"

response = http.request(request)
puts response.read_body

200

{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "data": {
    "total": 2,
    "search_after_ctx": "",
    "docs": [
      {
        "created_at": 1712700123456,
        "account_id": 10023,
        "member_id": 80011,
        "member_name": "Alice",
        "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
        "ip": "203.0.113.42",
        "operation": "template:write:create",
        "operation_name": "创建模板",
        "body": "{\"template_name\":\"生产默认模板\"}",
        "params": [],
        "is_dangerous": false,
        "is_write": true
      }
    ]
  }
}

{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "InvalidParameter",
    "message": "The specified parameter is not valid."
  }
}

{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "Unauthorized",
    "message": "You are unauthorized."
  }
}

{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "RequestTooFrequently",
    "message": "Request too frequently."
  }
}

{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "InternalError",
    "message": "We encountered an internal error, and it has been reported. Please try again later."
  }
}

​

限制说明

项目	说明
速率限制	每个账户 1,000 次/分钟；50 次/秒
权限要求	审计查看（organization）

​

使用说明

• 时间范围必填。最大跨度 90 天，start_time 和 end_time 均为 Unix 时间戳（秒）。
• 使用上次响应中的 search_after_ctx 获取下一页。该 token 是不透明的，请勿手动构造。
• 可查询的时间窗口受账户许可证限制，超出保留期的查询会静默返回空结果，而不是报错。
• 默认每页 20 条，最大 99 条。

授权

app_key · string · query · 必填

在 Flashduty 控制台 账户 → APP Key 中签发的 app_key。调用任何公开 API 时都必须携带。它等同于所属账户的身份凭证，请妥善保管。

请求体

application/json

审计日志检索的过滤条件，时间范围必填。

start_time · integer<int64> · 必填

检索窗口开始时间，Unix 时间戳（秒）。

示例:

1712620800

end_time · integer<int64> · 必填

检索窗口结束时间，Unix 时间戳（秒）。必须晚于 start_time，最大跨度 90 天。

示例:

1712707200

limit · integer

每页条数。最小 0，最大 99。

必填范围: 0 <= x <= 99

示例:

20

request_id · string

按唯一请求 ID 过滤到单条记录。

search_after_ctx · string

上次响应返回的不透明分页游标。首页留空。

operations · string[]

按操作名称过滤。合法值可通过 POST /audit/operation/list 获取。

person_id · integer<uint64>

按操作人成员 ID 过滤。

is_dangerous · boolean | null

为 true 时只返回高危操作。

is_write · boolean | null

为 true 时只返回写操作；为 false 时只返回读操作。

响应

200

application/json

成功

成功响应结构。2xx 响应中 request_id 标识本次调用（同时出现在 Flashcat-Request-Id 响应头中），data 为接口业务 payload。失败响应使用不同结构，参见 ErrorResponse。

request_id · string · 必填

本次请求的唯一 ID，也会在 Flashcat-Request-Id 响应头中返回。反馈问题时请一并附上。

示例:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

data · object · 必填

游标分页的审计日志检索结果。

Show child attributes