List logs

GET

/logs

Retrieves a paginated list of system logs. Optional query parameters allow searching, filtering, and sorting the results.

Authorization

API-Key

headerX-API-KEY<token>

MonoCloud APIs require authentication with an API key. Retrieve your key from the Tenant Settings section of the MonoCloud dashboard and include it in the request header as: X-API-Key: <your_api_key>

Query Parameters

page?integer

The page number to retrieve.

Formatint32

Range1 <= value

Default1

size?integer

The number of logs to return per page.

Formatint32

Range1 <= value <= 50

Default10

filter?string

Optional Lucene-style filter expression used to search by attributes.

sort?string

Sort expression in the format field:direction, where direction is 1 for ascending or -1 for descending. Supported fields include - time_stamp, category, code, type, and name

Response Headers

200

x-Pagination?object

Returns the x-Pagination header

page_size*integer

Number of items returned per page.

Formatint32

current_page*integer

The current page number.

Formatint32

total_count*integer

Total number of items available.

Formatint32

has_previous*boolean

Indicates whether a previous page exists.

has_next*boolean

Indicates whether a next page exists.

x-monocloud-log-window?string

Returns the x-monocloud-log-window header

Response Body

200

application/json

The log entries were retrieved successfully

TypeScript Definitions

Use the response body type in TypeScript.

Returns an array. Each item has the fields below.

Log Response: Represents an audit log entry capturing a system or security event.

id*string

The unique identifier of the log entry.

Formatuuid

time_stamp*integer

Specifies the event time (in Epoch).

Formatdate-time

category*LogCategories

The event category.

values

authentication
Events related to user authentication and sign-in flows.
tokens
Events related to token issuance, refresh, and validation.
consent
Events related to user consent and permission approval.
blocks
Events related to security blocks and enforcement actions.
users
Events related to user lifecycle and profile changes.
user_sessions
Events related to user session creation, termination, and activity.
notifications
Events related to notifications and message delivery.
resources
Events related to identity resources, API resources, and protected backend services.
trust_store
Events related to mTLS trust stores and certificate validation.
clients
Events related to OAuth and OIDC client configuration.
groups
Events related to group management and membership changes.
grants
Events related to user grants and delegated permissions.
policies
Events related to access policies.
network_zones
Events related to network zones.

name*string

The event name.

description*string

A human-readable description of the event.

type*EventTypes

The event severity/type.

values

success
Indicates that the operation completed successfully.
failure
Indicates that the operation failed to complete as expected.
information
Indicates an informational event that does not represent an error or failure.
error
Indicates an error condition encountered during processing.

code*EventCodes

The event code.

