get_audit_logs_of_resource

ResourceAuditLogsApi.get_audit_logs_of_resource(role_id, resource, id, limit=None, offset=None, sortorder=None, sortby=None, projection_expression=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

List audit logs for a user or resource

Returns DynamoDB audit rows for the path resource and id. Pagination is in DynamoDB; last page when next_available is no. Viewing another user’s logs or dwh requires users.fullaccess. Other types use ACL or creator/role-membership checks.

Parameters:

  • role_id (str) – Amorphic role ID. Required on the request (AUTH-1001 when missing for paths that call is_user_action_valid). Recorded in audit logs. Self-user GET does not run a permission check on this header. (required)

  • resource (str) – Resource kind. users is always accepted. Other values must be in the SSM permittedResourcesList. Unknown values return 400 {“Message”: “Invalid ‘Resource’ specified in Path Parameters”} with no code. hcls-* (except hcls-omics-workflows) is treated as hcls. users/{id} for a service user is remapped to service-users. (required)

  • id (str) – UserId when resource is users, otherwise the resource id. files ids are URL-decoded. assets ids are “{datasource_id}:{asset_id}” (invalid parts return IPV-1002). (required)

  • limit (str) – Page size as a string. Defaults to 1000. Values above 1000 return GE-1028. Non-numeric values fail as HTTP 500 without a code prefix.

  • offset (str) – 1-based item offset as a string (1 is the first log). Omitted starts at index 0. Last page when next_available is no. Out of range is HTTP 500 with the IPV-1026 text and no code prefix. Non-numeric values fail as HTTP 500 without a code prefix.

  • sortorder (str) – Sort on CreationTime. Defaults to desc. Only the value asc sets ScanIndexForward true; any other value sorts descending. There is no allow-list.

  • sortby (str) – Must be CreationTime (any case) or omitted (defaults to CreationTime). Any other value returns GE-1047.

  • projection_expression (str) – Present in the spec but ignored. The handler never reads this parameter and does not project items.

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

ResourceAuditLogsOutput

Returns:

Returns the result object.

Request and Response Examples

HTTP: GET /resource-audit-logs/{resource}/{id}

Success (HTTP 200)

AuditLogs plus next_available (yes/no), count (this page), and total_count. Continue with offset += limit until next_available is no. An empty result is still 200 with AuditLogs [] and total_count 0 (no Message).

First page of logs

{
  "AuditLogs": [
    {
      "AuditId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "Action": "create",
      "CreationTime": "2024-06-01 12:00:00",
      "ExpirationTime": 1719849600,
      "Message": "Dataset created",
      "ResourceId": "b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f",
      "ResourceType": "datasets",
      "UserId": "user1"
    }
  ],
  "next_available": "no",
  "count": 1,
  "total_count": 1
}

No logs for this id

{
  "AuditLogs": [],
  "next_available": "no",
  "count": 0,
  "total_count": 0
}

Errors

Documented error codes: AUTH-1001, AUTH-1003, AUTH-1030, GE-1028, GE-1047, IPV-1002, RTE-1001, IPV-1026.

HTTP 400

Validation or authorization failure. Coded errors are {“Message”: “<CODE> - <text>”}. Codes: AUTH-1001, AUTH-1003, AUTH-1030 (users.fullaccess for another user or dwh), GE-1028 (limit over 1000), GE-1047 (sortby), IPV-1002 (assets datasource or asset not found). No-code bodies: invalid resource path, and not authorized to view logs (datasets/roles/guard-rails/creator/ACL miss).

resource is not users and not in the permitted list

{
  "Message": "Invalid 'Resource' specified in Path Parameters"
}

Caller cannot view this resource’s logs

{
  "Message": "Not authorized to view resource audit logs"
}

limit greater than 1000

{
  "Message": "GE-1028 - Out of range for items per page, Limit is 1000"
}

sortby is not CreationTime

{
  "Message": "GE-1047 - Sorting is not supported for other columns, please use CreationTime"
}

Another user’s logs without users.fullaccess

{
  "Message": "AUTH-1030 - User is not authorized to get audit log information for the specified resource due to the following missing permission(s) - {'Users': ['fullaccess']}"
}

HTTP 500

This Lambda maps GenericFailureException and InconsistentMetadataException to HTTP 500. Uncaught errors (including non-numeric limit/offset) use {“Message”: “<exception>”} with no RTE-1001 prefix. Offset past the last item is HTTP 500 with the IPV-1026 text and no code prefix.

offset beyond total_count

{
  "Message": "Invalid parameter - OffsetIndex, offset must be between 1 and total_number_of_files(3)"
}

limit is not an integer

{
  "Message": "invalid literal for int() with base 10: 'abc'"
}