{ "openapi": { "info": { "title": "audit", "description": "Tamperproof audit trail", "version": "2", "x-pangea-ui-schema": { "groups": [ { "key": "config-management", "slug": "config-management", "label": "Config Management" } ] } }, "servers": [ { "url": "https://audit.aws.us.pangea.cloud", "description": "Pangea regional service cluster" }, { "url": "https://audit.aws.us-east.pangea.cloud", "description": "Pangea regional service cluster" }, { "url": "https://audit.aws.us-west-2.pangea.cloud", "description": "Pangea regional service cluster" }, { "url": "https://audit.aws.eu.pangea.cloud", "description": "Pangea regional service cluster" } ], "paths": { "/v1/log": { "post": { "operationId": "audit_post_v1_log", "summary": "Log entry", "description": "Create a log entry in the Secure Audit Log.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditLogRequest", "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1log/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Record has been persisted successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1log/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditLogResponse" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/log_stream": { "post": { "operationId": "audit_post_v1_log_stream", "x-pangea-ui-schema": { "disableInteractive": true }, "summary": "Log streaming endpoint", "description": "This API allows third-party vendors like Auth0 to stream log events to this endpoint. The payload structure may vary across different vendors. Please refer to examples in the [SDKs](/docs/sdk) to test this functionality and consult the [Log Streaming](/docs/audit/integrations#third-party-log-events) documentation for details.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": {}, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1log_stream/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1log_stream/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "properties": {} } } } } }, "description": "No description provided" }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/search": { "post": { "operationId": "audit_post_v1_search", "summary": "Search logs", "description": "Search the Secure Audit Log.", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "search-the-log", "type": "object", "additionalProperties": false, "properties": { "query": { "type": "string", "description": "Natural search string; a space-separated list of case-sensitive values used to search for records, which includes the optional `:` prefix to limit the search to a specific field. Values with a space can be enclosed in double-quote (`\"`) characters:\n\n * `\"search text\"`: any field contains \"search text\"\n * `actor:\"Jane Doe\"`: the actor field contains \"Jane Doe\"\n * `actor:alice target:bob sent`: actor contains \"alice\", target contains \"bob\", and any field contains \"sent\".\n\n The following optional prefixes are supported: `action:`, `actor:`, `message:`, `new:`, `old:`, `source:`, `status:`, `target:`.", "examples": [ "actor:\"Jane Doe\" target:cosmos", "\"viewed x-ray\"" ] }, "start": { "description": "The start of the time range to perform the search on. Defaults to 14 days of data.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "end": { "description": "The end of the time range to perform the search on. All records up to the latest if left out.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "max_results": { "type": "integer", "description": "Maximum number of results to return.", "minimum": 1, "maximum": 10000 }, "verbose": { "type": "boolean", "description": "If true, include the root hash of the tree and the membership proof for each record.", "default": true }, "limit": { "type": "integer", "description": "Number of audit records to include from the first page of the results." }, "order": { "type": "string", "description": "Specify the sort order of the response.", "enum": ["asc", "desc"] }, "order_by": { "type": "string", "description": "Name of column to sort the results by.", "enum": [ "actor", "action", "message", "received_at", "source", "status", "target", "timestamp" ] }, "search_restriction": { "type": "object", "description": "A list of keys to restrict the search results to. Useful for partitioning data available to the query string.", "properties": { "actor": { "type": "array", "description": "A list of actors to restrict the search to.", "items": { "type": "string" } }, "action": { "type": "array", "description": "A list of actions to restrict the search to.", "items": { "type": "string" } }, "source": { "type": "array", "description": "A list of sources to restrict the search to.", "items": { "type": "string" } }, "status": { "type": "array", "description": "A list of statuses to restrict the search to.", "items": { "type": "string" } }, "target": { "type": "array", "description": "A list of targets to restrict the search to.", "items": { "type": "string" } }, "tenant_id": { "type": "array", "description": "A list of tenant_ids to restrict the search to.", "items": { "type": "string" } } }, "additionalProperties": false, "required": [] }, "return_context": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ReturnFPEContext" } }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1search/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Search has completed successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1search/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "required": ["count", "events"], "properties": { "count": { "type": "integer", "description": "The total number of events that were returned by the search." }, "events": { "type": "array", "description": "A list of matching audit event results.", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSearchResult" } }, "expires_at": { "type": "string", "description": "The time when the results will no longer be available to page through via the results API.", "format": "date-time" }, "id": { "type": "string", "description": "Identifier to supply to search_results API to fetch/paginate through search results." }, "root": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditRoot" }, "unpublished_root": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUnpublishedRoot" } }, "examples": [ { "count": 1, "events": [ { "envelope": { "event": { "message": "hello world" } }, "received_at": "2022-08-09T23:30:01.313785+00:00" } ], "expires_at": "2022-08-11T23:42:15.558320Z", "id": "pas_sqilrhruwu54uggihqj3aie24wrctakr" } ] } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/results": { "post": { "operationId": "audit_post_v1_results", "summary": "Get search results", "description": "Page through results from a previous search.", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "search-results", "type": "object", "properties": { "assert_search_restriction": { "description": "If provided, fail if the original search was performed with anything but the provided search_restriction parameter.", "type": "object" }, "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "id": { "type": "string", "description": "A search results identifier returned by the search call." }, "limit": { "type": "integer", "description": "Number of audit records to include in a single set of results." }, "offset": { "type": "integer", "description": "Offset from the start of the result set to start returning results from." }, "return_context": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ReturnFPEContext" } }, "required": ["id"], "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1results/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Search results have been provided successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1results/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "required": ["count", "events"], "properties": { "count": { "type": "integer", "description": "The total number of results returned by the search." }, "events": { "type": "array", "description": "A list of matching audit records.", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSearchResult" } }, "root": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditRoot" }, "unpublished_root": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUnpublishedRoot" } }, "examples": [ { "count": 1, "events": [ { "envelope": { "event": { "message": "hello world", "timestamp": "2022-08-09T23:30:01.313785Z" }, "received_at": "2022-08-09T23:30:01.111111Z" }, "hash": "4c3fc1461e3335a938477d0a4807bce6c4f4529e7adc185013cde1ef204842c2" } ], "expires_at": "2022-08-11T23:42:15.558320Z", "id": "pas_sqilrhruwu54uggihqj3aie24wrctakr" } ] } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/root": { "post": { "operationId": "audit_post_v1_root", "summary": "Get tamperproof verification data", "description": "Return current root hash and consistency proof.", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "root", "type": "object", "required": [], "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "tree_size": { "type": "integer", "description": "The size of the tree (the number of records)", "minimum": 1 } }, "additionalProperties": false, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1root/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "The requested root was returned.