API - Auditing logs

Display auditing logs

We can use GET vault_rest/audit/{start}/{count} endpoint to fetch and search audit logs.

start- starting record to return

count- number of records to return

sort_column= Name of column to use when sorting data

sort_direction= Sorting direction

find= Free text search string

findB64= Free text search string (Base64 encoded)

try {

$headers = @{

Authorization = "Bearer $token"

sort_column = "Name of column to use when sorting data"

sort_direction = "Sorting direction"

find = "Free text search string"

findB64 = "Free text search string (Base64 encoded)"

}

$response = Invoke-RestMethod -Uri "$baseUrl/audit/0/5" -Headers $headers -Method Get

# Prints output as JSON object

Write-Host ( $response | ConvertTo-Json | Out-String)

# Prints output as Table

Write-Output $response.items | Select-Object date, location, event, status, user, description | Format-Table -AutoSize

} catch {

Write-Host "Error Status Code: $($_.Exception.Response.StatusCode.Value__)"

Write-Host "Error Message: $($_.Exception.Message)"

return

{

"filter_count": 2814,

"items": [

{

"audit_id": 14037,

"date": "2025-10-02T13:39:53.0200000",

"description": "milutin logged on.",

"event": "Logon",

"location": "127.0.0.1",

"status": "Success",

"user": "milutin"

{

"audit_id": 14036,

"date": "2025-10-02T13:39:37.9100000",