x-generated: Automatically generated by CDP protoc plugin. Do not edit manually. swagger: '2.0' x-endpoint-name: audit x-products: CDP x-form-factors: public x-cdp-releases: PUBLIC info: version: 0.9.163 title: Cloudera Audit Service license: name: Apache 2.0 description: Cloudera CDP Auditing is a web service for interacting with the audit subsystem. termsOfService: https://www.cloudera.com/legal/commercial-terms-and-conditions.html schemes: - https consumes: - application/json produces: - application/json paths: /api/v1/audit/archiveAuditEvents: post: summary: Archive audit events. description: 'This is used to trigger immediate audit event archiving based on input criteria. WARNING: This command is experimental and subject to backwards-incompatible change.' operationId: archiveAuditEvents x-entitlement: AUDIT_ARCHIVING_API x-right: audit/archiveAuditEvents x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/ArchiveAuditEventsRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ArchiveAuditEventsResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: true /api/v1/audit/batchEventsForArchiving: post: summary: Create batches of audit events to be archived. description: 'Create batches of audit events to be archived. This is an asynchronous operation; use the task ID in the response to get the status of the operation. If automated archiving is configured, then this operation is disabled. NOTE: If an operation is currently in progress, another operation cannot be started.' operationId: batchEventsForArchiving x-right: audit/batchEventsForArchiving parameters: - name: input in: body required: true schema: $ref: '#/definitions/BatchEventsForArchivingRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/BatchEventsForArchivingResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: true /api/v1/audit/configureArchiving: post: summary: Configures the audit system for archiving audit events to external cloud storage. description: Configures the audit system for archiving audit events to an external cloud storage service, replacing any existing configuration. Also returns the current configuration. operationId: configureArchiving x-right: audit/configureArchiving x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/ConfigureArchivingRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ConfigureArchivingResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: true /api/v1/audit/getArchivingConfig: post: summary: Retrieve the current archiving configuration. description: Returns the current configuration. operationId: getArchivingConfig x-right: audit/getArchivingConfig x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/GetArchivingConfigRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/GetArchivingConfigResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/getArchivingStatus: post: summary: Retrieve the status for an archive process. description: 'Returns the current status for the request archive process. WARNING: This command is experimental and subject to backwards-incompatible change.' operationId: getArchivingStatus x-entitlement: AUDIT_ARCHIVING_API x-right: audit/archiveAuditEvents x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/GetArchivingStatusRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/GetArchivingStatusResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/getBatchEventsForArchivingStatus: post: summary: Get the status of creating batches of audit events to be archived. description: Get the status of creating batches of audit events to be archived. If automated archiving is configured, then this operation is disabled. operationId: getBatchEventsForArchivingStatus x-right: audit/getBatchEventsForArchivingStatus parameters: - name: input in: body required: true schema: $ref: '#/definitions/GetBatchEventsForArchivingStatusRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/GetBatchEventsForArchivingStatusResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/listEvents: post: summary: List all audit events recorded in a specified time span, and optionally with a specified request ID and/or event source. description: Returns all audit log events that have a timestamp within the provided range (start is inclusive, end is exclusive) and, optionally, with the specified request ID and/or event source. operationId: listEvents x-right: audit/listAuditEvents x-paging-default-max-items: 20 x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/ListEventsRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ListEventsResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/listEventsInArchiveBatch: post: summary: List events contained in a single archive batch. description: List events contained in a single archive batch. The batch must not be marked as successfully archived already. A batch's events may be listed multiple times, as long as it is not marked as successfully archived. If automated archiving is configured, then this operation is disabled. operationId: listEventsInArchiveBatch x-right: audit/listEventsInArchiveBatch parameters: - name: input in: body required: true