Audit Logs
API7 Control Plane records supported authenticated administrative operations. Each entry helps identify who performed an action, when it happened, and the affected resource. Audit logs support security monitoring, troubleshooting, and compliance, but do not cover every request or security event.
Capabilities
- Administrative Tracking: Record supported authenticated changes to routes, services, plugins, and security policies.
- Detailed Context: Capture the operator, event time, resource, request, response, and source of the action.
- Long-Term Retention: Configure the retention period for audit data to meet your compliance needs.
- Export: Export filtered audit logs as JSON or CSV for external analysis and archival.
Audit Log Contents
Each audit log entry includes:
| Field | Description |
|---|---|
| Timestamp | When the operation occurred. |
| Operator | Details of the user who performed the action. |
| Event type | The named action, such as UpdateContactPoint. Use GET /api/audit_logs/event_types to retrieve the supported values. |
| Resource | The ID and available details of the resource associated with the action. |
| Request and response | The HTTP request method, URI, body, and user agent, plus the response status code and body. The entry records the request and response, not a before-and-after object diff. |
| Token name | The token used when the operation was authenticated through the Admin API. |
| Source IP | The IP address from which the request originated. |
| Source | Whether the operation came through the Dashboard or Admin API. ADC operations use the Admin API and are audited with other API operations. |
| Gateway group | The ID of the gateway group associated with the operation, when applicable. |
Coverage and Sensitive Data
API7 creates audit entries only for authenticated operations in the supported audit set. Requests made with dry-run=all and unauthenticated requests, including failed login attempts, are not recorded.
API7 masks known sensitive fields in supported request and response structures. When request or response JSON is captured outside those structures, it is stored without masking. Treat audit logs as sensitive data, restrict access to them, and do not place secrets in ordinary fields.
The Dashboard and Admin API do not provide a supported workflow for editing audit entries. Protect the Control Plane database against direct modification or deletion.
Review Audit Logs in the Dashboard
To view the audit trail, log in to the API7 Dashboard and navigate to the RBAC > Audit Logs section. You can filter the logs by date range, operator, operation type, or specific resource.
Retention
By default, audit logs are retained for 60 days. The Control Plane runs a background cleanup job that deletes audit entries older than the configured retention period. To change the retention period, set audit.retention_days in your Control Plane configuration:
audit:
retention_days: 180
Set a longer retention period if your compliance framework requires extended audit history, or a shorter one to reduce database storage consumption.
Export Audit Logs
Export filtered audit logs as JSON or CSV, then archive the file or import it into an external analysis system.
Compliance and Accountability
For covered operations, audit logs help establish who performed an action and when. Do not rely on audit logs alone to detect unauthenticated activity.
Next Steps
- Configure RBAC to limit who can make administrative changes.
- Review our Trust Center for certifications and security reports.