Audit Logs

GET

audit

Get Audit Logs

curl --request GET \
  --url https://auth.nullpass.xyz/api/audit \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://auth.nullpass.xyz/api/audit', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/audit",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/audit"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/audit")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "logs": [
    {
      "id": "<string>",
      "action": "<string>",
      "data": {},
      "createdAt": "2023-11-07T05:31:56Z"
    }
  ],
  "total": 123,
  "limit": 123,
  "offset": 123
}

{
  "error": "<string>",
  "message": "<string>"
}

Endpoint

GET /api/audit

Overview

Retrieves audit logs for the authenticated user. IP addresses in log data are automatically decrypted for display.

IP Address Encryption: IP addresses stored in audit logs are encrypted using AES-256-GCM with user-specific keys. They are automatically decrypted when retrieved via this API endpoint. See IP Encryption for implementation details.

Request

Requires authentication via Bearer token.

Query Parameters

number

default:"50"

Maximum number of logs to return (max 100)

number

default:"0"

Number of logs to skip (for pagination)

string

Filter by audit action type (e.g., “USER_LOGIN”, “PASSWORD_CHANGE”)

Response

array

Array of audit log entries

Show Audit Log Entry

string

Log entry ID

string

Audit action type

object

Additional log data (IP addresses are decrypted)

string

Timestamp of the action

number

Total number of logs matching the filter

number

Limit used in the query

number

Offset used in the query

Implementation Details

Code Reference

export async function GET(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request)
  if (blocked) return blocked

  const auth = await requireAuth(request)
  if ('error' in auth) return auth.error

  try {
    const { searchParams } = new URL(request.url)
    const limit = parseInt(searchParams.get('limit') || '50')
    const offset = parseInt(searchParams.get('offset') || '0')
    const action = searchParams.get('action')

    const where: any = {
      userId: auth.userId,
    }

    if (action) {
      where.action = action
    }

    const [logs, total] = await Promise.all([
      prisma.auditLog.findMany({
        where,
        orderBy: {
          createdAt: 'desc',
        },
        take: Math.min(limit, 100),
        skip: offset,
        select: {
          id: true,
          action: true,
          data: true,
          createdAt: true,
        },
      }),
      prisma.auditLog.count({ where }),
    ])

    const logsWithDecryptedIp = logs.map(log => {
      const data = log.data as any
      if (data && typeof data === 'object' && 'ip' in data && typeof data.ip === 'string') {
        return {
          ...log,
          data: {
            ...data,
            ip: decryptIp(data.ip, auth.userId),
          },
        }
      }
      return log
    })

    return jsonResponse(
      {
        logs: logsWithDecryptedIp,
        total,
        limit,
        offset,
      },
      200,
      request.headers.get('origin')
    )
  } catch (error) {
    console.error('Get audit logs error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

Status Codes

Success

Unauthorized

Missing or invalid authentication token

Example Requests

Get All Logs

curl -X GET https://auth.nullpass.xyz/api/audit \
  -H "Authorization: Bearer YOUR_TOKEN"

Get Logs with Pagination

curl -X GET "https://auth.nullpass.xyz/api/audit?limit=20&offset=0" \
  -H "Authorization: Bearer YOUR_TOKEN"

Filter by Action

curl -X GET "https://auth.nullpass.xyz/api/audit?action=USER_LOGIN" \
  -H "Authorization: Bearer YOUR_TOKEN"

Example Response

{
  "logs": [
    {
      "id": "clx1234567890",
      "action": "USER_LOGIN",
      "data": {
        "ip": "192.168.1.1",
        "twoFactorUsed": false
      },
      "createdAt": "2024-01-01T00:00:00.000Z"
    },
    {
      "id": "clx0987654321",
      "action": "PASSWORD_CHANGE",
      "data": {},
      "createdAt": "2024-01-02T00:00:00.000Z"
    }
  ],
  "total": 2,
  "limit": 50,
  "offset": 0
}

Security Notes

Users can only view their own audit logs
IP addresses are automatically decrypted from storage format
Maximum limit is 100 logs per request
Logs are ordered by creation date (newest first)

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

limit

integer

default:50

Maximum number of logs to return (max 100)

Required range: x <= 100

offset

integer

default:0

Number of logs to skip (for pagination)

action

string

Filter by audit action type (e.g., "USER_LOGIN", "PASSWORD_CHANGE")

Response

Audit logs

logs

object[]

Show child attributes

total

integer

limit

integer

offset

integer

Rate LimitingArcjet protection and rate limiting configuration

Get Audit Logs

curl --request GET \
  --url https://auth.nullpass.xyz/api/audit \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://auth.nullpass.xyz/api/audit', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/audit",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/audit"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/audit")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "logs": [
    {
      "id": "<string>",
      "action": "<string>",
      "data": {},
      "createdAt": "2023-11-07T05:31:56Z"
    }
  ],
  "total": 123,
  "limit": 123,
  "offset": 123
}

{
  "error": "<string>",
  "message": "<string>"
}

Get Started

Authentication

Services

Webhooks

Account Management

Service Connection

Polar Integration

Admin

Advanced

Library

Endpoint

Overview

Request

Query Parameters

Response

Implementation Details

Code Reference

Status Codes

Example Requests

Get All Logs

Filter by Action

Example Response

Security Notes

Authorizations

Query Parameters

Response

​Endpoint

​Overview

​Request

​Query Parameters

​Response

​Implementation Details

​Code Reference

​Status Codes

​Example Requests

​Get All Logs

​Get Logs with Pagination

​Filter by Action

​Example Response

​Security Notes

Authorizations

Query Parameters

Response

Endpoint

Overview

Request

Query Parameters

Response

Implementation Details

Code Reference

Status Codes

Example Requests

Get All Logs

Get Logs with Pagination

Filter by Action

Example Response

Security Notes