schema: $ref: '#/definitions/ListEventsInArchiveBatchRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ListEventsInArchiveBatchResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/listOutstandingArchiveBatches: post: summary: List outstanding (unarchived) archive batches. description: Lists archive batches that have not yet been marked as successfully archived. Their contents remain available for listing. If automated archiving is configured, then this operation is disabled. operationId: listOutstandingArchiveBatches x-right: audit/listOutstandingArchiveBatches x-paging-default-max-items: 20 parameters: - name: input in: body required: true schema: $ref: '#/definitions/ListOutstandingArchiveBatchesRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ListOutstandingArchiveBatchesResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/listRecentArchiveRuns: post: summary: List recent archive runs. description: Returns recent archive runs for a specified account. operationId: listRecentArchiveRuns x-right: audit/listRecentArchiveRuns x-api-rate-limit-group: AUDIT parameters: - name: input in: body required: true schema: $ref: '#/definitions/ListRecentArchiveRunsRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/ListRecentArchiveRunsResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: false /api/v1/audit/markArchiveBatchesAsSuccessful: post: summary: Mark archive batches as successful. description: Mark archive batches as successful. After a batch is marked as successfully archived, it is not considered outstanding and its events may no longer be listed. If automated archiving is configured, then this operation is disabled. operationId: markArchiveBatchesAsSuccessful x-right: audit/markArchiveBatchesAsSuccessful parameters: - name: input in: body required: true schema: $ref: '#/definitions/MarkArchiveBatchesAsSuccessfulRequest' responses: 200: description: Expected response to a valid request. schema: $ref: '#/definitions/MarkArchiveBatchesAsSuccessfulResponse' default: description: The default response on an error. schema: $ref: '#/definitions/Error' x-mutating: true definitions: Error: type: object description: An object returned on an error. properties: code: type: string description: The error code. message: type: string description: The error message. ArchivingConfigInfo: type: object description: Object for holding archiving configuration information for the audit service. properties: storageLocation: type: string description: The destination for the logs, e.g. S3 bucket name credentialName: type: string description: The credential name or CRN to use enabled: type: boolean description: Flag to enable/disable the archiving process storageRegion: type: string description: The region to work with when accessing the logs, e.g. S3 region ConfigureArchivingRequest: type: object description: Request object for the ConfigureArchiving method. required: - storageLocation - credentialName - enabled properties: storageLocation: type: string description: The destination for the logs, e.g. S3 bucket name x-no-paramfile: true credentialName: type: string description: The credential name or CRN to use enabled: type: boolean description: Flag to enable/disable the archiving process storageRegion: type: string description: The region to work with when accessing the logs, e.g. S3 region verifyOnly: type: boolean description: Whether to only verify the configuration, and not update it. ConfigureArchivingResponse: type: object description: Response object for the ConfigureArchiving method. properties: configuration: description: The configuration information $ref: '#/definitions/ArchivingConfigInfo' GetArchivingConfigRequest: type: object description: Request object for the GetArchivingConfig method. GetArchivingConfigResponse: type: object description: Response object for the GetArchivingConfig method. properties: configuration: description: The configuration information $ref: '#/definitions/ArchivingConfigInfo' ListEventsRequest: type: object description: Request object for the ListEvents method. required: - fromTimestamp - toTimestamp properties: fromTimestamp: type: string format: date-time description: The beginning timestamp for the search range (inclusive). toTimestamp: type: string format: date-time description: The ending timestamp for the search range (exclusive). pageSize: type: integer format: int32 minimum: 20 maximum: 50 x-paging-page-size: true description: The page size. pageToken: type: string x-paging-input-token: true description: The page token. requestId: type: string description: The optional request ID. If specified, only events associated with this request ID are returned. eventSource: type: string description: The optional source service. If specified, only events associated with this event source are returned. The source must be the name of a service as enumerated in the CRN definition. eventName: type: string description: The optional event name. If specified, only events with this name are returned. actorCrn: type: string description: The optional actor CRN. If specified, only events with