# audit.query

Query contents of audit databases specified by services.

Type: object

##

Type: array
No Additional Items

#### Tuple Validation

##### Parameter 1: data

#### data

Type: object
Default:
{ "services": [ "MIDDLEWARE" ], "query-filters": [], "query-options": { "count": false, "extra": {}, "force_sql_filters": false, "get": false, "limit": 0, "offset": 0, "order_by": [], "select": [] }, "remote_controller": false }

Audit query configuration specifying services, filters, and options.

No Additional Properties

##

#### Services

Type: array of enum (of string) Default: ["MIDDLEWARE"]

Array of services to include in the audit query.

No Additional Items

##### Each item of this array must be:

Type: enum (of string)

##### Must be one of:

- "MIDDLEWARE"
- "SMB"
- "SUDO"
- "SYSTEM"

##

#### Query-Filters

Type: array Default: []

List of filters for query results. See API documentation for "Query Methods" for more guidance.

No Additional Items

##### Each item of this array must be:

Type: object
Examples:

    [
        [
            "name",
            "=",
            "bob"
        ]
    ]

    [
        [
            "OR",
            [
                [
                    "name",
                    "=",
                    "bob"
                ],
                [
                    "name",
                    "=",
                    "larry"
                ]
            ]
        ]
    ]

##

#### QueryOptions

Type: object
Default:
{ "extra": {}, "order_by": [], "select": [], "count": false, "get": false, "offset": 0, "limit": 0, "force_sql_filters": false }

If the query-option `force_sql_filters` is true, then the query will be converted into a more efficient form for better performance. This will not be possible if filters use keys within `svc_data` and `event_data`.

No Additional Properties

##

#### Extra

Type: object Default: {}

Extra options are defined on a per-endpoint basis and are described in the documentation for the associated query method.

##

#### Order By

Type: array of string Default: []

An array of field names describing the manner in which query results should be ordered. The field names may also have one of more of the following special prefixes: `-` (reverse sort direction), `nulls_first:` (place any null values at the head of the results list), `nulls_last:` (place any null values at the tail of the results list).

No Additional Items

##### Each item of this array must be:

Type: string
Example:

    [
        "size",
        "-devname",
        "nulls_first:-expiretime"
    ]

##

#### Select

Type: array Default: []

An array of field names specifying the exact fields to include in the query return. The dot character `.` may be used to explicitly select only subkeys of the query result.

No Additional Items

##### Each item of this array must be:

## Any of

Type: string
Type: array
No Additional Items

##### Each item of this array must be:

Type: object
Example:

    [
        "username",
        "Authentication.status"
    ]

##

#### Count

Type: boolean Default: false

Return a numeric value representing the number of items that match the specified `query-filters`.

##

#### Get

Type: boolean Default: false

Return the JSON object of the first result matching the specified `query-filters`. The query fails if there specified `query-filters` return no results.

##

#### Offset

Type: integer Default: 0

This specifies the beginning offset of the results array. When combined with the `limit` query-option it may be used to implement pagination of large results arrays. WARNING: some query methods provide volatile results and the onus is on the developer to understand whether pagination is appropriate for a particular query API method.

##

#### Limit

Type: integer Default: 0

This specifies the maximum number of results matching the specified `query-filters` to return. When combined wtih the `offset` query-option it may be used to implement pagination of large results arrays.

WARNING: Some query methods provide volatile results and the onus is on the developer to understand whether pagination is appropriate for a particular query API method.

##

#### Force Sql Filters

Type: boolean Default: false

Force use of SQL for result filtering to reduce response time. May not work for all methods.

##

#### Remote Controller

Type: boolean Default: false

HA systems may direct the query to the 'remote' controller by including 'remote_controller=True'. The default is the 'current' controller.

##

#### Result

## Any of

Type: array of object
No Additional Items

##### Each item of this array must be:

#### AuditQueryResultItemQueryResultItem

Type: object

##

#### Audit Id

GUID uniquely identifying this specific audit event.

## Any of

Type: string
Type: integer
Type: null

##

#### Message Timestamp

Type: integer

Unix timestamp for when the audit event was written to the auditing database.

##

#### Timestamp

Type: stringFormat: date-time

Converted ISO-8601 timestamp from application recording when event occurred.

##

#### Address

Type: string

IP address of client performing action that generated the audit message.

##

#### Username

Type: string

Username used by client performing action.

##

#### Session

GUID uniquely identifying the client session.

## Any of

Type: string
Type: integer
Type: null

##

#### Service

Type: enum (of string)

Name of the service that generated the message. This will be one of the names specified in `services`.

##### Must be one of:

- "MIDDLEWARE"
- "SMB"
- "SUDO"
- "SYSTEM"

##

#### Service Data

JSON object containing variable data depending on the particular service. See TrueNAS auditing documentation for the service in question.

## Any of

Type: object
Type: null

##

#### Event

Type: string

Name of the event type that generated the audit record. Each service has its own unique event identifiers.

##

#### Event Data

JSON object containing variable data depending on the particular event type. See TrueNAS auditing documentation for the service in question.

## Any of

Type: object
Type: null

##

#### Success

Type: boolean

The action generating the event message succeeded.

##

Additional Properties of any type are allowed.

Type: object

#### AuditQueryResultItemQueryResultItem

Type: object

##

#### Audit Id

GUID uniquely identifying this specific audit event.

## Any of

Type: string
Type: integer
Type: null

##

#### Message Timestamp

Type: integer

Unix timestamp for when the audit event was written to the auditing database.

##

#### Timestamp

Type: stringFormat: date-time

Converted ISO-8601 timestamp from application recording when event occurred.

##

#### Address

Type: string

IP address of client performing action that generated the audit message.

##

#### Username

Type: string

Username used by client performing action.

##

#### Session

GUID uniquely identifying the client session.

## Any of

Type: string
Type: integer
Type: null

##

#### Service

Type: enum (of string)

Name of the service that generated the message. This will be one of the names specified in `services`.

##### Must be one of:

- "MIDDLEWARE"
- "SMB"
- "SUDO"
- "SYSTEM"

##

#### Service Data

JSON object containing variable data depending on the particular service. See TrueNAS auditing documentation for the service in question.

## Any of

Type: object
Type: null

##

#### Event

Type: string

Name of the event type that generated the audit record. Each service has its own unique event identifiers.

##

#### Event Data

JSON object containing variable data depending on the particular event type. See TrueNAS auditing documentation for the service in question.

## Any of

Type: object
Type: null

##

#### Success

Type: boolean

The action generating the event message succeeded.

##

Additional Properties of any type are allowed.

Type: object
Type: integer

Required roles: SYSTEM_AUDIT_READ