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1root/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditRoot", "examples": [ { "published_at": "2022-06-27T16:10:42.254390Z", "root_hash": "fd47cdb54df534aa4248a603ae24e06e147ffac7036dbf2ad8c04422e978fe1b", "size": 1, "tree_name": "e86b32dbb1993e2a6cf8c8802b2a639bddc8746e7abc0cb0bd6439c10b6cf3a7", "url": "https://arweave.net/tx/S6cuFlRrK0zFqftCMk-EFw0KTgSILbcCNEKpEpIk6nI/data/" } ] } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v2/log": { "post": { "operationId": "audit_post_v2_log", "summary": "Log multiple entries", "description": "Create multiple log entries in the Secure Audit Log.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": ["events"], "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "verbose": { "type": "boolean", "description": "If true, be verbose in the response; include all the data stored, creation time and proofs for the new event (both for membership and consistency)", "default": false }, "events": { "type": "array", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditLogRequestV2" }, "maxItems": 1000, "minItems": 1, "examples": [ [ { "event": { "message": "hello world" } } ] ] } }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v2~1log/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v2~1log/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "properties": { "results": { "type": "array", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditLogResponse" } } } } } } } }, "description": "No description provided" }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/schema": { "post": { "operationId": "audit_post_v1_schema", "summary": "Retrieve Audit Configuration Schema", "description": "Retrieves only the schema definition for the audit configuration\u2014without fetching the full configuration object\u2014so that client-side log viewers can dynamically display the configured fields. A project client token can used to access the endpoint.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": [], "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } } }, "additionalProperties": false, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1schema/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "The current schema.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1schema/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchema" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config": { "post": { "operationId": "audit_post_v1beta_config", "summary": "Get Secure Audit Log config", "description": "Retrieve an Secure Audit Log service configuration by its ID.", "x-pangea-ui-schema": { "group": "config-management", "isConfiguration": true }, "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": ["id"], "properties": { "id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-id" } }, "additionalProperties": false, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Configuration fetched successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config/create": { "post": { "operationId": "audit_post_v1beta_config_create", "x-pangea-ui-schema": { "disableInteractive": true, "group": "config-management", "isConfiguration": true }, "summary": "Create Secure Audit Log config", "description": "Create a new Secure Audit Log service configuration.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "description": "Configuration options available for Secure Audit Log service", "properties": { "name": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-name" }, "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchema" }, "version": { "type": "integer", "description": "Current version: 3", "const": 3 }, "cold_query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_query_result_retention" }, "cold_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_storage" }, "forwarding_configuration": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ForwardingConfiguration" }, "hot_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-hot_storage", "description": "Retention window for logs in hot storage. Migrated to warm, cold, or deleted afterwards." }, "query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-query_result_retention" }, "redact_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-redact_service_config_id" }, "ui_metadata": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUiMetadata" }, "vault_key_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_key_id" }, "vault_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_service_config_id" }, "vault_sign": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_sign" }, "warm_storage": { "description": "Retention window for logs in warm storage. Logs are migrated to cold storage or deleted after this period.", "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ] }, "partition_overrides": { "type": "object", "description": "Custom retention settings for specific tenants when tenant partitioning is enabled. Allows overriding warm and cold storage durations on a per-tenant basis." } }, "docs_anchor": "settings", "required": ["name", "schema", "version"], "not": { "required": ["id"], "description": "Creating a config does not accept an ID" }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1create/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Successfully created an Secure Audit Log service config", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1create/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config/update": { "post": { "operationId": "audit_post_v1beta_config_update", "x-pangea-ui-schema": { "group": "config-management", "configurationUpdate": { "get": "/v1beta/config", "list": "/v1beta/config/list" }, "isConfiguration": true }, "summary": "Update Secure Audit Log config", "description": "Update a Secure Audit Log service configuration.\n\nTo update a configuration, first retrieve the current version, apply your changes, and submit the updated configuration to this endpoint.\n\nFor a full example using a Project Admin management client, see the [Service Configuration APIs](https://pangea.cloud/docs/admin-guide/projects/credentials#service-configuration-apis) documentation.", "requestBody": { "content": { "application/json": { "schema": { "x-pangea-ui-schema": { "hideAnyOfOptions": [ "AuditServiceConfigV1", "AuditServiceConfigV2" ] }, "docs_anchor": "settings", "required": ["name", "id", "updated_at", "version"], "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig", "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1update/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Secure Audit Log service configuration updated successfully", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1update/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config/delete": { "post": { "operationId": "audit_post_v1beta_config_delete", "x-pangea-ui-schema": { "disableInteractive": true, "group": "config-management", "isConfiguration": true }, "summary": "Delete Secure Audit Log config", "description": "Delete a Secure Audit Log service configuration.", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "settings", "type": "object", "required": ["id"], "properties": { "id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-id" } }, "additionalProperties": false, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1delete/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Secure Audit Log service config successfully deleted", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1delete/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config/list": { "post": { "operationId": "audit_post_v1beta_config_list", "x-pangea-ui-schema": { "group": "config-management", "isConfiguration": true }, "summary": "List Secure Audit Log configs", "description": "Retrieve a paginated list of Secure Audit Log service configurations.