this CRN recorded for the actor identity are returned. resultCode: type: string description: The optional result code. If specified, only events with this result code are returned. Events without a result code are not returned. resultMessage: type: string description: The optional result message. If specified, only events with this result message are returned. Events without a result message are not returned. apiRequestEventCriteria: description: Optional additional filtering criteria for listing API request audit events. $ref: '#/definitions/ApiRequestEventCriteria' cdpServiceEventCriteria: description: Optional additional filtering criteria for listing CDP service audit events. $ref: '#/definitions/CdpServiceEventCriteria' interactiveLoginEventCriteria: description: Optional additional filtering criteria for listing interactive login audit events. $ref: '#/definitions/InteractiveLoginEventCriteria' ApiRequestEventCriteria: type: object description: Filter criteria for listing API request audit events. properties: sourceIPAddress: type: string description: The source IP address of the requester. userAgent: type: string description: The user agent that made the API request. CdpServiceEventCriteria: type: object description: Filter criteria for listing CDP service audit events. properties: resourceCrn: type: string description: The CRN of the resource operated on. InteractiveLoginEventCriteria: type: object description: Filter criteria for listing interactive login audit events. properties: identityProviderUserId: type: string description: The user ID as indicated by the identity provider. The specific format and type of this identifier is determined by the IdP. For Cloudera SSO this is the email used to login. email: type: string description: The email of the user as provided to CDP. sourceIPAddress: type: string description: The source IP address from which the login request came. firstName: type: string description: The first name of the user. lastName: type: string description: The last name of the user. ListEventsResponse: type: object description: Response object for the ListEvents method. properties: auditEvents: type: array x-paging-result: true items: $ref: '#/definitions/CdpAuditEvent' description: The audit events that satisfy the query. nextPageToken: type: string x-paging-output-token: true description: The page token for requesting the next page of results. ApiRequestEvent: type: object description: The model for an API request event, as a part of CdpAuditEvent. These events are triggered by requests to public CDP API services. properties: requestParameters: type: string description: The API request parameters. responseParameters: type: string description: The API response parameters. Only recorded for mutating calls. mutating: type: boolean description: Whether the request mutates the state of resources. apiVersion: type: string description: The API version associated with the request. sourceIPAddress: type: string description: The source IP address of the requester. userAgent: type: string description: The user agent that made the API request. CdpServiceEvent: type: object description: The model for a service event, as a part of CdpAuditEvent. These events are created by Cloudera CDP services, but are not directly triggered by a request to a public CDP API service. properties: additionalServiceEventDetails: type: string description: Optional JSON that contains additional details for an event and/or a result associated with the event. Each service defines the structure of details for each event. resourceCrns: type: array items: type: string description: The CRNs of the resources operated on. detailsVersion: type: string description: The schema version of the additional service event details for this service event. Maintained by the service. InteractiveLoginEvent: type: object description: The model for a login event, as a part of CdpAuditEvent. CDP logs attempts to interactively login to the CDP console. This includes logins using Cloudera SSO and through any federated interactive login events. required: - identityProviderCrn - identityProviderSessionId - identityProviderUserId - email properties: identityProviderCrn: type: string description: The identity provider CRN used to interactively login. For Cloudera SSO the ID is 'crn:altus:iam:us-west-1:altus:samlProvider:cloudera-sso'. For identity provider connectors the connector's CRN is used. identityProviderSessionId: type: string description: 'The identity provider session ID for this interactive login request. For SAML 2.0 identity federation this is the SessionIndex of the SAML AuthnResponse. (Deprecated: No replacement, as this was never available.)' x-deprecated: true identityProviderUserId: type: string description: The user ID as indicated by the identity provider. The specific format and type of this identifier is determined by the IdP. For Cloudera SSO this is the email used to login. email: type: string description: The email of the user as provided to CDP. sourceIPAddress: type: string description: The source IP address from which the login