Skip to content
Cloudflare API
Start here
API Reference
Accounts
Logs

Audit

Get account audit logs (Version 2)
accounts.logs.audit.list(AuditListParams**kwargs) -> SyncCursorPaginationAfter[AuditListResponse]
GET/accounts/{account_id}/logs/audit
Get resource change history from an account audit log entry (Version 2)
accounts.logs.audit.history(strid, AuditHistoryParams**kwargs) -> AuditHistoryResponse
GET/accounts/{account_id}/logs/audit/{id}/history
List account audit log product categories (Version 2)
accounts.logs.audit.product_categories(AuditProductCategoriesParams**kwargs) -> SyncSinglePage[AuditProductCategoriesResponse]
GET/accounts/{account_id}/logs/audit/product_categories
ModelsExpand Collapse
class AuditListResponse: …
id: Optional[str]

A unique identifier for the audit log entry.

maxLength32
account: Optional[Account]

Contains account related information.

id: Optional[str]

A unique identifier for the account.

name: Optional[str]

A string that identifies the account name.

action: Optional[Action]

Provides information about the action performed.

description: Optional[str]

A short description of the action performed.

result: Optional[str]

The result of the action, indicating success or failure.

time: Optional[datetime]

A timestamp indicating when the action was logged.

formatdate-time
type: Optional[str]

A short string that describes the action that was performed.

actor: Optional[Actor]

Provides details about the actor who performed the action.

id: Optional[str]

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context: Optional[Literal["api", "api_key", "api_token", 3 more]]

The context in which the action was initiated.

  • api: The action was performed through the API. The specific credential type was not recorded.
  • api_key: The action was authenticated with a Cloudflare Global API Key.
  • api_token: The action was authenticated with an API token.
  • dash: The action was performed through the Cloudflare dashboard.
  • oauth: The action was authenticated with an OAuth token.
  • origin_ca_key: The action was authenticated with an Origin CA key.
One of the following:
"api"
"api_key"
"api_token"
"dash"
"oauth"
"origin_ca_key"
email: Optional[str]

The email of the actor who performed the action.

formatemail
ip_address: Optional[str]

The IP address of the request that performed the action.

token_id: Optional[str]

The API token ID when the actor context is an api_token or oauth.

token_name: Optional[str]

The API token name when the actor context is an api_token or oauth.

type: Optional[Literal["account", "cloudflare_admin", "delegated_service", 2 more]]

The type of actor.

One of the following:
"account"
"cloudflare_admin"
"delegated_service"
"system"
"user"
raw: Optional[Raw]

Provides raw information about the request and response.

cf_rayid: Optional[str]

The Cloudflare Ray ID for the request.

method: Optional[str]

The HTTP method of the request.

status_code: Optional[int]

The HTTP response status code returned by the API.

uri: Optional[str]

The URI of the request.

user_agent: Optional[str]

The client’s user agent string sent with the request.

resource: Optional[Resource]

Provides details about the affected resource.

id: Optional[str]

The unique identifier for the affected resource.

product: Optional[str]

The Cloudflare product associated with the resource.

request: Optional[object]
response: Optional[object]
scope: Optional[object]

The scope of the resource.

type: Optional[str]

The type of the resource.

zone: Optional[Zone]

Provides details about the zone affected by the action.

id: Optional[str]

A string that identifies the zone id.

name: Optional[str]

A string that identifies the zone name.

List[AuditHistoryResponseItem]
id: Optional[str]

A unique identifier for the audit log entry.

maxLength32
account: Optional[AuditHistoryResponseItemAccount]

Contains account related information.

id: Optional[str]

A unique identifier for the account.

name: Optional[str]

A string that identifies the account name.

action: Optional[AuditHistoryResponseItemAction]

Provides information about the action performed.

description: Optional[str]

A short description of the action performed.

result: Optional[str]

The result of the action, indicating success or failure.

time: Optional[datetime]

A timestamp indicating when the action was logged.

formatdate-time
type: Optional[str]

A short string that describes the action that was performed.

actor: Optional[AuditHistoryResponseItemActor]

Provides details about the actor who performed the action.

id: Optional[str]

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context: Optional[Literal["api", "api_key", "api_token", 3 more]]

The context in which the action was initiated.

  • api: The action was performed through the API. The specific credential type was not recorded.
  • api_key: The action was authenticated with a Cloudflare Global API Key.
  • api_token: The action was authenticated with an API token.
  • dash: The action was performed through the Cloudflare dashboard.
  • oauth: The action was authenticated with an OAuth token.
  • origin_ca_key: The action was authenticated with an Origin CA key.
One of the following:
"api"
"api_key"
"api_token"
"dash"
"oauth"
"origin_ca_key"
email: Optional[str]

The email of the actor who performed the action.

formatemail
ip_address: Optional[str]

The IP address of the request that performed the action.

token_id: Optional[str]

The API token ID when the actor context is an api_token or oauth.

token_name: Optional[str]

The API token name when the actor context is an api_token or oauth.

type: Optional[Literal["account", "cloudflare_admin", "delegated_service", 2 more]]

The type of actor.

One of the following:
"account"
"cloudflare_admin"
"delegated_service"
"system"
"user"
raw: Optional[AuditHistoryResponseItemRaw]

Provides raw information about the request and response.

cf_rayid: Optional[str]

The Cloudflare Ray ID for the request.

method: Optional[str]

The HTTP method of the request.

status_code: Optional[int]

The HTTP response status code returned by the API.

uri: Optional[str]

The URI of the request.

user_agent: Optional[str]

The client’s user agent string sent with the request.

resource: Optional[AuditHistoryResponseItemResource]

Provides details about the affected resource.

id: Optional[str]

The unique identifier for the affected resource.

product: Optional[str]

The Cloudflare product associated with the resource.

request: Optional[object]
response: Optional[object]
scope: Optional[object]

The scope of the resource.

type: Optional[str]

The type of the resource.

zone: Optional[AuditHistoryResponseItemZone]

Provides details about the zone affected by the action.

id: Optional[str]

A string that identifies the zone id.

name: Optional[str]

A string that identifies the zone name.

class AuditProductCategoriesResponse: …

A predefined product category and the resource products it expands to.

label: Optional[str]

A human-readable label for the product category.

products: Optional[List[Product]]

The resource products that the product category expands to.

label: Optional[str]

A human-readable label for the product.

value: Optional[str]

The resource_product value that the product category expands to.

value: Optional[str]

The product category identifier used with the product_category filter.