Authdog audit logs record authentication and administrative activity for investigation, compliance, and operational monitoring. Environment logs cover identity activity; organization logs cover organization-level changes.
Review logs in the console
Open Audit in the Authdog console, then select the intended project and environment. Filter by time, event category, event type, user, browser, operating system, location, external ID, or event details.
Start with a narrow time range and a known user or event type. Expand only after confirming the relevant timestamp and environment.
Environment records can include event type and category, timestamp, tenant, application, environment, organization, provider, external ID, remote IP, user agent, user summary, location, and JSON event payload. Fields are nullable because context varies by event source.
Organization records can include actor, authentication method, resource type and ID, previous and new values, remote IP, user agent, and environment context.
Query environment logs with the REST API
Public REST endpoints use https://api.authdog.com/v1 and Bearer authentication. Keep the API token server-side; see API for the general conventions.
curl --get \
"https://api.authdog.com/v1/tenants/$TENANT_ID/environments/$ENVIRONMENT_ID/audit/logs" \
-H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
--data-urlencode "startDateTime=2026-07-01T00:00:00Z" \
--data-urlencode "endDateTime=2026-07-02T00:00:00Z" \
--data-urlencode "eventTypes=SIGNIN_SUCCESS,MFA_SIGNIN_FAILURE" \
--data-urlencode "limit=100"The response contains logs, total, and optional meta. Pagination uses numeric offset and limit; maximum limit is 500. Supported filters include:
startDateTime,endDateTime,from,to, orrelativeTimeeventTypeor comma-separatedeventTypeseventCategoryor comma-separatedcategoriessearchQuery,eventDetailsSearch, orexternalIdSearch- comma-separated
userIds,browsers,operatingSystems, orlocations
Treat event names as catalog values rather than guessing strings.
Discover event types
Use metadata endpoints to build filters dynamically:
curl \
"https://api.authdog.com/v1/tenants/$TENANT_ID/environments/$ENVIRONMENT_ID/audit/event-types/catalog" \
-H "Authorization: Bearer $AUTHDOG_API_TOKEN"Available routes:
GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-metadata: observed categories, counts, types, and sample payloads for the selected time range.GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-types: grouped event types, including catalog-backed zero-count entries where available.GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-types/catalog: centralized type/category catalog.
Do not hard-code an exhaustive event list. New catalog entries may appear without breaking the API.
Query organization logs
curl --get \
"https://api.authdog.com/v1/organizations/$ORGANIZATION_ID/audit/logs" \
-H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
--data-urlencode "categories=organization_management,tenant_management" \
--data-urlencode "limit=100"The organization log endpoint supports time, event type/category, search, and resource type filters. Maximum limit is 500.
Investigate an incident
- Record the tenant, environment, user, and UTC time range.
- Find the initial event and note its event ID, actor, remote IP, provider, and user agent.
- Correlate neighboring authentication, MFA, user-management, and secret-management events.
- Preserve raw JSON before taking remediation action.
- Revoke sessions or credentials as needed.
- Confirm remediation produced expected follow-up events.
Event payloads are source-specific. Parse defensively, preserve unknown fields, and never make authorization decisions from audit data.
Security and retention
Audit responses may contain personal data, IP addresses, and event details. Restrict API scopes, encrypt exports, set destination retention, and avoid copying payloads into tickets without redaction.
The Authdog API exposes recorded data, but this page does not promise a fixed retention period or a tamper-evident external archive. If regulation requires immutable long-term retention, export events to controlled SIEM or storage and document the verification process.