Audit logs

We record workspace actions and account security activity with structured action codes, actor details, resource references, and changed fields.

Customer responses hide staff network information. For other actors, address and network fields can be present. Network filters exclude staff entries.

Audit entry fields

Field	Type	Description
`action`	string	Action performed. See Action codes.
`actor_asn`	string or null	Autonomous system number announcing the actor's address, when available
`actor_country`	string or null	ISO 3166-1 alpha-2 country of the actor's address, when available
`actor_id`	string or null	User or token that performed the action, absent for system actors
`actor_ip`	string or null	IP address the actor connected from, when available
`actor_name`	string	Name of the actor at the time of the action
`actor_network`	string or null	Name of the network announcing the actor's address, when available
`actor_network_type`	string or null	Kind of network the actor's address belongs to, when available
`actor_staff`	boolean	Whether the action was performed by platform staff
`actor_type`	string	Kind of principal that performed the action. Values: `USER`, `TOKEN`, `SYSTEM`, `ANONYMOUS`, `APPLICATION`.
`context`	object	Resources involved, changed fields and parameters of the action
`created`	string	When the action happened. ISO 8601 timestamp.
`id`	string	Audit log entry ID
`target_id`	string or null	ID of the resource the entry is filed under
`target_kind`	string	Kind of resource the entry is filed under. Values: `INSTANCE`, `DEDIBOX`, `IMAGE`, `VPC`, `RECIPE`, `FLOATING_IP`, `TOKEN`, `USER`, `OAUTH_APPLICATION`, `WORKSPACE`, `SSH_KEY`, `REGISTRY_CREDENTIAL`.
`target_name`	string or null	Name of the resource at the time of the action
`user_id`	string or null	Account the action happened on
`workflow_id`	string or null	Workflow started by the action
`workspace_id`	string or null	Workspace the action happened in

The context object contains:

Field	Type	Description
`changes`	object	Fields the action changed, keyed by field name
`details`	object or null	Parameters of the action, for the actions that have any
`refs`	object	Other resources involved, keyed by their role in the action

Action codes

The action filter accepts these exact values. It does not perform substring matching.

INSTANCE_CREATED
INSTANCE_TERMINATED
INSTANCE_TERMINATION_SCHEDULED
INSTANCE_TERMINATION_CANCELLED
INSTANCE_POWER_ON
INSTANCE_POWER_OFF
INSTANCE_POWER_CYCLE
INSTANCE_SHUTDOWN
INSTANCE_POWER
INSTANCE_SUSPENDED
INSTANCE_RESUMED
INSTANCE_NETWORK_SUSPENDED
INSTANCE_NETWORK_RESUMED
INSTANCE_BOOT_CHANGED
INSTANCE_CLOUD_INIT_UPDATED
INSTANCE_HOSTNAME_CHANGED
INSTANCE_PASSWORD_RESET
INSTANCE_SSH_KEYS_SYNCED
INSTANCE_RECIPE_INSTALLED
INSTANCE_UPGRADED
INSTANCE_UPGRADES_APPLIED
INSTANCE_MIGRATION_STARTED
INSTANCE_REINSTALLED
INSTANCE_PACKET_CAPTURE_STARTED
SNAPSHOT_CREATED
SNAPSHOT_DELETED
SNAPSHOT_RESTORED
BACKUP_CREATED
BACKUP_RESTORED
ISO_ATTACHED
ISO_DETACHED
VPC_ATTACHED
VPC_DETACHED
FIREWALL_RULE_CREATED
FIREWALL_RULE_UPDATED
FIREWALL_RULE_DELETED
FIREWALL_UPDATED
FIREWALL_RESET
IP_ATTACHED
IP_DETACHED
IP_AUTO_ASSIGNED
IP_RELEASED
ISO_UPLOADED
ISO_IMPORTED
TEMPLATE_CREATED
TEMPLATE_IMPORTED
IMAGE_DELETED
VPC_DELETED
RECIPE_CREATED
RECIPE_UPDATED
RECIPE_DELETED
DEDIBOX_POWER_ON
DEDIBOX_POWER_OFF
DEDIBOX_POWER_CYCLE
DEDIBOX_SHUTDOWN
DEDIBOX_RECONFIGURED
DEDIBOX_VNC_RESET
TOKEN_CREATED
TOKEN_DELETED
TOKEN_EXPOSED_REVOKED
ACCOUNT_REGISTERED
ACCOUNT_LOGIN_PASSWORD
ACCOUNT_LOGIN_SSO
ACCOUNT_LOGIN_PASSWORD_FAILED
ACCOUNT_LOGIN_SSO_FAILED
ACCOUNT_LOGOUT
ACCOUNT_SESSIONS_REVOKED
ACCOUNT_SESSION_LOCATION_REVOKED
ACCOUNT_RENAMED
ACCOUNT_EMAIL_CHANGE_REQUESTED
ACCOUNT_EMAIL_CHANGED
ACCOUNT_EMAIL_VERIFIED
ACCOUNT_EMAIL_UNVERIFIED
ACCOUNT_PASSWORD_CHANGED
ACCOUNT_PASSWORD_RESET_REQUESTED
ACCOUNT_PASSWORD_RESET
ACCOUNT_PASSWORD_CLEARED
ACCOUNT_MFA_ENABLED
ACCOUNT_MFA_DISABLED
ACCOUNT_IDENTITY_LINKED
ACCOUNT_IDENTITY_UNLINKED
ACCOUNT_LOCKED
ACCOUNT_UNLOCKED
ACCOUNT_BILLING_LINK_CHANGED
ACCOUNT_DELETED
OAUTH_APPLICATION_AUTHORIZED
OAUTH_APPLICATION_DEAUTHORIZED
OAUTH_TOKEN_ISSUED
OAUTH_TOKEN_REFRESHED
OAUTH_TOKEN_REVOKED
OAUTH_APPLICATION_CREATED
OAUTH_APPLICATION_UPDATED
OAUTH_APPLICATION_DELETED
OAUTH_APPLICATION_SECRET_REGENERATED
WORKSPACE_CREATED
WORKSPACE_RENAMED
WORKSPACE_SETTINGS_CHANGED
WORKSPACE_DELETED
MEMBER_INVITED
MEMBER_INVITE_UPDATED
MEMBER_INVITE_REVOKED
MEMBER_JOINED
MEMBER_ROLE_CHANGED
MEMBER_PERMISSIONS_CHANGED
MEMBER_REMOVED
SSH_KEY_ADDED
SSH_KEY_DELETED
REGISTRY_CREDENTIAL_ADDED
REGISTRY_CREDENTIAL_UPDATED
REGISTRY_CREDENTIAL_DELETED

