Auditing

Introduction:

This article discusses the auditing capabilities and APIs that are available out of the box in Apigee Edge. Auditing is extremely important like any other component for a software or a platform. As an admin, you would want to know what are the different actions and events performed on the platform. In case of any issues, it is this feature that comes to the rescue or at least helps you track and narrow down the potential cause.

Using auditing, you can check not only the calls made but also check the entitlements for each calling user. It is very important that the admins understand this and use it correctly.

Below are the different aspects of Apigee Edge's out-of-the-box auditing capabilities:

• Logs a record for every call made to the management API and stores it in the Apigee Edge data store
• These records can be viewed using:
  • Management UI
  • Management API
• Audit logs are stored in Apigee Edge central data store and be viewed using:
  • Apigee Management API
  • Apigee Enterprise UI under Admin → Organization History
  • Apigee Enterprise UI under API Proxy → Project → API Proxy History
• These records can be useful for CI/CD pipeline to understand the different deployments across various teams happening in each environment.
• Useful to audit RBAC entitlements for different users of Apigee Edge (API Developers, non-human users used for deployments and automation, etc.)

What is being logged as part of an audit?

The following information is logged as part of an audit:

• Operation: create, update, delete
• Request URI
• Request
• Response code
• User
• Timestamp

Can I get audit records just for a developer or any other entities?

Apigee Edge Auditing gives you different levels of auditing as well. Depending on the audit requirements, you can pull the audits appropriately. The different levels of auditing are:

• Developers (all, single)
• Apigee Edge Users
• Organization
• API Products
• API Proxies
• Apps
• Trace sessions

Other Questions:

• Can I get the audit for deployments?
  • Yes, there is an API. Refer to this community post for additional information.
• How do I get to know if there are new Organization users added in my Edge organization?
  • You can use the Audit API or UI to view the same. Please refer to the Reference section below
• Is there any way we can log all the changes made in the KVM and configuration in API through the Management Console or via a script?
  • Yes, there is an audit API for this. If you query the audit trail, you will see changes in KVM, changes in API Proxies, proxy deployments and un-deployments, API Products, developers, developer apps, and so on. Refer to this community post for additional information.

Reference:

Management API: http://docs.apigee.com/api/audits-0

Apigee Audit Documentation: http://docs.apigee.com/api-services/content/view-api-history

Audit on the Edge UI looks like