API reference

Audit logs

The console activity log of your WeGuard account: who did what and when, newest first.

Import the whole API:OpenAPI 3.1 Postman collection

Use the audit log to feed a SIEM or to review administrative changes. It is the activity log of the whole account, the same one an account admin (customer_admin) sees in the console.

The console records the entries, so event, message and level are free-form text, not a fixed set. The API never returns the request and response payloads recorded internally, and it replaces credentials in a message, such as API keys, with [redacted].

The audit log object

AttributeDescription

id string: Unique id of the entry.
object string: Always audit_log.
occurredAt timestamp: When WeGuard recorded the entry. since / until filter on this time.
actor objectnullable: The console user who performed the action. null when the recorded actor is not an email address.
actor.email string: Login email of the console user at the time of the action.
event stringnullable: Event category recorded by the console, for example Policy, Roles and Permissions or SSO. Free-form text, not a closed set.
message stringnullable: Human-readable description of the action. Credentials in the text are replaced with [redacted].
level stringnullable: Severity in lowercase, for example info, warn or error. Free-form text, not a closed set.
sourceIp stringnullable: The public IP address the action came from: the nearest public address in the recorded forwarding chain. Best effort and for information only. null when no valid public IP address was recorded.
policyId stringnullable: Id of the policy the action concerns. null unless a valid policy id was recorded.

Example

{
  "id": "6702a4b8c9d0e1f2a3b4c5d6",
  "object": "audit_log",
  "occurredAt": "2026-10-07T08:15:02Z",
  "actor": {
    "email": "admin@acme.example"
  },
  "event": "Policy",
  "message": "Kiosk: Scanners updated",
  "level": "info",
  "sourceIp": "203.0.113.7",
  "policyId": "64ff0a1b2c3d4e5f60718293"
}

List audit log entries

GET/v1/audit-logs

Requiresaudit_logs:read

Returns audit log entries between since and until, newest first, as a paginated list. If you omit both since and until, you get the last 7 days. See Time ranges.

Audit log entries contain email addresses and IP addresses of your console users. Grant audit_logs:read only to systems that need it.

Query parameters

ParameterDescription

since timestampoptionaldefault 7 days before until: Start of the time range (inclusive), as an ISO-8601 timestamp with a UTC offset, for example 2026-10-01T00:00:00Z. Must be earlier than until. The range can span at most 93 days. See Time ranges.
until timestampoptionaldefault now: End of the time range (exclusive), as an ISO-8601 timestamp with a UTC offset. If you omit it, the first page fixes “now” and every nextCursor carries that value, so all pages cover the same window. In that case the maximum span of 93 days allows 5 minutes of clock tolerance.
actor stringoptional: Only return entries by this console user. Pass an email address of at most 254 characters. The match is exact and case-sensitive, and a value that is not an email address is rejected.
limit integeroptionaldefault 25: Maximum number of items to return, from 1 to 100.
cursor stringoptional: The nextCursor from the previous page. Send it unchanged, together with the same filters. See Pagination.
includeTotal booleanoptionaldefault false: Set to true to also return totalCount. It runs an extra count, so request it only when you need it.

Example request

curl "https://api-gw.weguard.ai/core/v1/audit-logs?since=2026-10-01T00:00:00Z&until=2026-10-08T00:00:00Z&actor=admin@acme.example&limit=1" \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

const response = await fetch("https://api-gw.weguard.ai/core/v1/audit-logs?since=2026-10-01T00:00:00Z&until=2026-10-08T00:00:00Z&actor=admin@acme.example&limit=1", {
  headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});

const body = await response.json();
if (!response.ok) {
  throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);

import os
import requests

response = requests.get(
    "https://api-gw.weguard.ai/core/v1/audit-logs",
    params={
        "since": "2026-10-01T00:00:00Z",
        "until": "2026-10-08T00:00:00Z",
        "actor": "admin@acme.example",
        "limit": 1,
    },
    headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Response

A list object whose data holds audit log objects, newest first.

200 OK

{
  "object": "list",
  "data": [
    {
      "id": "6702a4b8c9d0e1f2a3b4c5d6",
      "object": "audit_log",
      "occurredAt": "2026-10-07T08:15:02Z",
      "actor": {
        "email": "admin@acme.example"
      },
      "event": "Policy",
      "message": "Kiosk: Scanners updated",
      "level": "info",
      "sourceIp": "203.0.113.7",
      "policyId": "64ff0a1b2c3d4e5f60718293"
    }
  ],
  "hasMore": true,
  "nextCursor": "dDE6MTc5MTQxNDAwMDAwMDo2NzAxYzJlNWYxYTJiM2M0ZDVlNmY3ODk"
}

Errors

400invalid_parameter
since or until is not an ISO-8601 timestamp with an offset, or is outside the range 1970-01-01T00:00:00Z to 9999-12-31T23:59:59.999Z; since is not earlier than until; the range is longer than 93 days; limit or includeTotal is invalid; or a parameter was sent twice. Also returned when actor is not an email address.
400unknown_parameter
The request includes a query parameter this endpoint does not accept.
400invalid_cursor
The cursor is malformed, or was issued for a different listing: another path, other filters, or another since / until.
403insufficient_scope
The key lacks audit_logs:read.

Common errors

Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.

401missing_credentials
The request has no Authorization header.
401invalid_authorization_header
The Authorization header does not use the Bearer scheme, or has no key after it. The WWW-Authenticate header carries error="invalid_request".
401invalid_api_key
The key is malformed, does not exist, or its secret does not match. The WWW-Authenticate header carries error="invalid_token".
401api_key_expired
The key is past its expiresAt.
401api_key_revoked
An account admin revoked the key. Revocation takes effect immediately and cannot be undone.
403account_inactive
The WeGuard account that owns the key has been deleted or disabled.
406not_acceptable
The Accept header excludes JSON.
429rate_limit_exceeded
The key has used up its request budget. See Rate limits.
500internal_error
An unexpected error occurred on our side.
503service_unavailable
A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries Retry-After.