跳转到主要内容
POST
/
audit
/
search
检索审计日志
curl --request POST \
  --url 'https://api.flashcat.cloud/audit/search?app_key=' \
  --header 'Content-Type: application/json' \
  --data '
{
  "start_time": 1712620800,
  "end_time": 1712707200,
  "limit": 20,
  "operations": [
    "template:write:create",
    "template:write:delete"
  ]
}
'
import requests

url = "https://api.flashcat.cloud/audit/search?app_key="

payload = {
    "start_time": 1712620800,
    "end_time": 1712707200,
    "limit": 20,
    "operations": ["template:write:create", "template:write:delete"]
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    start_time: 1712620800,
    end_time: 1712707200,
    limit: 20,
    operations: ['template:write:create', 'template:write:delete']
  })
};

fetch('https://api.flashcat.cloud/audit/search?app_key=', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flashcat.cloud/audit/search?app_key=",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'start_time' => 1712620800,
    'end_time' => 1712707200,
    'limit' => 20,
    'operations' => [
        'template:write:create',
        'template:write:delete'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flashcat.cloud/audit/search?app_key="

	payload := strings.NewReader("{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/audit/search?app_key=")
  .header("Content-Type", "application/json")
  .body("{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.flashcat.cloud/audit/search?app_key=")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"start_time\": 1712620800,\n  \"end_time\": 1712707200,\n  \"limit\": 20,\n  \"operations\": [\n    \"template:write:create\",\n    \"template:write:delete\"\n  ]\n}"

response = http.request(request)
puts response.read_body
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "data": {
    "total": 2,
    "search_after_ctx": "",
    "docs": [
      {
        "created_at": 1712700123456,
        "account_id": 10023,
        "member_id": 80011,
        "member_name": "Alice",
        "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
        "ip": "203.0.113.42",
        "operation": "template:write:create",
        "operation_name": "创建模板",
        "body": "{\"template_name\":\"生产默认模板\"}",
        "params": [],
        "is_dangerous": false,
        "is_write": true
      }
    ]
  }
}
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "InvalidParameter",
    "message": "The specified parameter is not valid."
  }
}
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "Unauthorized",
    "message": "You are unauthorized."
  }
}
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "RequestTooFrequently",
    "message": "Request too frequently."
  }
}
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "error": {
    "code": "InternalError",
    "message": "We encountered an internal error, and it has been reported. Please try again later."
  }
}

​
限制说明

项目说明
速率限制每个账户 1,000 次/分钟；50 次/秒
权限要求审计查看（organization）

​
使用说明

  • 时间范围必填。最大跨度 90 天，start_time 和 end_time 均为 Unix 时间戳（秒）。
  • 使用上次响应中的 search_after_ctx 获取下一页。该 token 是不透明的，请勿手动构造。
  • 可查询的时间窗口受账户许可证限制，超出保留期的查询会静默返回空结果，而不是报错。
  • 默认每页 20 条，最大 99 条。

授权

​
app_key
string
query
必填

在 Flashduty 控制台 账户 → APP Key 中签发的 app_key。调用任何公开 API 时都必须携带。它等同于所属账户的身份凭证，请妥善保管。

请求体

application/json

审计日志检索的过滤条件，时间范围必填。

​
start_time
integer<int64>
必填

检索窗口开始时间，Unix 时间戳（秒）。

示例:

1712620800

​
end_time
integer<int64>
必填

检索窗口结束时间，Unix 时间戳（秒）。必须晚于 start_time，最大跨度 90 天。

示例:

1712707200

​
limit
integer

每页条数。最小 0，最大 99。

必填范围: 0 <= x <= 99
示例:

20

​
request_id
string

按唯一请求 ID 过滤到单条记录。

​
search_after_ctx
string

上次响应返回的不透明分页游标。首页留空。

​
operations
string[]

按操作名称过滤。合法值可通过 POST /audit/operation/list 获取。

​
person_id
integer<uint64>

按操作人成员 ID 过滤。

​
is_dangerous
boolean | null

为 true 时只返回高危操作。

​
is_write
boolean | null

为 true 时只返回写操作；为 false 时只返回读操作。

响应

成功

成功响应结构。2xx 响应中 request_id 标识本次调用（同时出现在 Flashcat-Request-Id 响应头中），data 为接口业务 payload。失败响应使用不同结构，参见 ErrorResponse。

​
request_id
string
必填

本次请求的唯一 ID，也会在 Flashcat-Request-Id 响应头中返回。反馈问题时请一并附上。

示例:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

​
data
object
必填

游标分页的审计日志检索结果。