--- title: "Using pubsub API calls to collect audit events" slug: "using-pubsub-api-calls-to-collect-audit-events" description: "Using PUB/SUB API calls to collect audit events" updated: 2024-08-19T17:59:25Z published: 2024-08-19T17:59:25Z canonical: "help.rapididentity.com/using-pubsub-api-calls-to-collect-audit-events" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt > Use this file to discover all available pages before exploring further. # Using pubsub API calls to collect audit events ## Required information You will need four pieces of information to utilize the APIs - The host for your cluster (us001, us002, etc) - Your tenant ID - An API key - The number of messages you'd like to retrieve in each set ## API call format ### Authenticate The authentication call will need a header identifying the content. `{'Content-type': 'application/json'}` The data to be sent will be a JSON containing the API key (a 32 character alpha numeric string). `{'apiKey': '123Abc45ExampleKeyFormat678stuvw'}` The URL to send the POST request will contain the following information - The host for your cluster (example https://pubsub.us003.ia.us003-rapididentity.com/) - Your tenant ID (example ia07766af2bd2f4efb824806ec1ef6d4b8) Example: ```plaintext https://pubsub.us003.ia.us003-rapididentity.com/v1/tenants/ia07766af2bd2f4efb824806ec1ef6d4b8/authenticate ``` A successful authentication will return a JSON containing an ID Token to be used in the Poll call and a statusCode of 200. ```json {    "data": {        "AuthenticationResult": {            "AccessToken": "xxxxxxxxxxxxxxxxxxxxx",            "ExpiresIn": 3600,            "IdToken": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",            "NewDeviceMetadata": null,            "RefreshToken": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",            "TokenType": "Bearer"        },        "ChallengeName": null,        "ChallengeParameters": {},        "Session": null    },.... } ``` ### Poll The poll call will need a header identifying the content and the ID Token as Authorization. `{'Content-type': 'application/json', 'Authorization': 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'}` The data to be sent will be a JSON containing the maximum number of messages you want returned on this call. `{'maxMessages': 50}` The URL to send the POST request will contain the following information - The host for your cluster (example https://pubsub.us003.ia.us003-rapididentity.com/) - Your tenant ID (example ia07766af2bd2f4efb824806ec1ef6d4b8) Example: ```plaintext https://pubsub.us003.ia.us003-rapididentity.com/v1/tenants/ia07766af2bd2f4efb824806ec1ef6d4b8/projects/builtin/subscriptions/audit:pull ``` A successful poll will return a JSON containing audit events from the message queue and a statusCode of 200. If there are no messages currently in the queue, data.receivedMessages will be null. ```json {  receivedMessages: [    {      actionId: 'net.idauto.audit.common.core.action.configSaved',      'ext.User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36',      'ext.enabled': 'true',      'ext.expiration': '2024-08-14T22:05:00.000Z',      'ext.version': '22',      hostIp: '172.17.94.70',      id: '39571b80-d3e4-4eb6-81df-41c8abf41a52',      moduleId: 'net.idauto.audit.common.module.core',      perpDN: 'idautoID=08b5f0ec-d56a-4712-ada5-c86074ab11db,ou=Accounts,dc=meta',      perpId: '08b5f0ec-d56a-4712-ada5-c86074ab11db',      perpIp: '172.17.95.143',      perpIpForwarded: '10.10.10.10',      productId: 