Audit Log - Query

参考

服务:: Audit

API 版本:: 7.1-preview.1

查询审核日志条目

GET https://auditservice.dev.azure.com/{organization}/_apis/audit/auditlog?api-version=7.1-preview.1

具有可选参数:

GET https://auditservice.dev.azure.com/{organization}/_apis/audit/auditlog?startTime={startTime}&endTime={endTime}&batchSize={batchSize}&continuationToken={continuationToken}&skipAggregation={skipAggregation}&api-version=7.1-preview.1

URI 参数

名称	在	必需	类型	说明
organization	path		string	Azure DevOps 组织的名称。
api-version	query	True	string	要使用的 API 版本。这应设置为“7.1-preview.1”才能使用此版本的 API。
batchSize	query		integer int32	要返回的最大结果数。可选
continuationToken	query		string	用于从上一个查询返回下一组结果的令牌。可选
endTime	query		string date-time	下载窗口的结束时间。可选
skipAggregation	query		boolean	跳过聚合事件，改为将其保留为单个条目。默认情况下，事件是聚合的。聚合的事件类型：AuditLog.AccessLog。
startTime	query		string date-time	下载窗口的开始时间。可选

响应

名称	类型	说明
200 OK	AuditLogQueryResult	成功的操作

安全性

oauth2

类型: oauth2
流向: accessCode
授权 URL: https://app.vssps.visualstudio.com/oauth2/authorize&response_type=Assertion
令牌 URL: https://app.vssps.visualstudio.com/oauth2/token?client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

作用域

名称	说明
vso.auditlog	向用户授予读取审核日志和审核流的能力

示例

By date

示例请求

HTTP

GET https://auditservice.dev.azure.com/_apis/audit/auditlog?startTime=2019-03-04T14:05:59.928Z&endTime=2019-03-05T14:05:59.928Z&batchSize=2&api-version=7.1-preview.1

示例响应

状态代码:: 200

{
  "value": {
    "decoratedAuditLogEntries": [
      {
        "id": "2518505060978539161;00000064-0000-8888-8000-000000000000;86fbe369-3f5d-4f52-9ab0-3be7db271948",
        "correlationId": "86fbe369-3f5d-4f52-9ab0-3be7db271948",
        "activityId": "033fde68-f713-4984-b24f-8d7a73d1ade6",
        "actorCUID": "a718550e-4777-4058-8298-bff88d0cb524",
        "actorUserId": "d6a98b6c-6932-485c-a986-aea9fc981df0",
        "authenticationMechanism": "FedAuth",
        "timestamp": "2019-03-05T14:05:02.1460838+00:00",
        "scopeType": "organization",
        "scopeDisplayName": "fabrikam (Organization)",
        "scopeId": "73638cd5-0dda-4128-9fd6-48c16d4e4de3",
        "ipAddress": "167.220.148.131",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
        "actionId": "AuditLog.AccessLog",
        "data": {
          "Filter": {
            "StartTime": "2019-03-04T14:05:59.928Z",
            "EndTime": "2019-03-05T14:05:59.928Z",
            "ContinuationToken": null,
            "BatchSize": 2,
            "HasMore": true
          },
          "EventSummary": [
            "2019-03-05T14:05:02.1460838+00:00",
            "2019-03-05T13:59:40.4899467+00:00",
            "2019-03-05T13:58:13.159128+00:00"
          ]
        },
        "details": "Accessed the audit log 3 times",
        "area": "Auditing",
        "category": "access",
        "categoryDisplayName": "Access",
        "actorDisplayName": "Norman Paulk",
        "actorImageUrl": "https://dev.azure.com/fabrikam/_apis/GraphProfile/MemberAvatars/aad.NzdhMTNiN2MtYjIxNy03NDc4LWIxMjItYTlhMTU5YTFlNWQw"
      },
      {
        "id": "2518505063644965580;00000002-0000-8888-8000-000000000000;198b13cf-5201-48e8-acef-0d8bb2d9e815",
        "correlationId": "57f825b4-a940-44a3-a3cc-25cdb9871107",
        "activityId": "01abe2fd-deee-4a47-b35f-dff3edc059a4",
        "actorCUID": "00000000-0000-0000-0000-000000000000",
        "actorUserId": "00000002-0000-8888-8000-000000000000",
        "authenticationMechanism": "",
        "timestamp": "2019-03-05T14:00:35.5034419+00:00",
        "scopeType": "organization",
        "scopeDisplayName": "fabrikam (Organization)",
        "scopeId": "73638cd5-0dda-4128-9fd6-48c16d4e4de3",
        "ipAddress": null,
        "userAgent": "",
        "actionId": "Project.CreateCompleted",
        "data": {
          "ProjectId": "2e0ffea5-d693-4711-862c-94393bacadcb",
          "ProjectName": "fabrikam-fiber-git",
          "ProcessTemplate": "Agile",
          "ProjectVisibility": "Private"
        },
        "details": "fabrikam-fiber-git project was created successfully",
        "area": "Project",
        "category": "create",
        "categoryDisplayName": "Create",
        "actorDisplayName": "Azure DevOps Service",
        "actorImageUrl": null
      }
    ],
    "continuationToken": "2518505063644965580;00000002-0000-8888-8000-000000000000;198b13cf-5201-48e8-acef-0d8bb2d9e815",
    "hasMore": false
  }
}

定义

名称	说明
AuditActionCategory	执行的操作类型
AuditLogQueryResult	查询审核日志时返回的对象。它包含查询更多审核条目所需的日志和信息。
AuditScopeType	组织 (作用域的类型是当前仅支持的范围)
DecoratedAuditLogEntry

AuditActionCategory

Enumeration

执行的操作类型

值	说明
access	已访问项目
create	已创建项目
execute	已执行项目
modify	已修改项目
remove	已删除项目
unknown	类别未知

AuditLogQueryResult

Object

查询审核日志时返回的对象。它包含查询更多审核条目所需的日志和信息。

名称	类型	说明
continuationToken	string	要传递以获取下一组结果的继续标记
decoratedAuditLogEntries	DecoratedAuditLogEntry[]	审核日志条目列表
hasMore	boolean	如果要提取更多匹配的结果，则为 True;否则为 false。

AuditScopeType