Audit Log - Query

參考

服務:: Audit

API 版本:: 7.1-preview.1

查詢稽核記錄專案

GET https://auditservice.dev.azure.com/{organization}/_apis/audit/auditlog?api-version=7.1-preview.1

含選擇性參數:

GET https://auditservice.dev.azure.com/{organization}/_apis/audit/auditlog?startTime={startTime}&endTime={endTime}&batchSize={batchSize}&continuationToken={continuationToken}&skipAggregation={skipAggregation}&api-version=7.1-preview.1

URI 參數

名稱	位於	必要	類型	Description
organization	path		string	Azure DevOps 組織的名稱。
api-version	query	True	string	要使用的 API 版本。這應該設定為 '7.1-preview.1' 以使用此版本的 API。
batchSize	query		integer int32	要傳回的結果數目上限。選擇性
continuationToken	query		string	用來從上一個查詢傳回下一組結果的權杖。選擇性
endTime	query		string date-time	下載視窗的結束時間。選擇性
skipAggregation	query		boolean	略過匯總事件，並改為將它們保留為個別專案。根據預設，會匯總事件。匯總的事件種類：AuditLog.AccessLog。
startTime	query		string date-time	下載視窗的開始時間。選擇性

回應

名稱	類型	Description
200 OK	AuditLogQueryResult	成功的作業

安全性

oauth2

類型: oauth2
Flow: accessCode
授權 URL: https://app.vssps.visualstudio.com/oauth2/authorize&response_type=Assertion
權杖 URL: https://app.vssps.visualstudio.com/oauth2/token?client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

範圍

名稱	Description
vso.auditlog	授與讀取稽核記錄和稽核串流給使用者的能力

範例

By date

範例要求

HTTP

GET https://auditservice.dev.azure.com/_apis/audit/auditlog?startTime=2019-03-04T14:05:59.928Z&endTime=2019-03-05T14:05:59.928Z&batchSize=2&api-version=7.1-preview.1

範例回覆

狀態碼:: 200

{
  "value": {
    "decoratedAuditLogEntries": [
      {
        "id": "2518505060978539161;00000064-0000-8888-8000-000000000000;86fbe369-3f5d-4f52-9ab0-3be7db271948",
        "correlationId": "86fbe369-3f5d-4f52-9ab0-3be7db271948",
        "activityId": "033fde68-f713-4984-b24f-8d7a73d1ade6",
        "actorCUID": "a718550e-4777-4058-8298-bff88d0cb524",
        "actorUserId": "d6a98b6c-6932-485c-a986-aea9fc981df0",
        "authenticationMechanism": "FedAuth",
        "timestamp": "2019-03-05T14:05:02.1460838+00:00",
        "scopeType": "organization",
        "scopeDisplayName": "fabrikam (Organization)",
        "scopeId": "73638cd5-0dda-4128-9fd6-48c16d4e4de3",
        "ipAddress": "167.220.148.131",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
        "actionId": "AuditLog.AccessLog",
        "data": {
          "Filter": {
            "StartTime": "2019-03-04T14:05:59.928Z",
            "EndTime": "2019-03-05T14:05:59.928Z",
            "ContinuationToken": null,
            "BatchSize": 2,
            "HasMore": true
          },
          "EventSummary": [
            "2019-03-05T14:05:02.1460838+00:00",
            "2019-03-05T13:59:40.4899467+00:00",
            "2019-03-05T13:58:13.159128+00:00"
          ]
        },
        "details": "Accessed the audit log 3 times",
        "area": "Auditing",
        "category": "access",
        "categoryDisplayName": "Access",
        "actorDisplayName": "Norman Paulk",
        "actorImageUrl": "https://dev.azure.com/fabrikam/_apis/GraphProfile/MemberAvatars/aad.NzdhMTNiN2MtYjIxNy03NDc4LWIxMjItYTlhMTU5YTFlNWQw"
      },
      {
        "id": "2518505063644965580;00000002-0000-8888-8000-000000000000;198b13cf-5201-48e8-acef-0d8bb2d9e815",
        "correlationId": "57f825b4-a940-44a3-a3cc-25cdb9871107",
        "activityId": "01abe2fd-deee-4a47-b35f-dff3edc059a4",
        "actorCUID": "00000000-0000-0000-0000-000000000000",
        "actorUserId": "00000002-0000-8888-8000-000000000000",
        "authenticationMechanism": "",
        "timestamp": "2019-03-05T14:00:35.5034419+00:00",
        "scopeType": "organization",
        "scopeDisplayName": "fabrikam (Organization)",
        "scopeId": "73638cd5-0dda-4128-9fd6-48c16d4e4de3",
        "ipAddress": null,
        "userAgent": "",
        "actionId": "Project.CreateCompleted",
        "data": {
          "ProjectId": "2e0ffea5-d693-4711-862c-94393bacadcb",
          "ProjectName": "fabrikam-fiber-git",
          "ProcessTemplate": "Agile",
          "ProjectVisibility": "Private"
        },
        "details": "fabrikam-fiber-git project was created successfully",
        "area": "Project",
        "category": "create",
        "categoryDisplayName": "Create",
        "actorDisplayName": "Azure DevOps Service",
        "actorImageUrl": null
      }
    ],
    "continuationToken": "2518505063644965580;00000002-0000-8888-8000-000000000000;198b13cf-5201-48e8-acef-0d8bb2d9e815",
    "hasMore": false
  }
}

定義

名稱	Description
AuditActionCategory	執行的動作類型
AuditLogQueryResult	查詢稽核記錄時所傳回的物件。其中包含記錄檔和查詢更多稽核專案所需的資訊。
AuditScopeType	組織 (範圍的類型只有目前支援的範圍)
DecoratedAuditLogEntry

AuditActionCategory

Enumeration

執行的動作類型

值	Description
access	已存取成品
create	成品已建立
execute	成品已執行
modify	已修改成品
remove	已移除成品
unknown	類別未知

AuditLogQueryResult

Object

查詢稽核記錄時所傳回的物件。其中包含記錄檔和查詢更多稽核專案所需的資訊。

名稱	類型	Description
continuationToken	string	要傳遞以取得下一組結果的接續權杖
decoratedAuditLogEntries	DecoratedAuditLogEntry[]	稽核記錄專案的清單
hasMore	boolean	如果擷取更多相符的結果，則為 True，否則為 false。

AuditScopeType