Audit Logs
Track all administrative changes in the API7 control plane with detailed audit logs. Learn how to review, manage, and export audit trails for security and compliance.
API7 control plane provides a complete audit trail of all administrative actions. These audit logs are what security monitoring, troubleshooting, and regulatory compliance are built on.
Capabilities
- Complete tracking: Record all changes to routes, services, plugins, and security policies.
- Detailed Context: Capture the identity of the user who made the change, the time of the action, and the request and response bodies that were sent.
- Long-Term Retention: Configure the retention period for audit data to meet your compliance needs.
- External Export: Export audit logs to SIEM platforms for centralized analysis.
Audit Log Contents
Each audit log entry includes:
| Field | Description |
|---|---|
| Timestamp | When the operation occurred. |
| Operator | The username or API key used to perform the action. |
| Event type | The action performed, as a named event such as AddConsumerCredential. GET /api/audit_logs/event_types returns the full list. |
| Resource | The target object (e.g., Route: 123, SSL: 456). |
| Request and response | The HTTP method, URI, body and user agent of the request, and the status code and body of the response. The entry records what was sent, not a before/after diff of the object. |
| Token name | The token used, when the operation came through the Admin API rather than an interactive session. |
| Source IP | The IP address from which the request originated. |
| Source | Which interface the operation came through. Requests made through the Dashboard UI and through the compatible Admin API paths (/apisix/admin/*) are both recorded with the same dashboard value; they are not distinguished from each other. Changes made declaratively through ADC are audited alongside changes made in the UI. |
| Gateway group | The ID of the gateway group the operation applied to. |
Sensitive values are masked before an entry is written, so an audit trail can be shared with reviewers who are not entitled to see the secrets the operation carried.
Review Audit Logs in the Dashboard
To view the audit trail, log in to the API7 Dashboard and navigate to the Organization > Audit Logs section. You can filter the logs by date range, operator, operation type, or specific resource, and export the filtered result as JSON or CSV for an external reviewer.
Retention
By default, audit logs are retained for 60 days. The control plane runs a background cleanup job that deletes audit entries older than the configured retention period. To change the retention period, set audit.retention_days in your control plane configuration:
audit:
retention_days: 180Set a longer retention period if your compliance framework requires extended audit history, or a shorter one to reduce database storage consumption.
Export to SIEM
For advanced security analysis and correlation, you can export your audit logs to external SIEM platforms such as Splunk, Elastic, or Datadog. See the Splunk Integration guide for a detailed walkthrough of connecting API7 logs to Splunk using the HEC (HTTP Event Collector). The same approach works for any log sink that exposes an HTTP ingestion endpoint. For high-volume environments, you can also query the underlying PostgreSQL database for audit data directly.
Compliance and Accountability
By maintaining a clear, immutable record of all administrative changes, API7 Gateway helps you demonstrate accountability and pass security audits. Audit logs ensure that every configuration change can be traced back to a specific individual and time.
Next Steps
- Configure RBAC to limit who can make administrative changes.
- Review the Trust Center for certifications and security reports.