Reference: Audit Log

StratoLens's own audit trail: who did what in StratoLens. This is the data behind the Audit Log System page. It is not the Azure Activity Log; for that, see Changes & Activity.

Installation-wide

This route needs View Audit Logs (held by Manager and Administrator among the built-in roles) and is not narrowed by data scope.

Audit Log

`GET /api/getAuditLogs`

Permission: View Audit Logs

Read audit entries, newest first, with skip/take paging and filters.

Parameters

getAuditLogs parameters
Name	Default	Notes
`skip`	0	0-10000
`take`	25	1-100
`startDate`, `endDate`		Any parseable date, normalised to a UTC timestamp; inclusive. Send a full timestamp for `endDate` (for example `2026-10-15T23:59:59Z`), because a date-only value ends at midnight at the start of that day
`type`		Exact activity type, e.g. `ScheduledScanExecuted`
`category`		`user_action`, `automated_process`
`actorType`		`user`, `system`
`actorName`		Exact, case-sensitive display name
`correlationId`		Exact

Errors

400skip parameter must be a number between 0 and 10000
400take parameter must be a number between 1 and 100
400startDate must be a valid ISO date string
400endDate must be a valid ISO date string
400category must be 'user_action' or 'automated_process'
400actorType must be 'user' or 'system'
500Failed to retrieve audit logs

Response: { activities[], totalCount, skip, take, hasMore, availableTypes[], availableActorTypes[], availableActorNames[] }. The available* lists honour only the date filter. Each activity:

getAuditLogs activity fields
Field	Meaning
`id`, `timestamp`, `auditMonth`	Identity and time
`category`, `type`	Classification
`actor`	`{ type, id?, displayName? }`
`summary`, `correlationId?`	What happened, and the correlation ID when present
`keyInformation`, `details`	Objects with the entry's data
`context?`	`{ ipAddress?, userAgent?, sessionId? }`

Notes

To read beyond 10,000 entries, narrow the dates rather than paging deeper.
Admin changes to the External API controls appear here under Access & Security. Individual API calls do not.

Example

GET /api/getAuditLogs?take=100&startDate=2026-10-01T00:00:00Z&endDate=2026-10-15T00:00:00Z&category=user_action