The System Log records system events that are related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems.
The System Log API provides near real-time, read-only access to your organization's system log and is the programmatic counterpart of the System Log UI.
The terms "event" and "log event" are often used interchangeably. In the context of this API, an "event" is an occurrence of interest within the system, and a "log" or "log event" is the recorded fact.
The System Log API supports these primary use cases:
The System Log API isn't intended for use as a Database as a Service (DBaaS) or to serve data directly to downstream consumers without an intermediate data store.
See Events API Migration for information on migrating from the Events API to the System Log API.
okta.logs.read
Lists all system log events. The Okta System Log API provides read access to your organization’s system log. This API provides more functionality than the Events API
Success
Forbidden
Too Many Requests
[- {
- "actor": {
- "alternateId": "string",
- "detailEntry": {
- "property1": { },
- "property2": { }
}, - "displayName": "string",
- "id": "string",
- "type": "string"
}, - "authenticationContext": {
- "authenticationProvider": "ACTIVE_DIRECTORY",
- "authenticationStep": 0,
- "credentialProvider": "DUO",
- "credentialType": "ASSERTION",
- "externalSessionId": "string",
- "interface": "string",
- "issuer": {
- "id": "string",
- "type": "string"
}
}, - "client": {
- "device": "string",
- "geographicalContext": {
- "city": "string",
- "country": "string",
- "geolocation": {
- "lat": 0,
- "lon": 0
}, - "postalCode": "string",
- "state": "string"
}, - "id": "string",
- "ipAddress": "string",
- "userAgent": {
- "browser": "string",
- "os": "string",
- "rawUserAgent": "string"
}, - "zone": "string"
}, - "debugContext": {
- "debugData": {
- "property1": { },
- "property2": { }
}
}, - "displayMessage": "string",
- "eventType": "string",
- "legacyEventType": "string",
- "outcome": {
- "reason": "string",
- "result": "string"
}, - "published": "2019-08-24T14:15:22Z",
- "request": {
- "ipChain": [
- {
- "geographicalContext": {
- "city": "string",
- "country": "string",
- "geolocation": {
- "lat": 0,
- "lon": 0
}, - "postalCode": "string",
- "state": "string"
}, - "ip": "string",
- "source": "string",
- "version": "string"
}
]
}, - "securityContext": {
- "asNumber": 0,
- "asOrg": "string",
- "domain": "string",
- "isp": "string",
- "isProxy": true
}, - "severity": "DEBUG",
- "target": [
- {
- "alternateId": "string",
- "detailEntry": {
- "property1": { },
- "property2": { }
}, - "displayName": "string",
- "id": "string",
- "type": "string"
}
], - "transaction": {
- "detail": {
- "property1": { },
- "property2": { }
}, - "id": "string",
- "type": "string"
}, - "uuid": "string",
- "version": "string"
}
]