Read and write audit logs

The audit log records who changed what on the switch, the same records as the Audit Logs Viewer of the panel. Use getAuditLogs to export them to your own monitoring, and writeAuditLog to record actions of your integration next to the panel’s own entries. Both methods are available to the root customer only and support trusted mode.

Dates in this group

Dates are strings in UTC in the format HH:MM:SS.000 GMT Ddd Mmm DD YYYY, for example 09:57:29.000 GMT Wed Nov 18 2026. In Python:

import time

time.strftime("%H:%M:%S.000 GMT %a %b %d %Y", time.gmtime())

Audit info structure

audit_info describes the person or system on whose behalf a change is made. The panel fills it for every change it sends to the API, and the values appear in the Action by, User IP and User Agent columns of the log.

Name	Type	Required	Description
datetime	string	no	Time of the action, in the date format
user_ip	string	no	IP address of the user
user_agent	string	no	Browser or client of the user
action_by	string	no	Who made the change, for example a web login
cli_mode	boolean	no	True when the change comes from a script, not from a user

getAuditLogs

Returns audit log records of a time window, at most 100 per call. Page through a longer period with offset.

Parameters

Name	Type	Required	Description
start_date	string	no	Start of the window, in the date format. Default: one hour ago
end_date	string	no	End of the window. Default: one hour after start_date
limit	int	no	Maximum number of records, up to 100. Default: 100
offset	int	no	Number of records to skip

Returns

Name	Type	Description
result	string	OK
records	array	Audit log records, each a struct

Each record holds the data shown in the Audit Logs Viewer: the resource, the action code, who did it, when and from which IP address. The action codes (A, U, D, AUTH_OK, FUNDS, CALL_DISC and others) and the resource syntax are listed on the Audit Logs Viewer page.

Example

request

call("getAuditLogs", {
    "start_date": "08:00:00.000 GMT Thu Jan 15 2026",
    "end_date": "09:00:00.000 GMT Thu Jan 15 2026",
    "limit": 100,
    "offset": 0,
})

response

{
    "result": "OK",
    "records": [
        # … one struct per audit log record
    ],
}

writeAuditLog

Adds a record to the audit log.

Parameters

Name	Type	Required	Description
action	string	yes	Action code, up to 10 characters, for example U for an update. Use the codes of the Audit Logs Viewer
resource	string	yes	What was changed, up to 100 characters, for example routes:i_destination_set=12,i_route=345
audit_info	struct	no	Who made the change; see the audit info structure

Returns

Name	Type	Description
result	string	OK

Example

request

call("writeAuditLog", {
    "action": "U",
    "resource": "routes:i_destination_set=12,i_route=345",
    "audit_info": {
        "datetime": "08:15:42.000 GMT Thu Jan 15 2026",
        "user_ip": "198.51.100.25",
        "user_agent": "acme-provisioning/2.1",
        "action_by": "acme-web",
    },
})

response

{"result": "OK"}

Related

• Audit Logs Viewer: the same records in the panel
• Manage active calls: disconnectCall and disconnectAccount take audit_info too