values

authorization_succeeded
Indicates a successful authorization request.
authorization_failed
Indicates a failed authorization request (e.g., invalid request, denied by policy).
pushed_authorization_succeeded
Indicates a successful Pushed Authorization Request (PAR).
pushed_authorization_failed
Indicates a failed Pushed Authorization Request (PAR).
client_authentication_succeeded
Indicates a successful OAuth client authentication.
client_authentication_failed
Indicates a failed OAuth client authentication (e.g., invalid client credentials).
api_authentication_succeeded
Indicates a successful API authentication.
api_authentication_failed
Indicates a failed API authentication (e.g., invalid or missing access token).
password_flow_authentication_succeeded
Indicates a successful Resource Owner Password Credentials (ROPC) authentication flow.
password_flow_authentication_failed
Indicates a failed Resource Owner Password Credentials (ROPC) authentication flow.
device_authorization_succeeded
Indicates a successful device authorization flow.
device_authorization_failed
Indicates a failed device authorization flow.
mtls_authentication_succeeded
Indicates a successful client certificate (mTLS) authentication.
mtls_authentication_failed
Indicates a failed client certificate (mTLS) authentication.
user_lookup_failed
Indicates a failed identifier-based sign-in attempt (e.g., username or email lookup).
external_provider_authentication_failed
Indicates a failed external identity provider sign-in.
user_sign_in_succeeded
Indicates a successful interactive user sign-in.
user_sign_in_failed
Indicates a failed interactive user sign-in attempt.
user_registration_succeeded
Indicates a successful user registration.
user_sign_out_succeeded
Indicates a user sign-out event.
token_issuance_succeeded
Indicates a successful token issuance.
token_issuance_failed
Indicates a failed token issuance attempt.
token_introspection_succeeded
Indicates a successful token introspection request.
token_introspection_failed
Indicates a failed token introspection request.
token_revocation_succeeded
Indicates a successful token revocation.
token_revocation_failed
Indicates a failed token revocation attempt.
consent_granted
Indicates that user consent was successfully granted for the requested scopes.
consent_denied
Indicates that user consent was denied or not granted for the requested scopes.
identifier_ip_blocked
Indicates that an IP address was blocked for a specific identifier.
user_account_blocked
Indicates that a user account was blocked.
user_account_unblocked
Indicates that a user account was unblocked.
user_account_ip_blocked
Indicates that an IP address was blocked for a user account.
user_account_ip_unblocked
Indicates that an IP address block was removed from a user account.
user_account_all_unblocked
Indicates that all blocks were removed from a user account.
user_account_all_ip_blocks_removed
Indicates that all IP address blocks were removed from a user account.
user_created
Indicates that a user account was successfully created.
user_deleted
Indicates that a user account was deleted.
user_password_reset_succeeded
Indicates that a user successfully completed a password reset.
user_added_to_group
Indicates that a user was added to a group.
user_removed_from_group
Indicates that a user was removed from a group.
user_session_revoked
Indicates that a specific user session was revoked.
user_sessions_revoked_all
Indicates that all active sessions for a user were revoked.
user_sessions_deleted_all
Indicates that all sessions for a user were permanently deleted.
sign_in_email_sending_succeeded
Indicates that a sign-in email notification was successfully sent.
verification_email_sending_succeeded
Indicates that a verification email notification was successfully sent.
welcome_email_sending_succeeded
Indicates that a welcome email notification was successfully sent.
password_change_email_sending_succeeded
Indicates that a password change confirmation email was successfully sent.
password_reset_email_sending_succeeded
Indicates that a password reset email notification was successfully sent.
user_blocked_email_sending_succeeded
Indicates that a user blocked notification email was successfully sent.
sign_in_sms_sending_succeeded
Indicates that a sign-in SMS notification was successfully sent.
verification_sms_sending_succeeded
Indicates that a verification SMS notification was successfully sent.
password_reset_sms_sending_succeeded
Indicates that a password reset SMS notification was successfully sent.
email_sending_failed
Indicates that sending an email notification failed.
sms_sending_failed
Indicates that sending an SMS notification failed.
api_resource_created
Indicates that an API resource was created.
api_resource_updated
Indicates that an API resource was updated.
api_resource_deleted
Indicates that an API resource was deleted.
api_resource_secret_created
Indicates that a secret was created for an API resource.
api_resource_secret_deleted
Indicates that a secret was deleted from an API resource.
api_access_policy_created
Indicates that an API access policy was created.
api_access_policy_updated
Indicates that an API access policy was updated.
api_access_policy_deleted
Indicates that an API access policy was deleted.
trust_store_created
Indicates that a trust store was created.
trust_store_updated
Indicates that a trust store was updated.
trust_store_deleted
Indicates that a trust store was deleted.
trust_store_revocation_added
Indicates that a certificate revocation list (CRL) was added to the trust store.
trust_store_revocation_removed
Indicates that a certificate revocation list (CRL) was removed from the trust store.
trust_store_certificate_banned
Indicates that a certificate was banned in the trust store.
trust_store_certificate_unbanned
Indicates that a previously banned certificate was unbanned in the trust store.
trust_store_svid_banned
Indicates that an SVID was banned in the trust store.
trust_store_svid_unbanned
Indicates that a previously banned SVID was unbanned in the trust store.
client_created
Indicates that a client application was created.
client_updated
Indicates that a client application was updated.
client_deleted
Indicates that a client application was deleted.
client_secret_created
Indicates that a client secret was created.
client_secret_deleted
Indicates that a client secret was deleted.
client_added_to_group
Indicates that a client application was added to a group.
client_removed_from_group
Indicates that a client application was removed from a group.
group_created
Indicates that a group was created.
group_updated
Indicates that a group was updated.
group_deleted
Indicates that a group was deleted.
user_grants_revoked
Indicates that all grants associated with a user were revoked.
authorization_code_revoked
Indicates that an authorization code grant was revoked.
user_consent_revoked
Indicates that a user consent grant was revoked.
reference_token_revoked
Indicates that a reference token grant was revoked.
refresh_token_revoked
Indicates that a refresh token grant was revoked.
usage_threshold_reached
Indicates that a usage threshold was reached.
network_zone_created
Indicates that a network zone was created.
network_zone_updated
Indicates that a network zone was updated.
network_zone_deleted
Indicates that a network zone was deleted.

message?|

The message associated with the event.

system*

System/environment details for the event.

request*

Request details for the event.

source?|

The source endpoint or path that generated the event.

actor*

The actor that performed the action.

targets*array<>

The targets affected by the action.

client?null|

details?null|

Errors

401Unauthorized

403Forbidden

curl -X GET "https://your-domain.us.monocloud.com/api/logs?page=1&size=10&filter=authentication&sort=category%3A1" \  -H "X-API-KEY: <token>"

[  {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "time_stamp": 0,    "category": "authentication",    "name": "string",    "description": "string",    "type": "success",    "code": "authorization_success",    "message": null,    "system": {      "activity_id": null,      "process_id": 0,      "local_ip": {        "ip": "string",        "version": "string"      }    },    "request": {      "trace_id": null,      "user_agent": null,      "remote_ip": null,      "location": null,      "is_mtls": true,      "is_spiffe": true,      "trust_store_id": null,      "certificate_subject": null,      "certificate_issuer": null,      "certificate_thumbprint": null,      "certificate_serial_number": null,      "certificate_san_uris": null,      "certificate_san_dns_names": null,      "certificate_san_ip_addresses": null,      "certificate_san_emails": null,      "certificate_san_upns": null,      "spiffe_id": null    },    "source": null,    "actor": {      "type": "user",      "id": null,      "name": null,      "identifier": null,      "session_id": null    },    "targets": [      {        "type": "user",        "id": null,        "name": null,        "identifier": null      }    ],    "client": null,    "details": null  }]

AuthorizationCopy Anchor Link

Query ParametersCopy Anchor Link

Response HeadersCopy Anchor Link

Response BodyCopy Anchor Link

ErrorsCopy Anchor Link

Authorization

Query Parameters

Response Headers

Response Body

Errors