request came from. firstName: type: string description: The first name of the user, if provided. lastName: type: string description: The last name of the user, if provided. accountAdmin: type: boolean description: Whether the user was marked as account admin. Can only be 'true' for users using Cloudera SSO. groups: type: array items: type: string description: A list of group names the user belongs to as received in CDP. Only available for non Cloudera SSO login events. userCrn: type: string description: The CDP user CRN for the user. This may be empty if the login failed. filteredInvalidGroups: type: array items: type: string description: 'The groups that are invalid and filtered (ignored) during the interactive login through non Cloudera SSO IdP. It is a subset of the groups the user belongs to as received in CDP. It can be empty for any of the following reasons: 1) If the account is not entitled for this feature. 2) If the membership sync is off for the IdP used during the interactive login. 3) If all the groups were valid during login through non Cloudera SSO IdP. 4) If the login is performed through Cloudera SSO. 5) If the login fails before filtering invalid groups.' ActorIdentity: type: object description: Identity information about the actor that initiated an event. Only one of the fields in this message may be set. properties: actorCrn: type: string description: The CRN of the actor who initiated this event. actorServiceName: type: string description: The name of the service that initiated this event. It must be the name of a service as enumerated in the CRN definition. CdpAuditEvent: type: object description: The model for an audit event. required: - version - id - eventSource - eventName - timestamp - actorIdentity - accountId properties: version: type: string description: The version of the event structure. id: type: string description: UUID for this event. eventSource: type: string description: The source service of the event. It must be the name of a service as enumerated in the CRN definition. eventName: type: string description: The name of the event. Each source defines all its event names, and a name must be unique for its source. timestamp: type: integer format: int64 description: The Unix timestamp, in milliseconds (UTC), when the event occurred. actorIdentity: description: The actor who initiated this event. $ref: '#/definitions/ActorIdentity' accountId: type: string description: Account id in which this event occurred. requestId: type: string description: Id of the request that initiated this event. Optional. resultCode: type: string description: Optional result code. resultMessage: type: string description: Optional result message, a short message (about one sentence) describing the result. apiRequestEvent: description: Information originating from an API request. $ref: '#/definitions/ApiRequestEvent' cdpServiceEvent: description: Information originating from an event generated by a CDP service. $ref: '#/definitions/CdpServiceEvent' interactiveLoginEvent: description: Information originating from a login event. $ref: '#/definitions/InteractiveLoginEvent' ArchiveAuditEventsRequest: type: object description: Request to archive audit events. required: - fromTimestamp - toTimestamp properties: fromTimestamp: type: string format: date-time description: The beginning timestamp for the search range (inclusive). toTimestamp: type: string format: date-time description: The ending timestamp for the search range (exclusive). ArchiveAuditEventsResponse: type: object description: Response from archiving audit events. properties: eventCount: type: integer format: int64 description: The number of events archived. eventBatches: type: array items: $ref: '#/definitions/ArchiveBatch' description: The details about the batches of events archived. taskId: type: string description: The id representing an asynchronous task. GetArchivingStatusRequest: type: object description: Request to get status for an archive process. required: - taskId properties: taskId: type: string description: The id representing an asynchronous task. GetArchivingStatusResponse: type: object description: Information about a current archive process. properties: status: description: The archive status. $ref: '#/definitions/AsyncTaskStatus' eventCount: type: integer format: int64 description: The number of events archived. eventBatches: type: array items: $ref: '#/definitions/ArchiveBatch' description: The details about the batches of events archived. BatchEventsForArchivingRequest: type: object description: Request to create batches of audit events for archiving. required: - fromTimestamp - toTimestamp properties: fromTimestamp: type: string format: date-time description: The beginning timestamp for the search range. toTimestamp: type: string format: date-time description: The ending timestamp for the search range. BatchEventsForArchivingResponse: type: object description: Response from creating batches of audit events for archiving. properties: taskId: type: string description: The ID of the asynchronous task to monitor. GetBatchEventsForArchivingStatusRequest: