查询审计日志
查询组织内的审计事件(控制台管理操作、登录事件与 Admin API 操作),按事件时间倒序返回,游标分页。
GET
/
v1
/
admin
/
organizations
/
audit_logs
查询审计日志
curl --request GET \
--url https://api.moonshot.cn/v1/admin/organizations/audit_logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.moonshot.cn/v1/admin/organizations/audit_logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.moonshot.cn/v1/admin/organizations/audit_logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.moonshot.cn/v1/admin/organizations/audit_logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.moonshot.cn/v1/admin/organizations/audit_logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.moonshot.cn/v1/admin/organizations/audit_logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.moonshot.cn/v1/admin/organizations/audit_logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"event_type": "api_key.created",
"organization_id": "<string>",
"actor": {
"type": "user",
"id": "<string>",
"name": "<string>",
"ip": "<string>",
"user_agent": "<string>"
},
"result": "success",
"created_at": "2023-11-07T05:31:56Z",
"project_id": "<string>",
"target": {
"type": "api_key",
"id": "<string>",
"name": "<string>"
},
"error_code": "<string>",
"error_message": "<string>",
"detail": {}
}
],
"has_more": true,
"next": "<string>"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}本接口要求 Admin Key 具备
audit:read 作用域。审计日志按组织开关启用:组织管理员在「控制台 → 组织管理 → Admin Key 管理 → 审计日志卡片」开启。未开启时本接口返回空列表(与「没有事件」同形,无法区分)。开启后事件自开启时点起可查:开启前不回溯,关闭期间的空白不可恢复。每次调用本接口自身也会记录一条 audit_log.read 审计事件。授权
Authorization 请求头携带 Admin API secret 作为 Bearer 令牌,格式为 Bearer sk-admin-***。Admin Key 可在「控制台 → 组织管理 → Admin API Keys」创建。
查询参数
起始时间(epoch 毫秒),含边界。例如 1790784000000(2026-10-01 00:00 CST)。
必填范围:
x >= 0结束时间(epoch 毫秒),不含边界。例如 1792598400000(2026-10-22 00:00 CST)。
必填范围:
x >= 0事件类型过滤。只返回 event_type 属于本列表的事件。支持重复传参(event_types=a&event_types=b)或逗号拼接(event_types=a,b)。
审计事件类型。枚举值可能随版本新增。
| 值 | 含义 |
|---|---|
api_key.created | 推理 API 密钥 创建。 |
api_key.updated | 推理 API 密钥 更新(改名/启停)。 |
api_key.deleted | 推理 API 密钥 删除(吊销)。 |
admin_api_key.created | Admin Key 创建(控制台自助签发)。 |
admin_api_key.updated | Admin Key 更新(名称/scopes/有效期);轮换复用本事件,以 detail.action=rotate 区分。 |
admin_api_key.deleted | Admin Key 删除(软删,列表置灰保留)。 |
organization.member_invited | 创建组织成员邀请。 |
organization.member_joined | 被邀请人接受邀请加入组织。 |
organization.member_role_updated | 组织成员角色变更(admin ↔ member)。 |
organization.member_removed | 组织成员被移除。 |
organization.ip_whitelist_updated | 组织 IP 白名单整体覆盖更新。 |
organization.audit_log_enabled | 组织审计日志开启(组织管理员操作)。 |
organization.audit_log_disabled | 组织审计日志关闭。 |
project.created | 项目创建。 |
project.updated | 项目更新(名称/描述)。 |
project.archived | 项目归档。 |
project.member_added | 项目成员加入(重复添加时更新角色,upsert 语义)。 |
project.member_role_updated | 项目成员角色变更。 |
project.member_removed | 项目成员被移除。 |
project.spend_limit_updated | 项目支出限额变更。 |
project.rate_limit_updated | 项目限速配置(TPM 维度)变更。 |
audit_log.read | 审计日志查询(自审计;每次调用 GET audit_logs 记录一条)。 |
auth.login_succeeded | 登录成功。 |
auth.login_failed | 登录失败(唯一保留的失败结果事件,用于安全审计)。 |
可用选项:
api_key.created, api_key.updated, api_key.deleted, admin_api_key.created, admin_api_key.updated, admin_api_key.deleted, organization.member_invited, organization.member_joined, organization.member_role_updated, organization.member_removed, organization.ip_whitelist_updated, organization.audit_log_enabled, organization.audit_log_disabled, project.created, project.updated, project.archived, project.member_added, project.member_role_updated, project.member_removed, project.spend_limit_updated, project.rate_limit_updated, audit_log.read, auth.login_succeeded, auth.login_failed 操作者 ID 过滤(uid 或 Admin Key ID)。
操作者类型过滤。
可用选项:
user, api_key 对象类型过滤。 审计事件对象类型。
| 值 | 含义 |
|---|---|
api_key | 推理 API 密钥(ak- 前缀)。 |
admin_api_key | Admin Key(admk_ 前缀)。 |
member | 组织/项目成员(uid)。 |
project | 项目(proj- 前缀)。 |
invite | 邀请单。 |
ip_whitelist | 组织 IP 白名单。 |
user | 平台用户(登录事件主体)。 |
organization | 组织。 |
audit_log | 审计日志(自审计事件对象)。 |
可用选项:
api_key, admin_api_key, member, project, invite, ip_whitelist, user, organization, audit_log 对象 ID 过滤。
结果过滤。
可用选项:
success, failed 页大小。默认 20,最大 100。
必填范围:
1 <= x <= 100上一次响应 next 字段返回的游标。游标只携带页位置;每次翻页都需原样重复全部查询参数(limit 除外),服务端不校验参数一致性。
此页面对您有帮助吗?
⌘I
查询审计日志
curl --request GET \
--url https://api.moonshot.cn/v1/admin/organizations/audit_logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.moonshot.cn/v1/admin/organizations/audit_logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.moonshot.cn/v1/admin/organizations/audit_logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.moonshot.cn/v1/admin/organizations/audit_logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.moonshot.cn/v1/admin/organizations/audit_logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.moonshot.cn/v1/admin/organizations/audit_logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.moonshot.cn/v1/admin/organizations/audit_logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"event_type": "api_key.created",
"organization_id": "<string>",
"actor": {
"type": "user",
"id": "<string>",
"name": "<string>",
"ip": "<string>",
"user_agent": "<string>"
},
"result": "success",
"created_at": "2023-11-07T05:31:56Z",
"project_id": "<string>",
"target": {
"type": "api_key",
"id": "<string>",
"name": "<string>"
},
"error_code": "<string>",
"error_message": "<string>",
"detail": {}
}
],
"has_more": true,
"next": "<string>"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}