Audit Log Documentation
This document covers the StreamShark audit log API endpoint and access to audit logs via the StreamShark portal, including details and examples
Audit Logs are currently available to enterprise customers. Contact your Sales Representative or Account Manager if you wish to know more, or are interested in a trial.
StreamShark Portal UI
- To access Audit logs within the StreamShark portal, It will be located under the account tab -> Audit Logs
StreamShark Portal UI - Filters Applied
Audit Log API Details:
Protocol: GET
Endpoint: https://secure.metacdn.com/api2/service/v1/users/<username>/auditLog
Authorization Basic:
- Username: <username>
- Password: <secret key> (can be obtained from the account details section in the StreamShark portal)
Audit Log API Overview:
Returns a paginated list of audit log entries for the account.
Results are sorted by timestamp descending (most recent first).
Audit Logs API Parameters:
| Parameters | Description | Example |
| startDate (string - datetime) |
Filter entries on or after this timestamp.
If omitted, all available entries up to endDate are returned.
Must be a valid ISO 8601 timestamp with a timezone offset
Returns HTTP 400 Bad Request if present but not a valid ISO 8601 timestamp. |
2025-06-01T00:00:00Z or 2025-06-01T09:00:00+09:00. |
| endDate (string - datetime) |
Filter entries on or before this timestamp. If omitted, results are returned up to the present.
Must be a valid ISO 8601 timestamp with a timezone offset
Returns HTTP 400 Bad Request if present but not a valid ISO 8601 timestamp. |
2025-06-11T23:59:59Z or 2025-06-11T23:59:59+09:00. |
| action (string) |
Filter by action name.
Supports % wildcard for prefix/suffix matching
Supports ! negation prefix to exclude a specific action
Use the /auditLog/actions endpoint to retrieve the list of available action names.
Note: % must be URL-encoded as %25 in the query string.
|
Event.create event.%25 (matches all event actions) !vod.delete |
| actorEmail (string) |
Filter by the email address of the actor who performed the action. Exact match.
|
john.smith@example.com |
| outcome (string) |
Filter by the outcome of the action.
Returns HTTP 400 Bad Request if present but not one of the accepted values.
Available values : SUCCESS, FAILURE, DENIED |
SUCCESS |
| page (integer) |
Page number to retrieve. Defaults to 1
|
1 |
| pageSize | Number of results per page. Defaults to 20. Maximum 100. | 20 |
Response Details:
Response type: JSON
Example Response:
{
"total": 1,
"page": 1,
"pageSize": 20,
"results": [
{
"timestamp": "2025-06-11T04:23:00+00:00",
"action": "event.create",
"resourceType": "event",
"resourceId": "my-conference-2025",
"resourceTitle": "My Conference Stream",
"outcome": "SUCCESS",
"actorEmail": "john.smith@example.com",
"actorName": "John Smith",
"actorType": "USER",
"username": "myuser",
“parentResourceType”: null,
“parentResourceId”: null,
"ipAddress": "203.0.113.42",
"httpMethod": "POST",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
}
]
}
Response Parameters
| Response Value | Description | Example |
| total (integer) | Total number of audit log entries based on the filters (across all pages) | 10 |
| page (integer) | Current page the query is at | 1 |
| pageSize (integer) |
Number of results returned per page
|
20
|
| results (list) |
Contains list of all audit log results found
|
|
| timestamp (string datetime) | Time that the action occurred in ISO-8601 format |
2025-06-11T04:23:00+00:00 |
| action (string) | Action that occured | event.create |
| resourceType (string) | The resource that the action was performed on | event |
| resourceId (string) | The id of the resource that the action was performed on. May be null if id is unable to be retrieved | test-event-123 |
| resourceTitle (string) | The user friendly title of the resource that the action was performed on. May be null if title is unable to be retrieved | Test event |
| outcome (string) | The outcome of the action performed on the resource | SUCCESS |
| actorEmail (string) | The email of the actor that performed the action on the resource | test@example.com |
| actorName (string) | The name of the actor that performed the action on the resource | John Smith |
| actorType (string) | Whether the action was performed by a user logged into the platform or via an API Key | USER |
| username (string) | The username of the account | user1 |
| parentResourceType (string) | Type of the parent resource, if the action was on a child resource. May be null if parent is unable to be retrieved | event |
| parentResourceId (string) | If the resource has a parent, the id of the parent will be in the results. May be null if parent is unable to be retrieved | test-event-123 |
| ipAddress (string) | IP Address of the actor at the time of action. May be null if not recorded | 203.0.113.42 |
| httpMethod (string) | The HTTP method used for the request of the action | POST |
| userAgent (string) | User agent string of the client that made the request (may default to python user agent due to legacy logging) | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) |
Examples:
Base query
/auditLog
Time range
/auditLog?startDate=2026-06-12T03:58:30Z&endDate=2026-06-12T03:59:59Z
Query by action
/auditLog?action=event.create
Query by outcome
/auditLog?outcome=FAILURE
Query by page/pageSize
/auditLog?page=2&pageSize=5
Notes:
- Audit data is typically synced once per day via a scheduled job. Activity from the current day may not yet be reflected.
- By default Audit Logs are kept for 12 months, after which they will be removed from the system (this retention period is configurable, please contact us if you would like to adjust the period)
- For some of the logs (mostly DELETE requests), we may be unable to retrieve the title of the resource, in this case, it will display the id of the resource. If you would like to inquire about the details of the resource, please contact our Support team
- In the API response, all .view logs are also included which lets you know which event/vod is being viewed (for events/vods with SSO enabled), to exclude these, please add action=!%25.view as a query parameter
Confirmed actions/resources captured
The audit log records activity against the following resources. Any action performed on these resources will generate an audit log entry:
- System
- Login
- Logout
- Sub accounts
- SSO Login/Logout
- Event
- Event Restream
- Event Archives
- Polls
- CTAs
- Media
- Live Schedule
- Video Profiles
- Privacy Profile
- Hardware Encoder
- Playlist
- Channel
- Viewer management - viewers + groups
- SSO Configuration
- Video Player Template
- Player Page Theme
- Permanent Links
- Global Settings
- Vocabulary
Additional resources may be added over time as audit logging support is extended.