Skip to content
FlySIPFlySIP Docs

Read and write audit logs

The audit log records who changed what on the switch, the same records as the Audit Logs Viewer of the panel. Use getAuditLogs to export them to your own monitoring, and writeAuditLog to record actions of your integration next to the panel’s own entries. Both methods are available to the root customer only and support trusted mode.

Dates in this group

Section titled “Dates in this group”

Dates are strings in UTC in the format HH:MM:SS.000 GMT Ddd Mmm DD YYYY, for example 09:57:29.000 GMT Wed Nov 18 2026. In Python:

import time


time.strftime("%H:%M:%S.000 GMT %a %b %d %Y", time.gmtime())

Audit info structure

Section titled “Audit info structure”

audit_info describes the person or system on whose behalf a change is made. The panel fills it for every change it sends to the API, and the values appear in the Action by, User IP and User Agent columns of the log.

Name Type Required Description
datetime string no Time of the action, in the date format
user_ip string no IP address of the user
user_agent string no Browser or client of the user
action_by string no Who made the change, for example a web login
cli_mode boolean no True when the change comes from a script, not from a user

getAuditLogs

Section titled “getAuditLogs”

Returns audit log records of a time window, at most 100 per call. Page through a longer period with offset.

Parameters

Section titled “Parameters”
Name Type Required Description
start_date string no Start of the window, in the date format. Default: one hour ago
end_date string no End of the window. Default: one hour after start_date
limit int no Maximum number of records, up to 100. Default: 100
offset int no Number of records to skip

Returns

Section titled “Returns”
Name Type Description
result string OK
records array Audit log records, each a struct

Each record holds the data shown in the Audit Logs Viewer: the resource, the action code, who did it, when and from which IP address. The action codes (A, U, D, AUTH_OK, FUNDS, CALL_DISC and others) and the resource syntax are listed on the Audit Logs Viewer page.

Example

Section titled “Example”
request
call("getAuditLogs", {
    "start_date": "08:00:00.000 GMT Thu Jan 15 2026",
    "end_date": "09:00:00.000 GMT Thu Jan 15 2026",
    "limit": 100,
    "offset": 0,
})
response
{
    "result": "OK",
    "records": [
        # … one struct per audit log record
    ],
}

writeAuditLog

Section titled “writeAuditLog”

Adds a record to the audit log.

Parameters

Section titled “Parameters”
Name Type Required Description
action string yes Action code, up to 10 characters, for example U for an update. Use the codes of the Audit Logs Viewer
resource string yes What was changed, up to 100 characters, for example routes:i_destination_set=12,i_route=345
audit_info struct no Who made the change; see the audit info structure

Returns

Section titled “Returns”
Name Type Description
result string OK

Example

Section titled “Example”
request
call("writeAuditLog", {
    "action": "U",
    "resource": "routes:i_destination_set=12,i_route=345",
    "audit_info": {
        "datetime": "08:15:42.000 GMT Thu Jan 15 2026",
        "user_ip": "198.51.100.25",
        "user_agent": "acme-provisioning/2.1",
        "action_by": "acme-web",
    },
})
response
{"result": "OK"}
Section titled “Related”