'net.idauto.audit.common.product.core',      successful: 'true',      target: 'net.idauto.config.IdautoTenantLoginConfig',      targetSystem: 'CONFIG_DB',      tenantId: 'ia07766af2bd2f4efb824806ec1ef6d4b8',      timestamp: '2024-08-01T22:05:16.015Z'    },    {      actionId: 'net.idauto.audit.common.core.action.configSaved',      'ext.User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36',      'ext.enabled': 'false',      'ext.version': '23',      hostIp: '172.17.94.70',      id: '22315d78-8174-4f4a-839a-d58e4de8befe',      moduleId: 'net.idauto.audit.common.module.core',      perpDN: 'idautoID=08b5f0ec-d56a-4712-ada5-c86074ab11db,ou=Accounts,dc=meta',      perpId: '08b5f0ec-d56a-4712-ada5-c86074ab11db',      perpIp: '172.17.81.223',      perpIpForwarded: '10.10.10.10',      productId: 'net.idauto.audit.common.product.core',      successful: 'true',      target: 'net.idauto.config.IdautoTenantLoginConfig',      targetSystem: 'CONFIG_DB',      tenantId: 'ia07766af2bd2f4efb824806ec1ef6d4b8',      timestamp: '2024-08-01T22:05:18.696Z'    }  ] } ``` ## Example code ### Connect ```actionscript myHeaders = {'Content-type': 'application/json'} myData = {'apiKey': Global.pubSubAPIKey} result = httpPOST(Global.pubSubURL+"/v1/tenants/"+Global.pubSubTenant+"/authenticate",myHeaders,toJSON(myData)) if (result.statusCode && (result.statusCode == "200")) { myIDToken = result.data.AuthenticationResult.IdToken } else { log("Could not authenticate", "ERROR", "red") return } myHeaders = {"Content-Type":"application/json", "Authorization": myIDToken} myData = {"maxMessages": 50} result = httpPOST(Global.pubSubURL+"/v1/tenants/"+Global.pubSubTenant+"/projects/builtin/subscriptions/audit:pull",myHeaders,toJSON(myData)) if (result.statusCode && (result.statusCode == "200")) { myMessages = result.data.receivedMessages if (myMessages) { log("Successfully pulled "+myMessages.length+" messages", "green") forEach (msg, myMessages) { log(msg) } } else { log("Queue is empty","green") } } else { log("Unable to pull messages from audit queue", "ERROR", "red") } ``` ### Javascript (via node.js) ```javascript const fetch = require("node-fetch"); let host='https://pubsub.us003.ia.us003-rapididentity.com/'; let tenant='ia07766af2bd2f4efb824806ec1ef6d4b8'; let myApiKey='123Abc45ExampleKeyFormat678stuvw'; let myMaxMessages=50; const myDate = new Date(); const poll = async() => {  const res = await fetch(host+"v1/tenants/"+tenant+"/authenticate", {    method: "POST",    body: JSON.stringify({      apiKey: myApiKey,    }),    headers: {      "Content-type": "application/json"    }  })  const response = await res.json();  const idToken = response.AuthenticationResult['IdToken'];  readMessages(idToken); } async function readMessages(myIdToken) {  const res = await fetch(host+"v1/tenants/"+tenant+"/projects/builtin/subscriptions/audit:pull", {    method: "POST",    body: JSON.stringify({      maxMessages: myMaxMessages    }),    headers: {      "Content-type": "application/json",      "Authorization": myIdToken,      "Date": myDate.toUTCString()    }  })  const response = await res.json()  console.log(response) } poll(); ``` ### Python 3 ```python import requests host = 'https://pubsub.us003.ia.us003-rapididentity.com/' tenant = 'ia07766af2bd2f4efb824806ec1ef6d4b8' myApiKey = '123Abc45ExampleKeyFormat678stuvw' myMaxMessages = 50 body = {'apiKey': myApiKey} headers = {'Content-type': 'application/json'} auth = requests.post(host+'v1/tenants/'+tenant+'/authenticate',json=body,headers=headers) auth_data = auth.json() myIdToken = auth_data['AuthenticationResult']['IdToken'] body = {'maxMessages': myMaxMessages} headers = {'Content-type': 'application/json', 'Authorization': myIdToken} poll = requests.post(host+"v1/tenants/"+tenant+"/projects/builtin/subscriptions/audit:pull",json=body,headers=headers) poll_data = poll.json() print(poll_data['receivedMessages']) ``` ### Example JSON events In the following events, please note: - actionId = An internal ID for the action being reported - ext.xxx = Extended audit event information - id = An identifier for a specific audit event - perpDN = The distinguished name of the user performing the action - perpId = The idautoID of the user performing the action - perpIpForwarded = The IP address of the user performing the action #### Successful IDP authentication ```json {    "actionId": "net.idauto.audit.idp.action.authentication",    "ext.User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",    "ext.json_data": "{\n  \"policy\" : {\n    \"id\" : \"a0892c93-a6ce-4796-8bf6-47dbce93dddd\",\n    \"name\" : \"Default Password Policy\",\n    \"version\" : 3\n  },\n  \"methods\" : [ \"username\", \"password\" ]\n}",    "hostIp": "172.17.84.154",    "id": "d5cc1314-dcc9-4f2e-951f-de93e7223dcf",    "moduleId": "net.idauto.audit.module.idp",    "perpDN": "idautoID=f7e65320-df03-4a8f-ab55-3e2efdbb6166,ou=Accounts,dc=meta",    "perpId": "f7e65320-df03-4a8f-ab55-3e2efdbb6166",    "perpIp": "172.17.81.157",    "perpIpForwarded": "10.9.8.7",    "productId": "net.idauto.audit.product.saml",    "successful": "true",    "target": "tester1@somedomain.net",    "targetId": "f7e65320-df03-4a8f-ab55-3e2efdbb6166",    "targetSystem": "DIRECTORY",    "tenantId": "ia07886af2bd2f5dcb824806ec1ef6deb8",    "timestamp": "2024-08-14T21:27:15.054Z" } ``` #### Successful IDP logout ```json {    "actionId": "idp.logout",    "ext.User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",    "hostIp": "172.17.84.154",    "id": "4e1e9d37-1abc-4121-800c-9842a0d9b238",    "moduleId": "net.idauto.audit.module.idp",    "perpDN": "idautoID=f7e65320-df03-4a8f-ab55-3e2efdbb6166,ou=Accounts,dc=meta",    "perpId": "f7e65320-df03-4a8f-ab55-3e2efdbb6166",    "perpIp": "172.17.81.157",    "perpIpForwarded": "10.9.8.7",    "productId": "net.idauto.audit.product.saml",    "successful": "true",    "targetSystem": "SYSTEM",    "tenantId": "ia07886af2bd2f5dcb824806ec1ef6deb8",    "timestamp": "2024-08-14T21:27:03.442Z" } ``` #### Failed IDP authentication ```json {    "actionId": "net.idauto.audit.idp.action.authentication",    "ext.User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",    "ext.json_data": "{\n  \"errorMessage\" : \"Authentication Failed\",\n  \"policy\" : {\n    \"id\" : \"a0892c93-a6ce-4796-8bf6-47dbce93dddd\",\n    \"name\" : \"Default Password Policy\",\n    \"version\" : 3\n  },\n  \"methods\" : [ \"username\" ],\n  \"failedStep\" : \"password\"\n}",    "hostIp": "172.17.84.154",    "id": "cc260535-0663-4901-b6cd-c38c11b834e1",    "moduleId": "net.idauto.audit.module.idp",    "perpDN": "idautoID=f7e65320-df03-4a8f-ab55-3e2efdbb6166,ou=Accounts,dc=meta",    "perpId": "f7e65320-df03-4a8f-ab55-3e2efdbb6166",    "perpIp": "172.17.81.157",    "perpIpForwarded": "10.9.8.7",    "productId": "net.idauto.audit.product.saml",    "successful": "false",    "target": "tester1@somedomain.net",    "targetId": "f7e65320-df03-4a8f-ab55-3e2efdbb6166",    "targetSystem": "DIRECTORY",    "tenantId": "ia07886af2bd2f5dcb824806ec1ef6deb8",    "timestamp": "2024-08-14T21:27:29.287Z" } ```