Harthelm Docs
REST APIAdmin

The audit log

Cluster admins only (`platform.admin`; `hart admin audit`). The audit log, newest first (by time, then id); the filters combine. A malformed `action`, a cursor this API did not return or an `actor` or `team` below 1 is `422`; a malformed time is `400`.

Generated from openapi/harthelm.yaml at v1.5.0
GET
/admin/audit

Authorization

cookie__Host-harthelm_session<token>

Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header Harthelm-CSRF: 1 and a matching Origin.

Query Parameters

limit?integer

Maximum number of items per page.

Range1 <= value <= 200
Default50
cursor?string

Opaque cursor from next_cursor of the previous page.

Lengthlength <= 1024
action?string

An action (workspace.create) or an area prefix ending in a dot (workspace.; it does not match the area workspace_archive.). Lower case letters, digits, underscores and dots, at most 100 characters.

Lengthlength <= 100
actor?integer

Only rows of this user (not of a workspace or the system).

Formatint64
Range1 <= value
team?integer

Only rows of this team.

Formatint64
Range1 <= value
since?string

Only rows at or after this time.

Formatdate-time
until?string

Only rows before this time.

Formatdate-time

Response Body

A page of audit rows.

application/json
  1. response
next_cursor?string

Absent on the last page.

items*array<>
curl -X GET 'https://console.example.com/api/v1/admin/audit'
{  "next_cursor": "string",  "items": [    {      "id": 1,      "at": "2019-08-24T14:15:22Z",      "actor_kind": "user",      "actor_id": 0,      "actor_label": "string",      "action": "string",      "target_kind": "string",      "target_id": "string",      "team_id": 1,      "payload": {},      "remote_addr": "string"    }  ]}

Every user of the installation

Cluster admins only (`platform.admin`; `hart admin users`). Every user of the installation, disabled ones included, ordered by email (ignoring case) and id. `q` is matched as plain text, not as a pattern.

Create an API key

Mints `hart_<id>_<secret>` for the caller. The response carries the key in `token` once; only the SHA-256 of the secret is stored. Use it as `Authorization: Bearer …` or `Harthelm-Authorization: Bearer …` on the API and as `Harthelm-Authorization: Bearer …` on private dev hosts and restricted custom domains. Browser sessions only (403 with an API key), so a leaked key cannot mint a successor that outlives its deletion.