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfigList", "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1list/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1list/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "properties": { "count": { "description": "Number of service configs matched by the list request", "type": "integer" }, "last": { "description": "Base64-encoded pagination cursor from the previous response, used to retrieve the next page of results", "type": "string", "examples": ["MTox"] }, "items": { "type": "array", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } } } }, "description": "No description provided" }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1beta/config/partition_overrides": { "post": { "operationId": "audit_post_v1beta_config_partition_overrides", "summary": "Update retention for a partition value", "description": "Update the retention settings for specific partition values. This beta endpoint accepts an `overrides` object, where each key is a partition name (such as a tenant ID), and the corresponding value specifies custom warm and cold storage retention periods.\n\nPartitioning must be enabled in the Audit Schema configuration typically using the `tenant_id` field.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "description": "Request to update retention settings for partitioned audit data", "docs_anchor": "settings", "required": ["id", "overrides"], "properties": { "id": { "type": "string", "description": "ID of the Secure Audit Log service configuration to update" }, "overrides": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-partition-overrides" } }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1partition_overrides/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Retention settings updated successfully", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1beta~1config~1partition_overrides/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfig" } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } }, "x-pangea-ui-schema": { "isConfiguration": true } } }, "/v2/log_async": { "post": { "operationId": "audit_post_v2_log_async", "summary": "Log multiple entries (async)", "description": "Asynchronously create multiple log entries in the Secure Audit Log.", "requestBody": { "content": { "application/json": { "schema": { "type": "object", "required": ["events"], "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "verbose": { "type": "boolean", "description": "If true, be verbose in the response; include all the data stored, creation time and proofs for the new event (both for membership and consistency)", "default": false }, "events": { "type": "array", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditLogRequestV2" }, "maxItems": 1000, "minItems": 1, "examples": [ [ { "event": { "message": "hello world" } } ] ] } }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v2~1log_async/requestBody/content/application~1json/schema" } } } }, "responses": { "202": { "description": "Record is accepted and being processed.", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/export": { "post": { "operationId": "audit_post_v1_export", "summary": "Create log export", "description": "Bulk export data from the Secure Audit Log, with optional filtering. Use the request parameters to define the log data to export. Providing no filtering will request all of the available logs.\n\nMake sure that your account has enough credits to complete the call before making the request. The API checks the account balance against the cost of the request and will exit before attempting the call if the account balance is too low to fulfill the request.\n\nThe export request is [asynchronous](/docs/api/async) and could take hours to complete, depending on the number of records. You can make a `GET` request to `https://audit...pangea.cloud/request/` to poll for the completion.\n\nAfter the export request completes, use the `/v1/download_results` endpoint to download the exported logs. Provide the `request_id` from the export request as the `request_id` parameter of the download request.", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "export-the-log", "type": "object", "additionalProperties": false, "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "end": { "description": "The end of the time range to perform the search on. All records up to the latest if left out.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "verbose": { "type": "boolean", "description": "If true, include the root hash of the tree and the membership proof for each record.", "default": true }, "order": { "type": "string", "description": "Specify the sort order of the response, either ascending (**asc**) or descending (**desc**).", "enum": ["asc", "desc"] }, "order_by": { "type": "string", "description": "Name of column to sort the results by.", "enum": [ "actor", "action", "message", "received_at", "source", "status", "target", "timestamp" ] }, "start": { "description": "The start of the time range to perform the search on.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "format": { "type": "string", "description": "Format for the records.", "enum": ["json", "csv"], "examples": ["csv"], "default": "csv" } }, "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1export/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Export has completed successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1export/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "properties": {}, "examples": [{}] } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } }, "/v1/download_results": { "post": { "operationId": "audit_post_v1_download_results", "summary": "Download export or search results", "description": "Retrieve all search or export results as a compressed (gzip) CSV file.\n\nTo download search results, use `result.id` provided in the search API response as the `result_id` parameter.\n\nTo download export results, use `request_id` from the export API request as the `request_id` parameter.\n\nThe download API returns a presigned GET URL in `result.dest_url`, where the log data can be downloaded.\n\n", "requestBody": { "content": { "application/json": { "schema": { "docs_anchor": "download-search-results", "type": "object", "additionalProperties": false, "properties": { "assert_search_restriction": { "description": "If provided, fail if the original search was performed with anything but the provided search_restriction parameter.", "type": "object" }, "result_id": { "type": "string", "description": "`result.id` returned by the search API.\n\nRequired if `request_id` is not provided. Mutually exclusive with the `request_id` parameter.", "examples": ["pas_sqilrhruwu54uggihqj3aie24wrctakr"], "pattern": "^pas_[a-z0-9]{32}$" }, "request_id": { "type": "string", "description": "`request_id` returned by the export API.\n\nRequired if `result_id` is not provided. Mutually exclusive with the `result_id` parameter.", "examples": ["prq_sqilrhruwu54uggihqj3aie24wrctakr"], "pattern": "^prq_[a-z0-9]{32}$" }, "format": { "type": "string", "description": "Format for the records.", "enum": ["json", "csv"], "examples": ["csv"], "default": "csv" }, "config_id": { "type": "string", "description": "ID for config associated with the result.", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "return_context": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ReturnFPEContext" } }, "oneOf": [ { "required": ["result_id"], "title": "Result ID" }, { "required": ["request_id"], "title": "Request ID" } ], "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1download_results/requestBody/content/application~1json/schema" } } } }, "responses": { "200": { "description": "Results retrieved successfully.", "content": { "application/json": { "schema": { "$id": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/paths/~1v1~1download_results/responses/200/content/application~1json/schema", "$schema": "https://json-schema.org/draft/2020-12/schema", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "$defs": {}, "properties": { "result": { "type": "object", "required": ["dest_url", "expires_at"], "properties": { "dest_url": { "type": "string", "description": "URL where search results can be downloaded" }, "expires_at": { "type": "string", "description": "The time when the results will no longer be available to page through via the results API.", "format": "date-time" } }, "examples": [ { "dest_url": "https://pangea-runtime.s3.amazonaws.com/audit/xxxxx/search_results_pas_sbexwdijj4sgxxv264xyjjnyhxa7yvkd.