API Request Logs

API Request Logs extend audit coverage to automation. Every request made with an API token is attributed to that token and the actor it belongs to, which makes it possible to trace an unexpected change from a script, integration, or Terraform run back to its exact origin.

Every authenticated request to the REST API records one entry, and the entry is written before the request is processed. If it can't be recorded, the request fails, so an API operation is never allowed to proceed unlogged.

Log IDs

API Request Log IDs start with a, and because the bits after the stream character are random, they carry no ordering meaning. Order entries by timestamp instead.

Fields

Field	Description
`log_id`	Unique ID of the entry.
`timestamp`	When the request was received.
`actor_id`	The actor the API token belongs to.
`api_token_id`	The API token used to authenticate the request.
`method`	HTTP method of the request.
`path`	Request path.
`content_length`	Size of the request body in bytes.
`request_id`	Unique request ID, also returned in the response headers.
`user_agent`	User agent of the API client.
`ip`	Source IP address of the request.
`ip_region`, `ip_city`	Country code and city resolved from the IP.
`ip_lat`, `ip_lon`	Coordinates resolved from the IP.

The location fields are resolved from the request's source IP using MaxMind's GeoLite2 City database when the entry is recorded, and the portal surfaces them as a Location column on every entry along with a location map in the detail panel.

Example

A Terraform provider listing policies:

{
  "type": "api_request",
  "log_id": "a7b3e91c4d208f5a6e1b2c3d",
  "timestamp": "2026-07-14T09:26:31.114213Z",
  "actor_id": "b8e0c2a4-6d8f-4a0b-8c2e-4f6a8b0c2d4e",
  "api_token_id": "d0f2a4c6-8e0b-4c2d-9e4f-6a8c0e2f4a6c",
  "method": "GET",
  "path": "/policies",
  "content_length": 0,
  "request_id": "F8nMlbf6MUyJZUUABBzB9-yT",
  "user_agent": "terraform-provider-firezone/0.4.1",
  "ip": "203.0.113.44",
  "ip_region": "US",
  "ip_city": "San Francisco",
  "ip_lat": 37.7749,
  "ip_lon": -122.4194
}

Viewing and retention

API Request Logs live under LogsAPI Request Logs in the admin portal, which shows each request's method, path, size, and a client badge derived from the user agent. You can also query them via the REST API's /logs endpoint with type=api_request. Entries are kept for 90 days.

Need help? See all support options.