View audit logs

Use the Telegraf Controller API to query and read audit entries.

• Prerequisites
• Query the audit log API
• Response shape
• Verify integrity

Prerequisites

• Audit logging must be enabled.
• The Owner or Administrator role assigned to your account.
• An API token issued to a user with one of those roles. See Create an API token.

Query the audit log API

Send GET requests to /api/audit-logger. The endpoint accepts the following query parameters:

curl -H "Authorization: Bearer 
YOUR_TC_API_TOKEN
" \
  "https://telegraf_controller.example.com/api/audit-logger?from=2026-05-01T00:00:00Z&to=2026-05-31T23:59:59Z&page=1&limit=500"

Replace YOUR_TC_API_TOKEN with a Telegraf Controller API token issued to an Owner or Administrator.

Response shape

The response is a JSON array. Each entry includes the event, the actor, the outcome, and the tamper-detection hash chain fields.

[
  {
    "seq": 4827,
    "timestamp": "2026-05-27T18:42:11.512Z",
    "action": "user.login",
    "actorId": "01HZ8R5T4VX9YQK0M2N3P4Q5R6",
    "actorType": "User",
    "ipAddress": "10.0.4.17",
    "userAgent": "Mozilla/5.0 ...",
    "outcome": "Success",
    "hash": "f7c1...",
    "prevHash": "a309..."
  }
]

actorType is one of User, Token, or System. For the categories of events captured, see What gets audited.

Verify integrity

The hash and prevHash fields form a SHA-256 chain across all entries. To detect tampering, walk the result set in seq order and check that:

1. Each entry’s prevHash equals the previous entry’s hash.
2. seq numbers are contiguous within and across monthly files.

If either check fails, an entry has been altered, removed, or inserted out of order. For background on how the chain is constructed, see Tamper detection.