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxxxx%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20240227T202443Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Security-Token=xxxxx", "expires_at": "2022-08-11T23:42:15.558320Z" } ] } } } } } }, "202": { "description": "Asynchronous request in progress", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-accepted-response" } } } }, "400": { "description": "Validation errors", "content": { "application/json": { "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-validation-errors" } } } } } } } }, "openapi": "3.1.0", "components": { "schemas": { "pangea-response": { "title": "Response Schema", "description": "Pangea standard response schema", "type": "object", "required": ["request_id", "request_time", "response_time", "status"], "properties": { "request_id": { "type": "string", "description": "A unique identifier assigned to each request made to the API. It is used to track and identify a specific request and its associated data. The `request_id` can be helpful for troubleshooting, auditing, and tracing the flow of requests within the system. It allows users to reference and retrieve information related to a particular request, such as the response, parameters, and raw data associated with that specific request.\n\n```\n\"request_id\":\"prq_x6fdiizbon6j3bsdvnpmwxsz2aan7fqd\"\n```" }, "request_time": { "type": "string", "description": "The timestamp indicates the exact moment when a request is made to the API. It represents the date and time at which the request was initiated by the client. The `request_time` is useful for tracking and analyzing the timing of requests, measuring response times, and monitoring performance metrics. It allows users to determine the duration between the request initiation and the corresponding response, aiding in the assessment of API performance and latency.\n\n```\n\"request_time\":\"2022-09-21T17:24:33.105Z\"\n```" }, "response_time": { "type": "string", "description": "Duration it takes for the API to process a request and generate a response. It represents the elapsed time from when the request is received by the API to when the corresponding response is returned to the client.\n\n```\n\"response_time\":\"2022-09-21T17:24:34.007Z\"\n```" }, "status": { "type": "string", "description": "It represents the status or outcome of the API request made for IP information. It indicates the current state or condition of the request and provides information on the success or failure of the request.\n\n```\n\"status\":\"success\"\n```" }, "summary": { "type": "string", "description": "Provides a concise and brief overview of the purpose or primary objective of the API endpoint. It serves as a high-level summary or description of the functionality or feature offered by the endpoint." }, "result": { "type": "object" } }, "examples": [ { "request_id": "prq_x6fdiizbon6j3bsdvnpmwxsz2aan7fqd", "request_time": "2022-09-21T17:24:33.105Z", "response_time": "2022-09-21T17:24:34.007Z", "status": "success" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/pangea-response" }, "pangea-validation-errors": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "required": ["result"], "properties": { "result": { "type": "object", "required": ["errors"], "properties": { "errors": { "type": "array", "minItems": 1, "items": { "type": "object", "required": ["code", "detail", "source"], "properties": { "code": { "type": "string", "enum": [ "FieldRequired", "InvalidString", "InvalidNumber", "InvalidInteger", "InvalidObject", "InvalidArray", "InvalidNull", "InvalidBool", "BadFormat", "BadFormatPangeaDuration", "BadFormatDateTime", "BadFormatTime", "BadFormatDate", "BadFormatEmail", "BadFormatHostname", "BadFormatIPv4", "BadFormatIPv6", "BadFormatIPAddress", "BadFormatUUID", "BadFormatURI", "BadFormatURIReference", "BadFormatIRI", "BadFormatIRIReference", "BadFormatJSONPointer", "BadFormatRelativeJSONPointer", "BadFormatRegex", "BadFormatJSONPath", "BadFormatBase64", "DoesNotMatchPattern", "DoesNotMatchPatternProperties", "NotEnumMember", "AboveMaxLength", "BelowMinLength", "AboveMaxItems", "BelowMinItems", "NotMultipleOf", "NotWithinRange", "UnexpectedProperty", "InvalidPropertyName", "AboveMaxProperties", "BelowMinProperties", "NotContains", "ContainsTooMany", "ContainsTooFew", "ItemNotUnique", "UnexpectedAdditionalItem", "InvalidConst", "IsDependentOn", "IsTooBig", "IsTooSmall", "ShouldNotBeValid", "NoUnevaluatedItems", "NoUnevaluatedProperties", "DoesNotExist", "IsReadOnly", "CannotAddToDefault", "MustProvideOne", "MutuallyExclusive", "BadState", "InaccessibleURI", "ProviderDisabled", "ConfigProjectMismatch", "ConfigServiceMismatch", "ConfigNotExist" ] }, "detail": { "type": "string", "description": "Human readable description of the error" }, "source": { "type": "string", "description": "Path to the data source of the error", "format": "json-pointer" }, "path": { "type": "string", "description": "The Schema path where the error occurred", "format": "json-pointer" } } } } } } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/pangea-validation-errors" }, "pangea-accepted-response": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/pangea-response", "required": ["status", "result"], "properties": { "status": { "enum": ["Accepted"] }, "result": { "type": "object", "required": ["ttl_mins", "retry_counter", "location"], "properties": { "ttl_mins": { "type": "integer", "description": "TTL from now until which results are stored for retrieval" }, "retry_counter": { "type": "integer", "description": "Number of retry counts performed so far to fetch the results" }, "location": { "type": "string", "description": "The location to check results of the asynchronous request" } }, "additionalProperties": false } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/pangea-accepted-response" }, "audit-service-config-id": { "type": "string", "description": "ID of a Secure Audit Log configuration", "pattern": "^pci_[a-z2-7]{32}$", "examples": ["pci_wuk7tvtpswyjtlsx52b7yyi2l7zotv4a"], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-id" }, "audit-service-config-name": { "type": "string", "description": "Human-readable name of the Secure Audit Log service configuration", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-name" }, "audit-service-config-created_at": { "type": "string", "format": "date-time", "description": "Database timestamp when the configuration was created. Automatically assigned.", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-created_at" }, "audit-service-config-updated_at": { "type": "string", "format": "date-time", "description": "Database timestamp when the configuration was last updated. Automatically assigned.", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-updated_at" }, "audit-service-config-retention": { "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ], "description": "Retention window for audit logs", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-retention" }, "audit-service-config-cold_query_result_retention": { "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ], "description": "Retention window for cold query result / state information", "default": "2d", "userVisible": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-cold_query_result_retention" }, "audit-service-config-hot_storage": { "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ], "description": "Retention window for keeping audit logs in hot storage", "default": "14d", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-hot_storage" }, "audit-service-config-query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration", "default": "2d", "userVisible": false, "description": "Retention window for retaining cached query results on the server", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-query_result_retention" }, "audit-service-config-redact_service_config_id": { "type": ["string", "null"], "description": "ID of the Redact service configuration used to remove sensitive data from logs", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-redact_service_config_id" }, "audit-service-config-shards": { "type": "integer", "description": "Number of OpenSearch shards to use per index", "minimum": 1, "maximum": 100, "userVisible": false, "x-pangea-ui-schema": { "isPublic": false }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-shards" }, "audit-service-config-vault_service_config_id": { "type": ["string", "null"], "description": "ID of the Vault service configuration used for cryptographic signing of logs", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-vault_service_config_id" }, "audit-service-config-vault_key_id": { "type": "string", "description": "ID of the Vault key used for signing logs. If not provided, a default key is used.", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-vault_key_id" }, "audit-service-config-vault_sign": { "type": "boolean", "default": false, "description": "Indicates whether cryptographic signing of audit logs using Vault is enabled", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-vault_sign" }, "audit-service-config-cold_storage": { "description": "Retention window for logs in cold storage. Logs are deleted after this period.