Konnect and Dev Portal audit logs

Uses: Konnect Platform Dev Portal

Audit log events

Konnect captures three types of events:

Event type	Org audit logs	Dev Portal audit logs
Authentication	This is triggered when a user attempts to log into the Konnect web application or use the Konnect API via a personal access token. Also triggered when a system account access token is used.	Triggered when a user logs in to the Dev Portal.
Authorization	Triggered when a permission check is made for a user or system account against a resource.	Not collected, use the org audit log.
Access logs	Triggered when a request is made to the Konnect API.	Not collected, use the org audit log.

Konnect retains audit logs for 7 days. After 7 days, Konnect permanently deletes them and you cannot recover them.

Dev Portal audit logs don’t collect authorization and access events by design. You can view Dev Portal entity creation, edits, and approved state changes from the Konnect audit logs.

Audit log webhook status

You can view the webhook status in the UI or via the API for the Konnect org audit logs and Dev Portal audit logs:

To view the Konnect org audit logs webhook status in the UI, navigate to Organization > Audit Log Setup, and click the Konnect tab.
To view the Dev Portal audit log status in the UI, navigate to your Dev Portal, click Settings, and click the Audit log tab.

The following table describes the webhook statuses:

Attribute	Description
`last_attempt_at`	The last time Konnect tried to send data to your webhook
`last_response_code`	The last response code from your webhook
`webhook_enabled`	The desired status of the webhook (from `audit-log-webhook.enabled`)
`webhook_status`	The actual status of the webhook

A combination of webhook_enabled and webhook_status give a full picture of webhook status:

`webhook_enabled`	`webhook_status`	Description
`true`	`active`	Konnect is ready to send data to the webhook. Either no attempts have been made yet (`last_attempt_at` is not set), or the last attempt was successful.
`true`	`inactive`	Last attempt to send data failed, but the webhook is still enabled. This usually means that there was an error in the endpoint or the SIEM provider went down that caused the logs to stop streaming.
`false`	`active`	Webhook config is saved. Konnect is not shipping data to it per webhook configuration.
`false`	`inactive`	Last attempt to send data failed, and customer has turned off the webhook.
`false`	`unconfigured`	The webhook for this region has not been configured yet.

Log formats

Konnect delivers log events in ArcSight CEF Format , JSON, or CrowdStrike Parsing Standard (CPS). You may specify which format to use in the audit log webhook endpoints.

Webhook calls include a batch of events. Each event is formatted in either CEF or JSON and separated by a newline. The Content-Type is text/plain.

To minimize payload size, the message body is compressed. The Content-Encoding is application/gzip.

All log entries include the following attributes:

Property	Description
Timestamp	Time and date of the event in UTC.
`rt`	Milliseconds since Unix epoch.
`src`	The IP address of the request originator.
`org_id`	The originating organization ID.
`principal_id`	The user ID of the user that performed the action.
~kong_initiated~	Whether the action was performed by Kong
`trace_id`	The correlation ID of the request. Use this value to find all log entries for a given request.
`user_agent`	The user agent of the request: application, operating system, vendor, and version.
`sig`	An ED25519 signature.

Authentication logs

Authentication attempts and their outcomes are logged whenever a user logs in to the Konnect application or the Dev Portal either through the UI or the Konnect API.

Example log entry:

2025-05-19T00:03:39Z
konghq.com CEF:0|ExampleOrg|Konnect|1.0|AUTHENTICATION_TYPE_PAT|AUTHENTICATION_OUTCOME_SUCCESS|0|rt=3958q3097698
src=127.0.0.1
request=/api/v1/personal-access-tokens/introspect
success=true
org_id=b065b594-6afc-4658-9101-5d9cf3f36b7b
principal_id=87655c36-8d63-48fe-9a1e-53b28dfbc19b
trace_id=3895213347334635099
user_agent=grpc-go/1.51.0
sig=N_4q2pCgeg0Fg4oGJSfUWKScnTCiC79vq8PIX6Sc_rwaxdWKpVfPwkW45yK_oOFV9gHOmnJBffcB1NmTSwRRDg

{
    "cef_version": 0,
    "event_class_id": "AUTHENTICATION_TYPE_BASIC",
    "event_product": "Konnect",
    "event_ts": "2025-05-16T00:28:01Z",
    "event_vendor": "KongInc",
    "event_version": "1.0",
    "name": "AUTHENTICATION_OUTCOME_SUCCESS",
    "org_id": "b065b594-6afc-4658-9101-5d9cf3f36b7b",
    "principal_id": "87655c36-8d63-48fe-9a1e-53b28dfbc19b",
    "request": "/api/v1/authenticate",
    "rt": "1684524079524",
    "severity": 0,
    "sig": "N_4q2pCgeg0Fg4oGJSfUWKScnTCiC79vq8PIX6Sc_rwaxdWKpVfPwkW45yK_oOFV9gHOmnJBffcB1NmTSwRRDg",
    "src": "127.0.0.6",
    "success": "true",
    "trace_id": 6891110586028963295,
    "user_agent": "grpc-node-js/1.8.10"
}

