Cloud Administration Event Log API 

The Cloud Administration Event Log API is a REST-based web services interface that allows administration audit log events to be retrieved from Cloud Access Service (CAS). You can use this REST API to download to a Cloud Administration Event Log API client sofware. For example, you can import the audit log events into your security information and event management (SIEM) solution, such as NetWitness, you can write your own custom Administration Event Log API client software, or use the Java or Python utilities or curl commands in the Admin Rest API package on the RSA Downloads page (RSA Community login is required).

Events are retrieved in chronological order in batches, and do not contain duplicates. They can be filtered by date range. All admin events are retained in CAS for 90 days and then purged, so events from the last 90 days are available for download using this API.

For information on audit log messages that describe Helpdesk Administrator and Super Administrator activities, see Administration Log Messages for Cloud Access Service (80001 - 81402).

For information on downloading audit log messages that describe user activities, see Cloud Administration User Event Log API.

For information about managing access to this API, see Accessing the Cloud Administration APIs.

Authentication

Admin Event Log API requests require an HTTP Authorization header with a bearer token to authenticate to CAS. The bearer token must be created as described in Authentication for the Cloud Administration APIs.

Software Developer Kit

You can download the API Software Developer Kit (SDK) as the RSA SecurID Access Administration REST API. It is available from the RSA ID Plus Downloads page (RSA Community login is required).

Request Requirements

Use the following method, request URL, body response, response body type, and response codes to retrieve administration events from CAS and deliver them to your API client.

Request Parameters

The Administration Log Event API allows the following optional parameters.

Note:  The request query parameter values may contain reserve characters that need to be URL encoded. Otherwise, the server may send a 400 Bad Request error. For example, the ISO 8601 Date and Time format may contain the + character if the specific time zone has an offset from UTC, such as+05:30. The + character needs to be encoded as %2B.

Request Examples

The following example displays a REST API request with no parameters.

GET /AdminInterface/restapi/v1/adminlog/exportlogs

Accept: application/json

Authorization: Bearer <bearer token>

The following example shows a REST API request with a specified start time.

GET /AdminInterface/restapi/v1/adminlog/exportlogs?startTimeAfter=2018-05-01T11:22:12.828-05:30

Accept: application/json

Authorization: Bearer <bearer token>

Responses

The following table shows response metadata.

The following example shows sample response metadata with 684 total results and a default page size of 100.

{

"totalPages": 7,

"totalElements": 684,

"pageSize": 100,

"currentPage":0,

"elements": [

{

......

}

]

}

The following table shows API response data.

Example Response

{

"totalPages": 1,

"totalElements": 2,

"pageSize": 100,

"currentPage":0,

"elements": [

{

"eventId": 767,

"eventLogDate": "2018-05-13T16:29:59.000 UTC",

"eventType": "Administration",

"serverURL": "https://mycompany.access..securid.com/AdminInterface/",

"serverIPAddress": "191.237.22.167",

"application": "SecurID Access",

"customerId": 3,

"customerName": "mycompanyname",

"sourceIPAddress": "1.2.3.4",

"adminUserName": "admin@mycompany.com",

"adminUserRole": "Super Administrator",

"activityKey": "SIGNIN_SUCCESS",

"activityCode": 80001,

"result": "SUCCESS",

"reasonKey": "",

"message": "admin@mycompany.com successfully signed in",

"requiresPublish": false

"targetObject1Id": null,

"targetObject1Name": null,

"targetObject1Type": null,

"targetObject2Id": null,

"targetObject2Name": null,

"targetObject2Type": null

},

{

"eventId": 768,

"eventLogDate": "2018-05-13T16:32:09.000 UTC",

"eventType": "Administration",

"serverURL": "https://mycompany.access..securid.com/AdminInterface/",

"serverIPAddress": "191.237.22.167", ,

"application": "SecurID Access",

"customerId": 3,

"customerName": "mycompanyname",

"sourceIPAddress": "1.2.3.4",

"adminUserName": "admin@mycompany.com",

"adminUserRole: "Super Administrator",

"activityKey": "ADD_ADMIN_API_KEY",

"activityCode": 80400,

"result": "SUCCESS",

"reasonKey": "",

"message": "admin@mycompany.com added an

Admin API Key 139f6495-e447-4a26-a765-5c01b6152d5",

"requiresPublish": false,

"targetObject1Id": 18,

"targetObject1Name": "139f6495-e447-4a26-a765-5c01b6b152d5",

"targetObject1Type": "ADMIN_API_KEY",

"targetObject2Id": null,

"targetObject2Name": null,

"targetObject2Type": null

}

]

}

Refer to the following table for baseAccessDNSName.