\n\nA value of `0` disables cold storage. When enabled, the minimum allowed duration is 180 days.\n\nLearn more in the Secure Audit Log [Retention Policy](https://pangea.cloud/docs/audit/getting-started/settings#retention-policy) and [Request Cold Export](https://pangea.cloud/docs/audit/using-secure-audit-log/cold-export) documentation.", "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-cold_storage" }, "audit-service-config-warm_storage": { "description": "Retention window for logs in warm storage. Logs are migrated to cold storage or deleted after this period.", "allOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-warm_storage" }, "audit-service-config-partition-overrides": { "type": "object", "description": "Custom retention settings for specific tenants when tenant partitioning is enabled. Allows overriding warm and cold storage durations on a per-tenant basis.\n\nThe settings are defined as a map of partition identifiers to retention values:\n\n- Each key is a partition value (for example, a tenant ID) specified in the **Tenant Retention Settings** in the Pangea User Console and referenced in the `tenant_id` field of a log event.\n\n- Each value is an object defining `warm_storage` and `cold_storage` durations.\n\nFor example:\n\n```\n{\n \"tenant1_id\": {\n \"warm_storage\": \"90d\",\n \"cold_storage\": \"16month\"\n },\n \"tenant2_id\": {\n \"warm_storage\": \"90d\",\n \"cold_storage\": \"0day\"\n }\n}\n```", "patternProperties": { ".*": { "type": "object", "properties": { "warm_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-warm_storage" }, "cold_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_storage" } }, "additionalProperties": false } }, "examples": [ { "tenant1_id": { "warm_storage": "90d", "cold_storage": "16month" }, "tenant2_id": { "warm_storage": "90d", "cold_storage": "0day" } } ], "x-pangea-ui-schema": { "largeJsonInput": true }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/audit-service-config-partition-overrides" }, "AuditLogRequest": { "type": "object", "description": "A request to log an event.", "required": ["event"], "additionalProperties": false, "properties": { "config_id": { "type": "string", "description": "Config ID. Can be found at the top of the [Secure Audit Log dashboard](https://console.pangea.cloud/service/audit).", "x-pangea-ui-schema": { "renderComponent": "ConfigIDOptions" } }, "event": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditEvent" }, "prev_root": { "type": "string", "description": "This is the unpublished root hash that was returned from the last log API call that was made. If the user does not provide prev_root, the consistency proof from the last known unpublished root will be provided.", "pattern": "^[a-z0-9]{64}" }, "public_key": { "type": "string", "description": "The base64-encoded ed25519 public key used for the signature, if one is provided", "maxLength": 256 }, "signature": { "type": "string", "description": "This is the signature of the hash of the canonicalized event that can be verified with the public key provided in the public_key field. Signatures cannot be used with the redaction feature turned on. If redaction is required, the user needs to perform redaction before computing the signature that is to be sent with the message. The SDK facilitates this for users.", "maxLength": 256 }, "verbose": { "type": "boolean", "description": "If true, be verbose in the response; include all the data stored, creation time and proofs for the new event (both for membership and consistency)", "default": false } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditLogRequest" }, "AuditLogRequestV2": { "type": "object", "description": "A request to log an event.", "required": ["event"], "additionalProperties": false, "properties": { "event": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditEvent" }, "public_key": { "type": "string", "description": "The base64-encoded ed25519 public key used for the signature, if one is provided", "maxLength": 256 }, "signature": { "type": "string", "description": "This is the signature of the hash of the canonicalized event that can be verified with the public key provided in the public_key field. Signatures cannot be used with the redaction feature turned on. If redaction is required, the user needs to perform redaction before computing the signature that is to be sent with the message. The SDK facilitates this for users.", "maxLength": 256 } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditLogRequestV2" }, "AuditLogResponse": { "type": "object", "required": [], "properties": { "envelope": { "type": "object", "description": "The sealed envelope containing the event that was logged. Includes event metadata such as optional client-side signature details and server-added timestamps." }, "hash": { "type": "string", "description": "The hash of the event data.", "minLength": 64, "maxLength": 64 }, "unpublished_root": { "type": "string", "description": "The current unpublished root.", "pattern": "^[a-z0-9]{64}" }, "membership_proof": { "description": "A proof for verifying that the buffer_root contains the received event", "type": "string" }, "consistency_proof": { "description": "If prev_buffer_root was present in the request, this proof verifies that the new unpublished root is a continuation of prev_unpublished_root", "type": "array", "items": { "type": "string" } } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditLogResponse" }, "AuditLogResponseV2": { "type": "object", "required": [], "properties": { "envelope": { "type": "object", "description": "The sealed envelope containing the event that was logged. Includes event metadata such as optional client-side signature details and server-added timestamps." }, "hash": { "type": "string", "description": "The hash of the event data.", "minLength": 64, "maxLength": 64 } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditLogResponseV2" }, "AuditEvent": { "type": "object", "required": ["message"], "description": "A structured record describing that \\ did \\ on \\ changing it from \\ to \\ and the operation was \\, and/or a free-form \\.", "additionalProperties": false, "properties": { "actor": { "type": "string", "description": "An identifier for _who_ the audit record is about.", "maxLength": 128, "examples": ["John Doe", "user-id", "DennisNedry@InGen.com"] }, "action": { "type": "string", "description": "What action was performed on a record.", "maxLength": 32, "examples": ["created", "deleted", "updated"] }, "message": { "type": "string", "description": "A free form text field describing the event.", "maxLength": 32766, "examples": ["Hello, World!"] }, "new": { "type": "string", "description": "The value of a record _after_ it was changed.", "maxLength": 32766 }, "old": { "type": "string", "description": "The value of a record _before_ it was changed.", "maxLength": 32766 }, "source": { "type": "string", "description": "The source of a record.", "maxLength": 128 }, "status": { "type": "string", "description": "The status or result of the event.", "maxLength": 32, "examples": ["failure", "success"] }, "target": { "type": "string", "description": "An identifier for what the audit record is about.", "maxLength": 128 }, "tenant_id": { "type": "string", "description": "An optional client-supplied tenant_id.", "maxLength": 128 }, "timestamp": { "type": "string", "format": "date-time", "description": "An optional client-supplied timestamp.", "maxLength": 128 } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditEvent" }, "AuditEventEnvelope": { "type": "object", "description": "An audit record returned by a search operation", "properties": { "event": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditEvent" }, "err": { "type": "array", "description": "A list of errors (if any) encountered when processing the event. A non-empty array indicates the client had sent a malformed event.", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditEventUserError" } }, "received_at": { "description": "A Pangea provided timestamp of when the event was received.", "type": "string", "format": "date-time" }, "signature": { "type": "string", "description": "This is the signature of the hash of the canonicalized event that can be verified with the public key provided in the public_key field. Signatures cannot be used with the redaction feature turned on. If redaction is required, the user needs to perform redaction before computing the signature that is to be sent with the message. The SDK facilitates this for users.", "maxLength": 256 }, "public_key": { "type": "string", "description": "The base64-encoded ed25519 public key used for the signature, if one is provided", "maxLength": 256 } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditEventEnvelope" }, "AuditEventUserError": { "description": "Details on the failure to properly process an event.", "type": "object", "required": ["error", "field"], "properties": { "error": { "description": "A description of the detected error/problem with the original event.", "type": "string" }, "field": { "description": "The original JSON field where the error was detected.", "type": "string" }, "value": { "description": "The original JSON value (may be truncated.)" } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditEventUserError" }, "AuditSchemaTemplate": { "description": "An audit schema template supporting an example use case.", "type": "object", "properties": { "default": { "description": "If true, expected to be the default UI selection.", "type": "boolean", "default": false }, "title": { "description": "User facing title of the schema.", "type": "string" }, "ui_metadata": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUiMetadata" }, "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchema" } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditSchemaTemplate" }, "AuditSchemaField": { "type": "object", "description": "Describes a single field within an audit schema, including its type, display settings, and redaction behavior.", "required": ["id", "type"], "properties": { "id": { "type": "string", "description": "Unique identifier for the field in lowercase with underscores. \n\nCannot be `received_at`, which is reserved.", "maxLength": 32, "not": { "enum": ["received_at"] }, "pattern": "^[a-z][0-9a-z_]*$" }, "name": { "type": "string", "description": "Human-readable name of the field. Used as **Displayed name** in the UI", "maxLength": 64 }, "type": { "type": "string", "description": "Data type of the field.\n\nUse `string-unindexed` for fields that should not be indexed for search, which improves query performance and allows storing structured values like JSON.\n\nUse `text` for full-text indexed fields that support single-word search but do not support multi-word queries." }, "description": { "type": "string", "description": "Optional description of the field's purpose or contents", "maxLength": 255 }, "redact": { "type": "boolean", "description": "If `true`, this field will be processed by the redaction service (if configured). Only valid for string-type fields.\n\nLearn more in the Secure Audit Log [Redact log events](https://pangea.cloud/docs/audit/getting-started/settings#redact-records) documentation." }, "required": { "type": "boolean", "description": "If `true`, this field must be present in every audit event" }, "partitioned": { "type": "boolean", "description": "If `true`, this field is used to partition data in cold storage (for example, by `tenant_id`)" }, "size": { "type": "integer", "description": "Maximum number of UTF-8 characters allowed in the field. Applicable only to string-type fields." }, "ui_default_visible": { "type": "boolean", "description": "If `true`, this field is shown by default in the Secure Audit Log Viewer UI" } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditSchemaField" }, "AuditSchema": { "type": "object", "description": "Defines the structure and field behavior of audit logs for a specific schema configuration. The overall schema can only be defined at creation time and must include at least one required field with a specified identifier and type. Field descriptions, required status, and default UI visibility can be updated later.\n\nLearn more in the [Enable and Configure Secure Audit Log](https://pangea.cloud/docs/audit/getting-started/configuration) documentation.", "properties": { "client_signable": { "type": "boolean", "description": "If `true`, audit records will include fields required for cryptographic signing using a Vault-managed key. This ensures record integrity by allowing verification that the content has not been modified after creation.\n\nLearn more in the Secure Audit Log [Log Signing](https://pangea.cloud/docs/audit/getting-started/settings#log-signing) documentation." }, "save_malformed": { "type": "string", "description": "Specifies how to handle malformed audit events:\n- `reject` (default): Reject the event with a 400 error.\n- `all`: Log all events regardless of structure or redaction issues.\n- `unredacted`: Log all events, but omit values that would have been redacted.", "enum": ["all", "reject", "unredacted"], "default": "reject" }, "tamper_proofing": { "type": "boolean", "description": "If `true`, audit records will include fields required to support tamperproofing using Merkle Trees. This ensures that records cannot be modified, deleted, or inserted without detection.\n\nLearn more in the Secure Audit Log [Tamperproofing](https://pangea.cloud/docs/audit/about-tamperproofing) documentation." }, "vendor_id": { "type": "string", "description": "Identifier for the third-party service streaming log events to Secure Audit Log. Used in vendor-specific schemas to indicate the source provider, such as `auth0`.\n\nLearn more in the Secure Audit Log [Third-party Log Events](https://pangea.cloud/docs/audit/log-streaming/) documentation." }, "json_path": { "type": "string", "description": "JSON path used to extract the log records from the incoming event payload. For example, `$.logs[*].data` selects all log entries under the `logs` array in a typical Auth0 stream.\n\nLearn more in the Secure Audit Log [Third-party Log Events](https://pangea.cloud/docs/audit/log-streaming/) documentation." }, "fields": { "type": "array", "description": "List of defined fields for this audit schema.", "x-pangea-ui-schema": { "largeJsonInput": true }, "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchemaField" } } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditSchema" }, "AuditUiMetadata": { "type": "object", "description": "Represents metadata configurations for the UI elements of the Audit search interface", "properties": { "saved_searches": { "type": "array", "items": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSavedSearch" } } }, "x-pangea-ui-schema": { "isPublic": false }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditUiMetadata" }, "AuditSavedSearch": { "type": "object", "additionalProperties": false, "properties": { "title": { "description": "User facing title of the search query.", "type": "string" }, "query": { "type": "string", "description": "Natural search string; a space-separated list of case-sensitive values used to search for records, which includes the optional `:` prefix to limit the search to a specific field. Values with a space can be enclosed in double-quote (`\"`) characters:\n\n * `\"search text\"`: any field contains \"search text\"\n * `actor:\"Jane Doe\"`: the actor field contains \"Jane Doe\"\n * `actor:alice target:bob sent`: actor contains \"alice\", target contains \"bob\", and any field contains \"sent\".