Documentation | CertSecure

Logs

The Logs endpoints return audit logs by date, month, range, severity, or type, control debug logging, and manage log forwarding to a SIEM (Splunk).

For the corresponding user interface, refer to the Miscellaneous > Logging section.

Endpoints

Method	Endpoint	Description
GET	/logs/count	Log count.
GET	/logs/date	Logs by date.
GET	/logs/debug/codes	Get debug codes.
GET	/logs/debug/extend	Extend debug duration.
GET	/logs/debug/logs	Get debug logs.
GET	/logs/debug/off	Disable debug logging.
GET	/logs/debug/on	Enable debug logging.
GET	/logs/debug/status	Debug log status.
GET	/logs/month	Logs by month.
GET	/logs/range	Logs between dates.
POST	/logs/recentByType	Recent logs by type.
GET	/logs/seimConfig	Get SIEM config.
POST	/logs/seimConfig	Save SIEM config.
GET	/logs/severity	Logs by severity.
GET	/logs/Splunk/testConnection	Test the stored Splunk configuration.
POST	/logs/Splunk/testConnection	Test a submitted Splunk configuration.

GET /logs/count

Returns the number of log entries by severity.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/count" \
  -H "Authorization: Bearer <token>"

Example Response

{
    "ERROR": 2824,
    "INFO": 3497,
    "WARNING": 0
}

Responses

Status Code	Description
200	Counts.

GET /logs/date

Returns the logs of a day.

Request Parameters

Name	Located In	Type	Required	Description
`date`	Query	string	Yes	Day of the month to return logs for.
`month`	Query	string	Yes	Month to return logs for.
`type`	Query	string	No	-

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/date?date=<date>&month=<month>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Logs.

GET /logs/debug/codes

Returns the codes of the available debug log sessions.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/codes" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Codes.

GET /logs/debug/extend

Extends the duration of the current debug logging session.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/extend" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Extended.

GET /logs/debug/logs

Returns the debug logs of a debug session.

Request Parameters

Name	Located In	Type	Required	Description
`code`	Query	string	No	-

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/logs" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Logs.

GET /logs/debug/off

Disables debug logging.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/off" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Disabled.

GET /logs/debug/on

Enables debug logging.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/on" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Enabled.

GET /logs/debug/status

Returns whether debug logging is enabled.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/debug/status" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Status.

GET /logs/month

Returns the logs of a month.

Request Parameters

Name	Located In	Type	Required	Description
`month`	Query	string	Yes	Month to return logs for.
`type`	Query	string	No	-

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/month?month=<month>" \
  -H "Authorization: Bearer <token>"

Example Response

{
    "Message": "No records found"
}

Responses

Status Code	Description
200	Logs.

GET /logs/range

Returns the logs between two dates.

Request Parameters

Name	Located In	Type	Required	Description
`start_date`	Query	string	Yes	Start of the date range.
`end_date`	Query	string	Yes	End of the date range.
`type`	Query	string	No	-

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/range?start_date=<start_date>&end_date=<end_date>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Logs.

POST /logs/recentByType

Recent logs by type. Returns the 50 most recent audit records for one log type, newest first. Requires the Configure CertSecure or View CertSecure Configuration permission.

Request Body (application/json)

Field	Type	Required	Description
`logType`	string	Yes	Audit category, for example Certificate Management, Environment, Ownership Transfer, Bulk Ownership Transfer, User Management, Certificate Download or Agent Logs. An unrecognised value returns an empty array.

Example Request

curl -X POST "https://<certsecure-backend-url>/logs/recentByType" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"logType": "string"}'

Responses

Status Code	Description
200	The matching audit records, newest first, capped at 50.
400	The body is missing or carries no logType.
403	The caller holds neither required permission.
500	Permissions could not be resolved, or the audit query failed.

GET /logs/seimConfig

Get SIEM config. Returns the stored SIEM configuration. The HEC token is never returned. The HEC host is returned under both hec_host and the deprecated url key. When no index has been saved, the default certsecure_logs index applies.

Request Parameters

Name	Located In	Type	Required	Description
`tool`	Query	string	Yes	Currently only Splunk is supported.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/seimConfig?tool=<tool>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	The stored configuration, or {"Success": "Tool not found in config"} when none is saved.
400	tool query parameter missing.
403	Caller lacks configuration read permission.

POST /logs/seimConfig

Save SIEM config. Saves the Splunk configuration. Omitting token or index keeps the stored value; sending either as an empty string is rejected. When sync_boolean is true, the configuration is verified against the HEC before it is saved. When false, no checks run, so forwarding can always be switched off. The host field is rejected.

Request Body (application/json)

Field	Type	Required	Description
`hec_host`	string	Yes	HEC host only - no scheme, port or path.
`index`	string	No	Splunk index. Omit to keep the stored one; defaults to certsecure_logs. The index must already exist.
`port`	string	Yes	1-65535.
`protocol`	string	Yes	Allowed values: http, https.
`sync_boolean`	boolean	Yes	Whether to forward logs to Splunk.
`token`	string	No	HEC token. Omit to keep the stored one.
`tool`	string	Yes	Currently only Splunk.
`url`	string	No	Deprecated former name for hec_host.

Example Request

curl -X POST "https://<certsecure-backend-url>/logs/seimConfig" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"hec_host": "string", "port": "string", "protocol": "string", "sync_boolean": false, "tool": "string"}'

Responses

Status Code	Description
200	Configuration saved.
400	Validation failed, Splunk was unreachable or unhealthy, the index rejected a test event, or host was supplied.
403	Caller lacks Configure CertSecure.

GET /logs/severity

Returns the logs with a given severity.

Request Parameters

Name	Located In	Type	Required	Description
`severity`	Query	string	Yes	Log severity, for example INFO or ERROR.
`type`	Query	string	No	-
`value`	Query	string	No	-

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/severity?severity=<severity>" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Logs.

GET /logs/Splunk/testConnection

Test the stored Splunk configuration. Sends a synthetic certificate event to Splunk using the configuration already stored, to confirm that ingestion still works. Use the POST form to test values that have not been saved yet.

Example Request

curl -X GET "https://<certsecure-backend-url>/logs/Splunk/testConnection" \
  -H "Authorization: Bearer <token>"

Responses

Status Code	Description
200	Splunk accepted the test event.
400	No Splunk configuration is stored.
403	Caller lacks Configure CertSecure.
502	Splunk could not be reached, or rejected the test event.

POST /logs/Splunk/testConnection

Test a submitted Splunk configuration. Verifies a Splunk configuration before it is saved. Checks reachability and the credential, then writes a test event to the target index. Takes the same body as POST /logs/seimConfig without sync_boolean. The test writes a real event into the index, so trigger it deliberately.

Note: This test writes a real event into the Splunk index.

Request Body (application/json)

Field	Type	Required	Description
`hec_host`	string	Yes	HEC host only - no scheme, port or path.
`index`	string	No	Omit to test the default certsecure_logs index.
`port`	string	Yes	1-65535.
`protocol`	string	Yes	Allowed values: http, https.
`token`	string	No	Omit to use the stored token. Blank is rejected.
`url`	string	No	Deprecated former name for hec_host.

Example Request

curl -X POST "https://<certsecure-backend-url>/logs/Splunk/testConnection" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"hec_host": "string", "port": "string", "protocol": "string"}'

Responses

Status Code	Description
200	Test event accepted.
the response names the index that accepted it.	.
400	Validation failed, Splunk was unreachable or unhealthy, or the index rejected the test event.
403	Caller lacks Configure CertSecure.
502	The test could not be completed.

On this Page: