Next.js

Authdog audit logs record authentication and administrative activity for investigation, compliance, and operational monitoring. Environment logs cover identity activity; organization logs cover organization-level changes.

Review logs in the console

Open Audit in the Authdog console, then select the intended project and environment. Filter by time, event category, event type, user, browser, operating system, location, external ID, or event details.

Start with a narrow time range and a known user or event type. Expand only after confirming the relevant timestamp and environment.

Environment records can include event type and category, timestamp, tenant, application, environment, organization, provider, external ID, remote IP, user agent, user summary, location, and JSON event payload. Fields are nullable because context varies by event source.

Organization records can include actor, authentication method, resource type and ID, previous and new values, remote IP, user agent, and environment context.

Query environment logs with the REST API

Public REST endpoints use https://api.authdog.com/v1 and Bearer authentication. Keep the API token server-side; see API for the general conventions.

1234567curl --get \
  "https://api.authdog.com/v1/tenants/$TENANT_ID/environments/$ENVIRONMENT_ID/audit/logs" \
  -H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
  --data-urlencode "startDateTime=2026-07-01T00:00:00Z" \
  --data-urlencode "endDateTime=2026-07-02T00:00:00Z" \
  --data-urlencode "eventTypes=SIGNIN_SUCCESS,MFA_SIGNIN_FAILURE" \
  --data-urlencode "limit=100"

The response contains logs, total, and optional meta. Pagination uses numeric offset and limit; maximum limit is 500. Supported filters include:

startDateTime, endDateTime, from, to, or relativeTime
eventType or comma-separated eventTypes
eventCategory or comma-separated categories
searchQuery, eventDetailsSearch, or externalIdSearch
comma-separated userIds, browsers, operatingSystems, or locations

Treat event names as catalog values rather than guessing strings.

Discover event types

Use metadata endpoints to build filters dynamically:

123curl \
  "https://api.authdog.com/v1/tenants/$TENANT_ID/environments/$ENVIRONMENT_ID/audit/event-types/catalog" \
  -H "Authorization: Bearer $AUTHDOG_API_TOKEN"

Available routes:

GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-metadata: observed categories, counts, types, and sample payloads for the selected time range.
GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-types: grouped event types, including catalog-backed zero-count entries where available.
GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-types/catalog: centralized type/category catalog.

Do not hard-code an exhaustive event list. New catalog entries may appear without breaking the API.

Record a custom action

Register the name in the console first: Audit, then Custom actions. Registration is per environment. The name then appears in the event-type catalog under custom with a count of 0.

A name is 2–64 characters, starts with a letter, and uses A–Z, digits, and underscores. Spaces and hyphens become underscores. The API stores the uppercase form, so invoice paid and invoice-paid are both INVOICE_PAID. An optional description is capped at 280 characters. Saving the same name again updates the description.

12345curl -X POST \
  "https://api.authdog.com/v1/events/audit" \
  -H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action":"INVOICE_PAID","external_id":"inv_1042","payload":{"amount":1280}}'

The environment comes from the API credential. The path does not take a tenant or environment id. A name that is not registered for that environment is rejected. A successful response is { "event_type": "INVOICE_PAID" }.

payload is a JSON object. Authdog sets origin to api and channel to api.audit_action, replacing any caller values for those keys. The stored payload cannot exceed 8192 characters. external_id is the subject the event is about. Omit it and the log stores -.

The event category is custom. Removing the registration does not delete events already written. If no event was recorded, the name leaves the catalog.

Query organization logs

12345curl --get \
  "https://api.authdog.com/v1/organizations/$ORGANIZATION_ID/audit/logs" \
  -H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
  --data-urlencode "categories=organization_management,tenant_management" \
  --data-urlencode "limit=100"

The organization log endpoint supports time, event type/category, search, and resource type filters. Maximum limit is 500.

Investigate an incident

Record the tenant, environment, user, and UTC time range.
Find the initial event and note its event ID, actor, remote IP, provider, and user agent.
Correlate neighboring authentication, MFA, user-management, and secret-management events.
Preserve raw JSON before taking remediation action.
Revoke sessions or credentials as needed.
Confirm remediation produced expected follow-up events.

Event payloads are source-specific. Parse defensively, preserve unknown fields, and never make authorization decisions from audit data.

Security and retention

Audit responses may contain personal data, IP addresses, and event details. Restrict API scopes, encrypt exports, set destination retention, and avoid copying payloads into tickets without redaction.

The Authdog API exposes recorded data, but this page does not promise a fixed retention period or a tamper-evident external archive for the event stream. Export artifacts (the CSV or JSON files produced by an export job) are deleted 30 days after the job is created. If regulation requires immutable long-term retention, export events to controlled SIEM or storage and document the verification process.

To record a business action that is not in the built-in catalog, register a custom action and post it with the API credential for that environment.

To export a time window on demand, use the events export API (POST /v1/events/exports, then download the finished CSV or JSON artifact) or the Export control on the console audit view. Exports contain only the environment the credential belongs to. For continuous retention, stream events to your own platform with a SIEM channel and manage the lifecycle there.

Audit trail vs Lidar

Audit logs record what happened. They are not threat decisions by themselves. Lidar correlates the auth event stream and raises Signals when detectors mark activity suspicious. Use audit events to investigate and confirm remediation; use Lidar for identity-aware detections in the console. Forwarding the raw stream to an external platform is SIEM channel delivery, not Lidar.

Audit logs