Audit logs

The audit log records every significant action taken in a workspace, for example instance power events, settings changes, and recipe installs. Each entry carries the action code (message) and a metadata object with context such as the actor, the affected resource, and before-and-after values.

IP address fields are redacted in responses; they are stripped before serialization and will never appear in metadata.

An audit log entry has these fields:

Field	Type	Description
id	string	Snowflake ID; the timestamp is embedded and increases monotonically
message	string	Action code, for example instance.power or instance.cloud-init
workspace_id	string	Workspace the entry belongs to
metadata	object	Key-value string pairs with action context. Common keys include instance_id, instance_name, session_actor_id, session_actor_name, workspace_id, workspace_name. Specific actions may include additional keys such as before, after, and enabled.

Search audit log

POST/v1/workspaces/{wid}/auditSearch audit log

Searches the audit log for a workspace. The method is POST because the filter is passed as a JSON body rather than query parameters.

Without a body, or with an empty object {}, all entries are returned sorted newest first.

Path parameters

Name	Type	Description
wid	integer	Workspace ID

Request body

A JSON object where each key is a filter field. All keys are optional.

Key	Description
message	Substring match against the action code, for example "power" matches instance.power
date	ISO-8601 date string (YYYY-MM-DD); restricts results to entries created on that calendar day
Any other key	Exact match against a field in metadata, for example "instance_id": "1526665089190330368"

Results are returned sorted by id descending (newest first) unless the pagination sort and dir parameters override that.

Returns a paged list of audit log entries.

curl -X POST https://api.galaxygate.net/v1/workspaces/42/audit \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -A 'curl/8.5' \
  -d '{ "message": "instance.power" }'

Plus the shared pagination parameters as query parameters on the URL.

Fetch an audit entry

GET/v1/workspaces/{wid}/audit/{id}Fetch one audit entry

Returns a single audit log entry by its ID.

Path parameters

Name	Type	Description
wid	integer	Workspace ID
id	integer	Audit entry ID

Returns a single audit log entry, or 404 Not Found if the ID does not exist in the workspace.