2025-06-23T14:28:47Z
konghq.com CEF:0|KongInc|Dev-Portal|1.0|AUTHENTICATION_TYPE_BASIC|AUTHENTICATION_OUTCOME_SUCCESS|0|rt=1750688927556
src=172.71.232.22
request=/api/v2/developer/authenticate
success=true
org_id=998db3e4-5cb7-4dd5-b51c-9878096a6999
portal_id=3e551b39-227d-4297-b911-e68fd5d77c17
principal_id=a3d2699a-0ed3-4417-bb10-d8e74a1513a4
trace_id=3360194145499877252
user_agent=
sig=XQC3OSFxLbi5dy2-o4xAXHT-x8oW5Df-zVsACWQLMU9Q-sPnEyk5CVs4JHwuRcwO0QNLsNaP1wsyrXYPeneXDQ

{
    "cef_version": 0,
    "event_class_id": "AUTHENTICATION_TYPE_BASIC",
    "event_product": "Dev-Portal",
    "event_ts": "2025-06-23T14:28:47Z",
    "event_vendor": "KongInc",
    "event_version": "1.0",
    "name": "AUTHENTICATION_OUTCOME_SUCCESS",
    "org_id": "998db3e4-5cb7-4dd5-b51c-9878096a6999",
    "portal_id": "3e551b39-227d-4297-b911-e68fd5d77c17",
    "principal_id": "a3d2699a-0ed3-4417-bb10-d8e74a1513a4",
    "request": "/api/v2/developer/authenticate",
    "rt": "1750688927556",
    "severity": 0,
    "sig": "XQC3OSFxLbi5dy2-o4xAXHT-x8oW5Df-zVsACWQLMU9Q-sPnEyk5CVs4JHwuRcwO0QNLsNaP1wsyrXYPeneXDQ",
    "src": "172.71.232.22",
    "success": "true",
    "trace_id": 3360194145499877252,
    "user_agent": ""
}

In addition to the defaults, each authentication log entry also contains the following attributes:

Property	Description
AUTHENTICATION_TYPE	Can be one of the following: - `AUTHENTICATION_TYPE_BASIC`: Basic email and password authentication - `AUTHENTICATION_TYPE_SSO`: Authentication with single sign-on (SSO) - `AUTHENTICATION_TYPE_PAT`: Authentication with a personal access token
AUTHENTICATION_OUTCOME	Can be one of the following: - `AUTHENTICATION_OUTCOME_SUCCESS`: Authentication is successful - `AUTHENTICATION_OUTCOME_NOT_FOUND`: User was not found - `AUTHENTICATION_OUTCOME_INVALID_PASSWORD`: Invalid password specified - `AUTHENTICATION_OUTCOME_LOCKED`: User account is locked - `AUTHENTICATION_OUTCOME_DISABLED`: User account has been disabled
success	`true` or `false`, depending on whether authentication was successful or not.
`portal_id`	The ID of the Dev Portal the event occurred in. Only present in Dev Portal authentication log entries.

Authorization logs

Authorization log entries are created for every permission check in Konnect.

Example log entry:

2025-05-19T00:03:39Z
konghq.com CEF:0|ExampleOrg|Konnect|1.0|konnect|Authz.portals|1|rt=16738287345642
src=127.0.0.6
action=retrieve
granted=true
org_id=b065b594-6afc-4658-9101-5d9cf3f36b7b
principal_id=87655c36-8d63-48fe-9a1e-53b28dfbc19b
actor_id=
trace_id=8809518331550410226
user_agent=grpc-node/1.24.11 grpc-c/8.0.0 (linux; chttp2; ganges)
sig=N_4q2pCgeg0Fg4oGJSfUWKScnTCiC79vq8PIX6Sc_rwaxdWKpVfPwkW45yK_oOFV9gHOmnJBffcB1NmTSwRRDg

{
    "action": "list",
    "cef_version": 0,
    "event_class_id": "konnect",
    "event_product": "Konnect",
    "event_ts": "2025-05-16T00:28:01Z",
    "event_vendor": "KongInc",
    "event_version": "1.0",
    "granted": true,
    "name": "Authz.portals",
    "org_id": "b065b594-6afc-4658-9101-5d9cf3f36b7b",
    "principal_id": "87655c36-8d63-48fe-9a1e-53b28dfbc19b",
    "rt": "1684196881193",
    "severity": 1,
    "sig": "N_4q2pCgeg0Fg4oGJSfUWKScnTCiC79vq8PIX6Sc_rwaxdWKpVfPwkW45yK_oOFV9gHOmnJBffcB1NmTSwRRDg",
    "src": "127.0.0.6",
    "trace_id": 6891110586028963295,
    "user_agent": "grpc-node-js/1.8.10"
}

In addition to the defaults, each authorization log entry also contains the following attributes:

Property	Description
action	The type of action the user performed on the resource. For example, `retrieve`, `list`, or `edit`.
granted	Boolean indicating whether the authorization was granted or not.

