Audit Logs

Audit logs record authenticated API requests across your entire organization. Use them to review who called Kernel, which endpoint they called, when the request happened, and how the request completed. Choose the workflow that matches the amount of data you need:

Workflow	Best for	Output
Search	Interactive investigation and recent activity	Paginated JSON events
Export	Archival, compliance, and offline analysis	JSON Lines (`.jsonl`) or gzip-compressed JSON Lines (`.jsonl.gz`)

Audit logs are ordered newest first. Time windows use an inclusive start and exclusive end: [start, end). A search or export can cover up to 30 days. Split longer periods into multiple time windows. Both workflows are also available from the CLI. For the underlying HTTP API, see search and export in the API reference.

Filter audit logs

The API and SDKs use the same filters for search and export:

auth_strategy filters by authentication method, such as api_key, dashboard, or oauth.
service filters by the service that emitted the audit event.
method returns only requests that use the specified HTTP method.
exclude_method omits requests that use any of the specified HTTP methods.
search matches path, user ID, email, client IP, and status.
search_user_id matches requests from the specified user IDs in addition to any free-text matches.

The API and SDKs include all methods unless you filter. Only the CLI excludes GET by default to reduce noise. Pass --include-get to remove that default exclusion, or pass --method GET to return only GET requests.

Search audit logs

Each API page contains up to 100 events. The SDK pagination helpers request older pages as you iterate.

import Kernel from '@onkernel/sdk';

const kernel = new Kernel({
  apiKey: process.env.KERNEL_API_KEY,
});

for await (const event of kernel.auditLogs.list({
  start: '2026-06-01T00:00:00Z',
  end: '2026-06-02T00:00:00Z',
  method: 'POST',
})) {
  console.log(event.timestamp, event.method, event.path, event.status);
}

import os
from kernel import Kernel

client = Kernel(api_key=os.environ["KERNEL_API_KEY"])

for event in client.audit_logs.list(
    start="2026-06-01T00:00:00Z",
    end="2026-06-02T00:00:00Z",
    method="POST",
):
    print(event.timestamp, event.method, event.path, event.status)

package main

import (
	"context"
	"fmt"
	"time"

	"github.com/kernel/kernel-go-sdk"
)

func main() {
	ctx := context.Background()
	client := kernel.NewClient()

	pager := client.AuditLogs.ListAutoPaging(ctx, kernel.AuditLogListParams{
		Start:  time.Date(2026, time.June, 1, 0, 0, 0, 0, time.UTC),
		End:    time.Date(2026, time.June, 2, 0, 0, 0, 0, time.UTC),
		Method: kernel.String("POST"),
	})
	for pager.Next() {
		event := pager.Current()
		fmt.Println(event.Timestamp, event.Method, event.Path, event.Status)
	}
	if err := pager.Err(); err != nil {
		panic(err)
	}
}

See the API reference for the full request and response schema.

Export audit logs

The export API returns one chunk per request. Export paging uses a cursor rather than the page token used by search; both are opaque values you pass back unchanged. Repeat requests until X-Has-More is false, passing X-Next-Cursor back as cursor. With the jsonl.gz format, each chunk is an independent gzip member, and appending the members produces a valid gzip file. With jsonl, each chunk contains raw JSON Lines that you can also append. The following minimal examples write all chunks to one file. For a hardened export with checksum verification and retries, use the CLI.

import { open } from 'node:fs/promises';
import Kernel from '@onkernel/sdk';

const kernel = new Kernel({
  apiKey: process.env.KERNEL_API_KEY,
});

const file = await open('audit-logs.jsonl.gz', 'w');
try {
  let cursor: string | undefined;
  while (true) {
    const response = await kernel.auditLogs.exportChunk({
      start: '2026-06-01T00:00:00Z',
      end: '2026-06-02T00:00:00Z',
      format: 'jsonl.gz',
      exclude_method: ['GET'],
      cursor,
    });

    await file.writeFile(Buffer.from(await response.arrayBuffer()));

    if (response.headers.get('x-has-more') !== 'true') {
      break;
    }
    cursor = response.headers.get('x-next-cursor') ?? undefined;
  }
} finally {
  await file.close();
}

import os
from kernel import Kernel

client = Kernel(api_key=os.environ["KERNEL_API_KEY"])

params = {
    "start": "2026-06-01T00:00:00Z",
    "end": "2026-06-02T00:00:00Z",
    "format": "jsonl.gz",
    "exclude_method": ["GET"],
}

with open("audit-logs.jsonl.gz", "wb") as file:
    while True:
        response = client.audit_logs.export_chunk(**params)
        file.write(response.read())
        if response.headers.get("x-has-more") != "true":
            break
        params["cursor"] = response.headers.get("x-next-cursor")

package main

import (
	"context"
	"io"
	"os"
	"time"

	"github.com/kernel/kernel-go-sdk"
)

func main() {
	ctx := context.Background()
	client := kernel.NewClient()

	file, err := os.Create("audit-logs.jsonl.gz")
	if err != nil {
		panic(err)
	}
	defer file.Close()

	params := kernel.AuditLogExportChunkParams{
		Start:         time.Date(2026, time.June, 1, 0, 0, 0, 0, time.UTC),
		End:           time.Date(2026, time.June, 2, 0, 0, 0, 0, time.UTC),
		Format:        kernel.AuditLogExportChunkParamsFormatJSONLGz,
		ExcludeMethod: []string{"GET"},
	}

	for {
		response, err := client.AuditLogs.ExportChunk(ctx, params)
		if err != nil {
			panic(err)
		}
		_, copyErr := io.Copy(file, response.Body)
		closeErr := response.Body.Close()
		if copyErr != nil {
			panic(copyErr)
		}
		if closeErr != nil {
			panic(closeErr)
		}

		if response.Header.Get("X-Has-More") != "true" {
			break
		}
		params.Cursor = kernel.String(response.Header.Get("X-Next-Cursor"))
	}
}

Don’t use these minimal loops for a production export without adding integrity checks and durable cursor storage. For each chunk, buffer the exact response bytes, compare their SHA-256 hash with X-Content-Sha256, write the verified bytes, and then validate the cursor. When X-Has-More is true, require a non-empty X-Next-Cursor that differs from the current cursor. Persist that cursor only after the verified chunk is safely written. You must also retry transient failures. The CLI download command implements this hardened path.

Export chunks contain one JSON object per line. They use the same fields as search results and add event_id, which provides a stable tie-breaker when multiple events share a timestamp. See the API reference for the full request and response schema.

Overview

Working with your browser

deploying your agent

Agent Skills

Integrations

Migrations

Community

Info

Filter audit logs

Search audit logs

Export audit logs

​Filter audit logs

​Search audit logs

​Export audit logs

Filter audit logs

Search audit logs

Export audit logs