Audit Logs

CertWatch.io records an audit entry for every API request and security-relevant event in your organization. You can view audit logs in the dashboard and query them via the API.

What is recorded

Category Fields
Request HTTP method, path, query parameters, request body (non-GET)
Authentication organization, API key or user, authentication type
Response status code, response time, error code and message
Client IP address, user agent, country
Security rate-limit remaining, security flags, security-event marker
Resource resource type, resource ID, action performed

Querying audit logs

# List recent audit events
curl "https://api.certwatch.io/api/v1/audit-logs" \
  -H "Authorization: Bearer cw_live_..."

Useful endpoints:

  • GET /api/v1/audit-logs lists events with filtering and pagination
  • GET /api/v1/audit-logs/export exports as CSV or JSON
  • GET /api/v1/audit-logs/stats returns aggregate statistics
  • GET /api/v1/audit-logs/security-events returns security events only
  • GET /api/v1/audit-logs/{id} returns one event in full detail

See the API Reference for parameters and response shapes.

Retention and privacy

Audit logs are retained per your plan and stored separately from monitoring data. Request bodies are stored as submitted, so avoid putting secrets in request payloads beyond the authentication header.