> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ozura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

# Audit Logs

Track all activity in your Ozura Vault projects for compliance and monitoring.

## Overview

Audit logs record:

* Token creation and deletion
* Detokenization requests
* Proxy transactions
* Authentication events
* Settings changes
* Project management actions

## Endpoint

```
GET /audit-logs
```

## Authentication

Requires JWT token.

## Quick Start

```bash theme={null}
curl -X GET "$YOUR_VAULT_URL/audit-logs" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"
```

## Response

```json theme={null}
{
  "success": true,
  "data": {
    "logs": [
      {
        "id": "log_abc123",
        "event_type": "TOKEN_CREATION",
        "action": "TOKENIZE",
        "resource_type": "TOKEN",
        "resource_id": "tok_xyz789",
        "user_id": "usr_def456",
        "app_id": "app_ghi789",
        "timestamp": "2024-01-15T10:30:00Z",
        "ip_address": "203.0.113.50",
        "details": {
          "token_type": "card",
          "masked_number": "411111******1111"
        }
      }
    ],
    "pagination": {
      "page": 1,
      "limit": 50,
      "total": 1250
    }
  }
}
```

## Log Entry Fields

| Field           | Description                               |
| --------------- | ----------------------------------------- |
| `id`            | Unique log entry ID                       |
| `event_type`    | Type of event (see Event Types)           |
| `action`        | Specific action taken                     |
| `resource_type` | Type of resource affected                 |
| `resource_id`   | ID of affected resource                   |
| `user_id`       | User who performed action (if applicable) |
| `app_id`        | Application used (if applicable)          |
| `timestamp`     | When the event occurred                   |
| `ip_address`    | Source IP address                         |
| `details`       | Additional event-specific data            |

## Sections

* [Querying Logs](query.md) - Filtering and searching
* [Event Types](events.md) - All event types reference

## Use Cases

### Compliance Audits

Demonstrate PCI compliance with complete activity history.

### Security Monitoring

Detect unusual patterns:

* Multiple failed login attempts
* High detokenization volume
* Access from unexpected IPs

### Debugging

Trace issues through the system:

* Failed transactions
* Token not found errors
* Permission issues

## Retention

Audit logs are retained for **2 years** by default.

## Next Steps

* [Querying Logs](query.md) - Filter and search logs
* [Event Types](events.md) - Reference for all events