Ardoq Security Event Log API: Overview and Integration Guide
The Ardoq Security Event Log API provides security and compliance teams with programmatic access to a detailed audit trail of security-relevant activity within your Ardoq organization.
It is designed to feed into existing SIEM (Security Information and Event Management) tools, log aggregation pipelines, or custom monitoring solutions, allowing you to centralize Ardoq activity alongside the rest of your enterprise security data.
Key Capabilities
The API captures a comprehensive range of events across authentication, access control, and user management. Each event is timestamped and attributed to a named user and IP address, providing a clear "who, what, and when" for every action.
What events are captured?
The log covers the following security event categories:
User Access: Successful and failed login events, including the method used (plain credentials, Ardoq token, or SSO/OAuth).
Invitation Management: When users accept invitations to join the Ardoq platform.
Role and Privilege Changes: Updates to a user’s role (Reader, Writer, Admin) or individual privileges, including a "diff" of what was added or removed.
Group Management: Changes to group memberships and the affected users.
Permission Changes: Updates to resource-level permissions for both groups and individual users, featuring before/after snapshots.
Authentication Settings: Changes to organization-wide login options, such as toggling Google OAuth or plain login.
How to Integrate
The API is a simple HTTPS endpoint that returns a JSON payload for a specific calendar day. Integration follows three primary steps:
1. Obtain Your Credentials
You will need your organization's Ardoq tenant URL and an API access token.
Access Tokens: Can be created and managed under your organization settings. See Organization label and access tokens for details.
Service Accounts: For automated integrations, we recommend using a service account. See How to Create a Service Account.
2. Request a Daily Log
Send a POST request to the security trail endpoint with a JSON body specifying the date you wish to retrieve:
Bash
curl \
-H "Content-Type: application/json" \
-H "Accepts: application/json" \
-H "Authorization: Token token=<YOUR_TOKEN>" \
-X POST \
"<https://<YOUR_ORG>>.ardoq.com/api/audit-log/security-trail/" \
-d '{ "year": 2025, "month": 5, "day": 17 }'
3. Process the Response
The response is a JSON object with a result array containing the log entries for that day.
Common Fields: Each entry includes a timestamp, event type, user name/email, IP address, and the internal API endpoint called.
Event-Specific Fields: Additional metadata is included based on the specific event type.
Note on Pagination: A
nextPageTokenfield is present but currently returnsnull. Pagination features may be introduced in a future update.
Pro Tip: For a typical integration, schedule this request to run once per day (e.g., via a cron job or workflow automation) to pull the previous day’s log and forward it to your SIEM platform.
Availability and Access
The Security Event Log API is available upon request. To enable this feature for your organization, please reach out to your Customer Success Manager for access.