Access logs

Access logs include information about create, update, and delete requests to the Konnect API.

Example log entry:

2025-05-16T20:09:54Z
konghq.com CEF:0|KongInc|Konnect|1.0|KongGateway|Ingress|1|rt=1684267794226
src=127.0.0.6
request=/konnect-api/api/vitals/v1/explore
act=POST
status=200
org_id=b065b594-6afc-4658-9101-5d9cf3f36b7b
principal_id=87655c36-8d63-48fe-9a1e-53b28dfbc19b
user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
trace_id=1146381705542353508
query={"end":"1684270800","start":"1684098000"}
sig=JxJaQG3Bozrb5WdHE_Y0HaOsim2F1Xsq_bCfk71VgsfldkLAD_SF234cnKNS

{
    "act": "POST",
    "cef_version": 0,
    "event_class_id": "KongGateway",
    "event_product": "Konnect",
    "event_ts": "2025-05-16T00:28:01Z",
    "event_vendor": "KongInc",
    "event_version": "1.0",
    "name": "Ingress",
    "org_id": "b065b594-6afc-4658-9101-5d9cf3f36b7b",
    "principal_id": "87655c36-8d63-48fe-9a1e-53b28dfbc19b",
    "query": "{}",
    "request": "/konnect-api/api/control_planes/1c026712-c17d-4e30-ac27-53a6cdc56b9c/services",
    "rt": "1684196881193",
    "severity": 1,
    "src": "127.0.0.6",
    "status": 201,
    "trace_id": 6891110586028963295,
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
    "sig": "N_4q2pCgeg0Fg4oGJSfUWKScnTCiC79vq8PIX6Sc_rwaxdWKpVfPwkW45yK_oOFV9gHOmnJBffcB1NmTSwRRDg",
}

In addition to the defaults, each access log entry also contains the following attributes:

Property	Description
request	The endpoint that was called.
query	The request query parameters, if any.
act	The HTTP request method; for example, `POST`, `PATCH`, `PUT`, or `DELETE`.
status	The HTTP response code; for example, `200` or `403`.

Recover audit logs

You can use replay jobs in Konnect to recover audit logs. These are useful when you’ve missed audit log entries due to an error or a misconfigured audit log webhook.

You can use either the Konnect UI or the Konnect API to configure a replay job.

Konnect replay job

Select your Konnect org.
Click Manage Organization.
Click the Audit Logs Setup tab.
Do one of the following:

Click the Konnect tab.
Navigate to the region you want to configure the replay job for.
Click the Replay tab.
Select a time frame from the Replay Time Range dropdown menu.
Click Send Replay.

Send a PUT request to the /audit-log-replay-job endpoint:

curl -X PUT "https://us.api.konghq.com/v3/audit-log-replay-job" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "start_at": "'$UTF_START_TIME'",
       "end_at": "'$UTF_END_TIME'"
     }'

Copied!

Note: The replay job is always sent to the webhook that is currently configured for the organization or Dev Portal at the time the replay job is executed. There is one webhook configuration per region.

Replay job status

Once you configure a replay job, it displays one of the following statuses.

A replay job can be in one of the following statuses:

Status	Description
Unconfigured	The job has not been set up. This is the job’s initial state.
Accepted	The job has been accepted for scheduling.
Pending	The job has been scheduled.
Running	The job is in progress. When a replay job is `running`, a request to update the job will return a `409` response code until it has completed or failed.
Completed	The job has finished with no errors.
Failed	The job has failed.

Once the replay job is marked as Complete, the audit logs are re-sent to a configured SIEM provider webhook for the specified date and time range.

FAQs

How can I verify Konnect audit log signatures?

Konnect and Dev Portal use an ED25519 signature on the audit logs they produce. You can verify the signature in your audit logs to confirm that it’s from Konnect instead of a bad actor.

To do that:

Retrieve the public key from the audit log JWKS endpoint. The public key is stored in the x field.
Get an audit log from Konnect and remove the sig value. Make sure to save the signature, you’ll need it in the next step.
Decode the Base64-encoded signature and private key.
Use your preferred tool (for example, OpenSSL) to verify the ED25519 signature by using the signature-less audit log entry together with the decoded signature and public key.

Do Konnect audit logs collect personally identifiable information?

No, Konnect audit logs don’t collect any PII. See the audit log examples for the information that they do collect.

How many days of Konnect org audit logs can I recover?

Konnect only collects audit logs from the past seven days, so you can only recover up to seven days of logs from the current date.

Konnect and Dev Portal audit logs

Audit log events

Audit log webhook status

Log formats

Authentication logs

Authorization logs

Access logs

Recover audit logs

Konnect replay job

Replay job status

FAQs

Help us make these docs great!

Still need help?