type: object description: Request to get the status of creating batches of audit events to be archived. properties: taskId: type: string description: The ID of the asynchronous task to monitor. GetBatchEventsForArchivingStatusResponse: type: object description: Response from getting the status of creating batches of audit events to be archived. properties: status: description: The task status. $ref: '#/definitions/AsyncTaskStatus' eventBatches: type: array items: $ref: '#/definitions/ArchiveBatch' description: The details about the created batches, if the task completed successfully. ListOutstandingArchiveBatchesRequest: type: object description: Request to list outstanding archive batches. properties: fromTimestamp: type: string format: date-time description: The beginning timestamp for the search range (inclusive). toTimestamp: type: string format: date-time description: The ending timestamp for the search range (exclusive). pageSize: type: integer format: int32 minimum: 20 maximum: 100 x-paging-page-size: true description: The page size. pageToken: type: string x-paging-input-token: true description: The page token. ListOutstandingArchiveBatchesResponse: type: object description: The response from listing outstanding archive batches. properties: eventBatches: type: array x-paging-result: true items: $ref: '#/definitions/ArchiveBatch' description: The details about the outstanding batches of events. nextPageToken: type: string x-paging-output-token: true description: The page token for requesting the next page of results. ListEventsInArchiveBatchRequest: type: object description: Request to list events contained in a single archive batch. required: - archiveId properties: archiveId: type: string description: The archive ID of the batch. ListEventsInArchiveBatchResponse: type: object description: Response from listing events contained in a single archive batch. properties: auditEvents: type: array items: $ref: '#/definitions/CdpAuditEvent' description: The audit events in the archive batch. MarkArchiveBatchesAsSuccessfulRequest: type: object description: Request to mark archive batches as successful. properties: archiveIds: type: array items: type: string description: The archive IDs of the batches to mark. MarkArchiveBatchesAsSuccessfulResponse: type: object description: Response from marking archive batches as successful. properties: archiveIds: type: array items: type: string description: The archive IDs of the batches marked as successful. archiveTimestamp: type: string format: date-time description: The archive timestamp marked for each batch. ArchiveBatch: type: object description: Information about a batch of audit events that were archived. properties: accountId: type: string description: The account ID for which events were archived. eventCount: type: integer format: int64 description: The number of events archived. A negative number indicates that the count is not available. archiveId: type: string description: The archive ID of the batch. archiveTimestamp: type: integer format: int64 description: The archive timestamp of the batch. ListRecentArchiveRunsRequest: type: object description: Request to list recent archive runs. properties: limit: type: integer format: int32 description: The maximum number of archive runs to return. ListRecentArchiveRunsResponse: type: object description: The response from listing recent archive runs. properties: archiveRuns: type: array items: $ref: '#/definitions/ArchiveRun' description: The archive runs. ArchiveRun: type: object description: The public model for an archive run. properties: accountId: type: string description: The account ID for the archive run. runId: type: string description: The run ID for the archive run, which uniquely identifies the run. archiveId: type: string description: The archive ID for the batch of events archived by the run. status: description: 'The status of the archive run: CREATED, SUCCEEDED, or FAILED.' $ref: '#/definitions/ArchiveRunStatus' summary: type: string description: A summary of the outcome of the run. details: type: string description: Additional details about the run, such as a stack trace. creationTimestamp: type: string format: date-time description: The creation timestamp of the archive run. archiveTimestamp: type: string format: date-time description: The archive timestamp of the batch. ArchiveRunStatus: type: string description: "Archive run status.\n `CREATED` - Indicates that an archive run has been created but has not yet completed. `SUCCEEDED` - Indicates that an archive run completed successfully. `FAILED` - Indicates that an archive run failed." enum: - CREATED - SUCCEEDED - FAILED AsyncTaskStatus: type: string description: "Archive task status.\n `OPEN` - Task is still in progress `COMPLETED` - Task has completed successfully `FAILED` - Task has failed `CANCELED` - Task was canceled `TERMINATED` - Task as terminated `CONTINUED_AS_NEW` - Task was rerun as a new task `TIMED_OUT` - The task has timed out" enum: - OPEN - COMPLETED - FAILED - CANCELED - TERMINATED - CONTINUED_AS_NEW - TIMED_OUT x-audit: true