\n\n The following optional prefixes are supported: `action:`, `actor:`, `message:`, `new:`, `old:`, `source:`, `status:`, `target:`.", "examples": [ "actor:\"Jane Doe\" target:cosmos", "\"viewed x-ray\"" ] }, "start": { "description": "The start of the time range to perform the search on. Defaults to 14 days of data.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "end": { "description": "The start of the time range to perform the search on. Defaults to 14 days of data.", "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/DateTimeRel" }, "order": { "type": "string", "description": "Specify the sort order of the response.", "enum": ["asc", "desc"] }, "order_by": { "type": "string", "description": "Name of column to sort the results by." } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditSavedSearch" }, "AuditSearchResult": { "type": "object", "description": "An audit record returned by a search operation", "properties": { "envelope": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditEventEnvelope" }, "membership_proof": { "type": "string", "description": "A cryptographic proof that the record has been persisted in the log" }, "hash": { "type": "string", "description": "The record's hash", "minLength": 64, "maxLength": 64 }, "published": { "type": "boolean", "description": "If true, a root has been published after this event. If false, there is no published root for this event" }, "imported": { "type": "boolean", "description": "If true, the even was imported manually and not logged by the standard procedure. Some features such as tamper proofing may not be available" }, "leaf_index": { "type": "integer", "description": "The index of the leaf of the Merkle Tree where this record was inserted or null if published=false" }, "valid_signature": { "type": "boolean", "description": "Result of the verification of the Vault signature, if the event was signed and the parameter `verify_signature` is `true`", "x-pangea-ui-schema": { "isPublic": false } }, "fpe_context": { "type": "string", "description": "The context data needed to decrypt secure audit events that have been redacted with format preserving encryption." } }, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditSearchResult" }, "AuditServiceConfig": { "anyOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfigV1" }, { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfigV2" }, { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditServiceConfigV3" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditServiceConfig" }, "AuditServiceConfigV1": { "title": "AuditServiceConfigV1", "type": "object", "description": "Properties of a Secure Audit Log service configuration", "required": [], "properties": { "id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-id" }, "name": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-name" }, "version": { "type": "integer", "const": 1, "default": 1 }, "created_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-created_at" }, "updated_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-updated_at" }, "retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-retention" }, "cold_query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_query_result_retention" }, "hot_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-hot_storage" }, "query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-query_result_retention" }, "redact_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-redact_service_config_id" }, "redaction_fields": { "type": "array", "description": "List of audit log fields to redact using the configured Redact service", "items": { "type": "string", "enum": [ "message", "new", "old", "actor", "action", "status", "target", "tenant_id", "source" ] } }, "shards": { "description": "Number of OpenSearch shards to use per index", "type": "integer", "userVisible": false, "maximum": 100, "minimum": 1, "x-pangea-ui-schema": { "isPublic": false } }, "vault_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_service_config_id" }, "vault_key_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_key_id" }, "vault_sign": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_sign" } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditServiceConfigV1" }, "AuditServiceConfigV2": { "title": "AuditServiceConfigV2", "type": "object", "description": "Configuration options available for audit service", "required": ["schema", "version"], "properties": { "cold_query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_query_result_retention" }, "created_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-created_at" }, "hot_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-hot_storage" }, "id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-id" }, "name": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-name" }, "query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-query_result_retention" }, "redact_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-redact_service_config_id" }, "retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-retention" }, "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchema" }, "ui_metadata": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUiMetadata" }, "shards": { "description": "Number of OpenSearch shards to use per index", "type": "integer", "userVisible": false, "maximum": 100, "minimum": 1, "x-pangea-ui-schema": { "isPublic": false } }, "updated_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-updated_at" }, "vault_key_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_key_id" }, "vault_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_service_config_id" }, "vault_sign": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_sign" }, "version": { "type": "integer", "const": 2 }, "forwarding_configuration": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ForwardingConfiguration" } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditServiceConfigV2" }, "AuditServiceConfigV3": { "title": "AuditServiceConfigV3", "type": "object", "description": "Configuration options available for audit service", "required": ["schema", "version"], "properties": { "cold_query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_query_result_retention" }, "cold_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-cold_storage" }, "created_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-created_at" }, "forwarding_configuration": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/ForwardingConfiguration" }, "hot_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-hot_storage", "description": "Retention window for logs in hot storage. Migrated to warm, cold, or deleted afterwards." }, "id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-id" }, "name": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-name" }, "query_result_retention": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-query_result_retention" }, "redact_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-redact_service_config_id" }, "schema": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditSchema" }, "shards": { "description": "Number of OpenSearch shards to use per index", "type": "integer", "userVisible": false, "maximum": 100, "minimum": 1, "x-pangea-ui-schema": { "isPublic": false } }, "ui_metadata": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/AuditUiMetadata" }, "updated_at": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-updated_at" }, "vault_key_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_key_id" }, "vault_service_config_id": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_service_config_id" }, "vault_sign": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-vault_sign" }, "version": { "type": "integer", "description": "Current version: 3", "const": 3 }, "warm_storage": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-warm_storage" }, "partition_overrides": { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/audit-service-config-partition-overrides" }, "datastore": { "type": "string", "description": "Use specific datastore. For example, the AI Detection and Response (AIDR) service uses `postgresql` as datastore.", "enum": ["default", "postgresql"], "examples": ["default", "postgresql"], "x-pangea-ui-schema": { "isPublic": false } } }, "additionalProperties": false, "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditServiceConfigV3" }, "AuditServiceConfigList": { "type": "object", "additionalProperties": false, "description": "List or filter/search records.", "properties": { "filter": { "type": "object", "properties": { "id": { "description": "Only records where id equals this value.", "nullable": false, "type": "string" }, "id__contains": { "description": "Only records where id includes each substring.", "items": { "description": "A substring to check for.", "type": "string" }, "type": "array" }, "id__in": { "description": "Only records where id equals one of the provided substrings.", "items": { "description": "A substring to check for.", "type": "string" }, "type": "array" }, "created_at": { "description": "Only records where created_at equals this value.", "format": "date-time", "nullable": false, "type": "string" }, "created_at__gt": { "description": "Only records where created_at is greater than this value.", "format": "date-time", "type": "string" }, "created_at__gte": { "description": "Only records where created_at is greater than or equal to this value.", "format": "date-time", "type": "string" }, "created_at__lt": { "description": "Only records where created_at is less than this value.", "format": "date-time", "type": "string" }, "created_at__lte": { "description": "Only records where created_at is less than or equal to this value.", "format": "date-time", "type": "string" }, "updated_at": { "description": "Only records where updated_at equals this value.", "format": "date-time", "nullable": false, "type": "string" }, "updated_at__gt": { "description": "Only records where updated_at is greater than this value.", "format": "date-time", "type": "string" }, "updated_at__gte": { "description": "Only records where updated_at is greater than or equal to this value.", "format": "date-time", "type": "string" }, "updated_at__lt": { "description": "Only records where updated_at is less than this value.", "format": "date-time", "type": "string" }, "updated_at__lte": { "description": "Only records where updated_at is less than or equal to this value.", "format": "date-time", "type": "string" } }, "additionalProperties": false }, "last": { "description": "Reflected value from a previous response to obtain the next page of results.", "type": "string" }, "order": { "description": "Order results asc(ending) or desc(ending).", "enum": ["asc", "desc"], "type": "string" }, "order_by": { "description": "Which field to order results by.", "enum": ["id", "created_at", "updated_at"], "type": "string" }, "size": { "description": "Maximum results to include in the response.", "minimum": 1, "type": "integer" } }, "required": [], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditServiceConfigList" }, "AuditRoot": { "type": "object", "description": "A root of a Merkle Tree", "properties": { "size": { "type": "integer", "minimum": 1, "description": "The size of the tree (the number of records)" }, "root_hash": { "type": "string", "description": "The root hash", "minLength": 64, "maxLength": 64 }, "published_at": { "type": "string", "format": "date-time", "description": "The date/time when this root was published" }, "url": { "type": "string", "format": "uri", "description": "The URL where this root has been published" }, "tree_name": { "type": "string", "description": "The name of the Merkle Tree" }, "consistency_proof": { "type": "array", "items": { "type": "string" }, "description": "Consistency proof to verify that this root is a continuation of the previous one" } }, "examples": [ { "published_at": "2022-06-27T16:10:42.254390Z", "root_hash": "fd47cdb54df534aa4248a603ae24e06e147ffac7036dbf2ad8c04422e978fe1b", "size": 1, "tree_name": "e86b32dbb1993e2a6cf8c8802b2a639bddc8746e7abc0cb0bd6439c10b6cf3a7", "url": "https://arweave.net/tx/S6cuFlRrK0zFqftCMk-EFw0KTgSILbcCNEKpEpIk6nI/data/" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditRoot" }, "AuditUnpublishedRoot": { "type": "object", "description": "A root of a Merkle Tree that was not published yet", "properties": { "size": { "type": "integer", "minimum": 1, "description": "The size of the tree (the number of records)" }, "root_hash": { "type": "string", "description": "The root hash", "minLength": 64, "maxLength": 64 }, "tree_name": { "type": "string", "description": "The name of the Merkle Tree" }, "consistency_proof": { "type": "array", "items": { "type": "string" }, "description": "Consistency proof to verify that this root is a continuation of the previous one" } }, "examples": [ { "root_hash": "fd47cdb54df534aa4248a603ae24e06e147ffac7036dbf2ad8c04422e978fe1b", "size": 1, "tree_name": "e86b32dbb1993e2a6cf8c8802b2a639bddc8746e7abc0cb0bd6439c10b6cf3a7" } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/AuditUnpublishedRoot" }, "DateTimeRel": { "type": "string", "description": "An RFC-3339 formatted timestamp, or relative time adjustment from the current time.", "oneOf": [ { "$ref": "https://audit.aws.us.pangea.cloud/v1/openapi.json#/components/schemas/Duration" }, { "description": "Absolute timestamp.", "pattern": "^\\d{4}-\\d{1,2}-\\d{1,2}T\\d{1,2}:\\d{1,2}:\\d{1,2}(.\\d{1,6})?([\\+\\-]\\d{1,2}(:?\\d{1,2})?|Z)?$" } ], "maxLength": 128, "examples": [ "2022-01-02T01:02:03Z", "7d", "1day", "120min", "2months" ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/DateTimeRel" }, "Duration": { "description": "A period of time.", "type": "string", "pattern": "^(\\d+)(d|da|day|days|h|hour|hr|hrs|hours|mi|min|mins|minute|minutes|mo|mon|month|months|s|sec|secs|second|seconds|w|week|weeks|y|year|years)$", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/Duration" }, "ForwardingConfiguration": { "type": "object", "description": "Configuration for forwarding audit logs to an external system, such as a Splunk HEC endpoint or a Next-Gen SIEM destination. Forwarding is authenticated using a secret stored in Vault, and can optionally include TLS settings and acknowledgement support.\n\nLearn more in the [Secure Audit Log Forwarding](https://pangea.cloud/docs/audit/getting-started/settings#audit-log-forwarding) documentation.", "required": ["type"], "properties": { "forwarding_enabled": { "type": "boolean", "default": false, "description": "Indicates whether audit log forwarding is enabled for this configuration" } }, "oneOf": [ { "required": ["event_url", "vault_config_id", "vault_secret_id"], "properties": { "type": { "oneOf": [ { "const": "ngsiem", "title": "Crowdstrike Next-Gen SIEM", "description": "Forwards logs to a Crowdstrike Next-Gen SIEM destination" }, { "const": "splunk", "title": "Splunk", "description": "Forwards logs to a Splunk HTTP Event Collector (HEC) endpoint" } ] }, "event_url": { "type": "string", "format": "uri", "description": "HTTPS URL of the endpoint where audit events will be forwarded" }, "ack_url": { "type": "string", "description": "URL used for HEC indexer acknowledgement. Required with `channel_id` when indexer acknowledgement is enabled." }, "channel_id": { "type": "string", "description": "Channel ID used to correlate acknowledgements. Required with `ack_url` when indexer acknowledgement is enabled." }, "public_cert": { "type": "string", "format": "base64", "description": "Optional base64-encoded public TLS certificate used to validate self-signed HTTPS endpoints for log forwarding" }, "index": { "type": "string", "description": "Optional index name included in the HEC payload to route events within the external system" }, "vault_config_id": { "type": "string", "description": "ID of the Vault service configuration used to store the HEC authentication token" }, "vault_secret_id": { "type": "string", "description": "ID of the Vault secret that contains the HEC authentication token" } }, "dependentRequired": { "channel_id": ["ack_url"], "ack_url": ["channel_id"] } } ], "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/ForwardingConfiguration" }, "ReturnFPEContext": { "type": "boolean", "description": "Return the context data needed to decrypt secure audit events that have been redacted with format preserving encryption.", "$id": "https://pangea.cloud/docs/openapi/audit_openapi.json#/components/schemas/ReturnFPEContext" } }, "securitySchemes": { "APIToken": { "type": "http", "bearerFormat": "token", "description": "Pangea API Token", "scheme": "bearer" } } }, "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema" }, "remoteDocuments": {}, "url": "https://audit.aws.us.pangea.cloud/v1/openapi.json" }