Search audit log

GET/v1/workspaces/{wid}/auditSearch audit log

Lists workspace actions, newest first. Requires read access to the workspace audit log. Send filters as query parameters. No request body is used.

Path parameters

Name	Type	Required	Description
`wid`	string	yes	Workspace ID

Query parameters

Name	Type	Required	Description
`action`	string[]	no	Actions to filter
`target_kind`	string	no	Kind of resource the entries are filed under. Values: `INSTANCE`, `DEDIBOX`, `IMAGE`, `VPC`, `RECIPE`, `FLOATING_IP`, `TOKEN`, `USER`, `OAUTH_APPLICATION`, `WORKSPACE`, `SSH_KEY`, `REGISTRY_CREDENTIAL`.
`target_id`	string[]	no	IDs of the resources the entries are filed under
`actor_type`	string	no	Kind of principal that performed the action. Values: `USER`, `TOKEN`, `SYSTEM`, `ANONYMOUS`, `APPLICATION`.
`actor_id`	string[]	no	IDs of the users or tokens that performed the action
`workflow_id`	string	no	Only entries for the given workflow
`since`	string	no	Only entries at or after this time. ISO 8601 timestamp.
`until`	string	no	Only entries before this time. ISO 8601 timestamp.
`ip`	string	no	Only entries from this address, or from any address in this CIDR range
`asn`	string[]	no	Autonomous system numbers the actor's address belongs to
`country`	string[]	no	ISO 3166-1 alpha-2 countries of the actor's address
`network_type`	string	no	Kind of network the actor's address belongs to. Values: `PROXY`, `DATACENTER`, `RESIDENTIAL`, `UNKNOWN`.

Plus the shared pagination query parameters.

Returns 200 OK with a keyset-paged list of audit entries.

bash

curl 'https://api.galaxygate.net/v1/workspaces/42/audit?action=INSTANCE_POWER&since=2026-03-01T00:00:00Z' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -A 'curl/8.5'

Fetch an audit entry

GET/v1/workspaces/{wid}/audit/{aid}Fetch an audit entry

Requires read access to the workspace audit log. Returns 404 Not Found if the entry does not exist in this workspace.

Path parameters

Name	Type	Required	Description
`wid`	string	yes	Workspace ID
`aid`	string	yes	Audit log entry ID

Returns 200 OK with a single audit entry.

Search account audit log

GET/v1/users/{uid}/auditSearch account audit log

Lists account security activity, newest first. Requires an interactive login session for the account. API tokens cannot read this log. Use @me for your account.

Path parameters

Name	Type	Required	Description
`uid`	string	yes	User ID, or @me for the current user

Query parameters

Name	Type	Required	Description
`action`	string[]	no	Actions to filter
`target_kind`	string	no	Kind of resource the entries are filed under. Values: `INSTANCE`, `DEDIBOX`, `IMAGE`, `VPC`, `RECIPE`, `FLOATING_IP`, `TOKEN`, `USER`, `OAUTH_APPLICATION`, `WORKSPACE`, `SSH_KEY`, `REGISTRY_CREDENTIAL`.
`target_id`	string[]	no	IDs of the resources the entries are filed under
`actor_type`	string	no	Kind of principal that performed the action. Values: `USER`, `TOKEN`, `SYSTEM`, `ANONYMOUS`, `APPLICATION`.
`actor_id`	string[]	no	IDs of the users or tokens that performed the action
`workflow_id`	string	no	Only entries for the given workflow
`since`	string	no	Only entries at or after this time. ISO 8601 timestamp.
`until`	string	no	Only entries before this time. ISO 8601 timestamp.
`ip`	string	no	Only entries from this address, or from any address in this CIDR range
`asn`	string[]	no	Autonomous system numbers the actor's address belongs to
`country`	string[]	no	ISO 3166-1 alpha-2 countries of the actor's address
`network_type`	string	no	Kind of network the actor's address belongs to. Values: `PROXY`, `DATACENTER`, `RESIDENTIAL`, `UNKNOWN`.

Plus the shared pagination query parameters.

Returns 200 OK with a keyset-paged list of audit entries.

Fetch an account audit entry

GET/v1/users/{uid}/audit/{aid}Fetch an account audit entry

Requires an interactive login session for the account. API tokens cannot read this log. Returns 404 Not Found if the entry does not exist on the account.

Path parameters

Name	Type	Required	Description
`uid`	string	yes	User ID, or @me for the current user
`aid`	string	yes	Audit log entry ID

Returns 200 OK with a single audit entry.

Audit logs ​

Audit entry fields ​

Action codes ​

Search audit log ​

Fetch an audit entry ​

Search account audit log ​

Fetch an account audit entry ​

Audit logs

Audit entry fields

Action codes

Search audit log

Fetch an audit entry

Search account audit log

Fetch an account audit entry