> ## Documentation Index > Fetch the complete documentation index at: https://docs.nebius.com/llms.txt > Use this file to discover all available pages before exploring further. # List ## OpenAPI ````yaml https://api.nebius.cloud/openapi.json get /audit/v2/audit-events openapi: 3.0.3 info: title: Nebius API version: version not set servers: - url: https://api.nebius.cloud security: - bearerAuth: [] tags: - name: nebius.ai.v1.EndpointService - name: nebius.ai.v1.JobService - name: nebius.applications.v1alpha1.K8sReleaseService - name: nebius.audit.v2.AuditEventExportService - name: nebius.audit.v2.AuditEventService - name: nebius.billing.v1.CalculatorService - name: nebius.billing.v1alpha1.CalculatorService - name: nebius.billing.v1alpha1.OneTimeExportService - name: nebius.capacity.v1.CapacityAllowanceService - name: nebius.capacity.v1.CapacityBlockGroupService - name: nebius.capacity.v1.CapacityIntervalService - name: nebius.capacity.v1.ResourceAdviceService - name: nebius.compute.v1.DiskService - name: nebius.compute.v1.DiskSnapshotService - name: nebius.compute.v1.FilesystemService - name: nebius.compute.v1.GpuClusterService - name: nebius.compute.v1.ImageService - name: nebius.compute.v1.InstanceService - name: nebius.compute.v1.MaintenanceService - name: nebius.compute.v1.NVLInstanceGroupService - name: nebius.compute.v1.NodeService - name: nebius.compute.v1.PlatformService - name: nebius.dns.v1.RecordService - name: nebius.dns.v1.ZoneService - name: nebius.iam.v1.AccessKeyService - name: nebius.iam.v1.AccessPermitService - name: nebius.iam.v1.AuthPublicKeyService - name: nebius.iam.v1.FederatedCredentialsService - name: nebius.iam.v1.FederationCertificateService - name: nebius.iam.v1.FederationService - name: nebius.iam.v1.GroupMembershipService - name: nebius.iam.v1.GroupService - name: nebius.iam.v1.InvitationService - name: nebius.iam.v1.ProfileService - name: nebius.iam.v1.ProjectService - name: nebius.iam.v1.ServiceAccountService - name: nebius.iam.v1.SessionManagementService - name: nebius.iam.v1.StaticKeyService - name: nebius.iam.v1.TenantService - name: nebius.iam.v1.TenantUserAccountService - name: nebius.iam.v1.TenantUserAccountWithAttributesService - name: nebius.iam.v2.AccessKeyService - name: nebius.iam.v2.ProjectService - name: nebius.iam.v2.TenantService - name: nebius.kms.v1.AsymmetricCryptoService - name: nebius.kms.v1.AsymmetricKeyService - name: nebius.kms.v1.SymmetricCryptoService - name: nebius.kms.v1.SymmetricKeyService - name: nebius.logging.agentmanager.v1.VersionService - name: nebius.logging.v1.LogExportService - name: nebius.maintenance.v1alpha1.MaintenanceService - name: nebius.mk8s.v1.ClusterService - name: nebius.mk8s.v1.NodeGroupService - name: nebius.mk8s.v1alpha1.ClusterService - name: nebius.mk8s.v1alpha1.NodeGroupService - name: nebius.msp.mlflow.v1alpha1.ClusterService - name: nebius.msp.postgresql.v1alpha1.BackupService - name: nebius.msp.postgresql.v1alpha1.ClusterService - name: nebius.mysterybox.v1.PayloadService - name: nebius.mysterybox.v1.SecretService - name: nebius.mysterybox.v1.SecretVersionService - name: nebius.quotas.v1.QuotaAllowanceService - name: nebius.registry.v1.ArtifactService - name: nebius.registry.v1.RegistryService - name: nebius.storage.v1.BucketService - name: nebius.storage.v1.TransferService - name: nebius.storage.v1alpha1.TransferService - name: nebius.tunnel.v1.TunnelService - name: nebius.vpc.v1.AllocationService - name: nebius.vpc.v1.NetworkService - name: nebius.vpc.v1.PoolService - name: nebius.vpc.v1.RouteService - name: nebius.vpc.v1.RouteTableService - name: nebius.vpc.v1.SecurityGroupService - name: nebius.vpc.v1.SecurityRuleService - name: nebius.vpc.v1.SubnetService - name: nebius.vpc.v1.TargetGroupService - name: nebius.vpc.v1alpha1.AllocationService - name: nebius.vpc.v1alpha1.NetworkService - name: nebius.vpc.v1alpha1.PoolService - name: nebius.vpc.v1alpha1.ScopeService - name: nebius.vpc.v1alpha1.SubnetService paths: /audit/v2/audit-events: get: tags: - nebius.audit.v2.AuditEventService summary: List operationId: AuditEventService_List parameters: - description: A tenant id must be provided in: query name: parentId required: true schema: type: string - in: query name: pageSize schema: format: int64 type: string - in: query name: start required: true schema: format: date-time type: string - in: query name: end required: true schema: format: date-time type: string - in: query name: pageToken schema: type: string - description: >- Example: service.name = 'iam' AND resource.hierarchy.id:'container-e0t' AND regex(resource.metadata.name, '^.*test.*$') Supported filters: "=" - equals "!=" - not equals ":" - contains regex - regular expression Fields that can be used for filtering: action authentication.static_key_credential.id authentication.subject.name authentication.subject.service_account_id authentication.subject.tenant_user_id authentication.token_credential.masked_token project_region.name resource.hierarchy.id resource.hierarchy.name resource.metadata.id resource.metadata.name resource.metadata.type service.name type status in: query name: filter schema: type: string - description: |- Type of audit event to filter by. - EVENT_TYPE_UNSPECIFIED: Unspecified event type. - CONTROL_PLANE: Control plane events. - DATA_PLANE: Data plane events (S3). in: query name: eventType schema: default: EVENT_TYPE_UNSPECIFIED enum: - EVENT_TYPE_UNSPECIFIED - CONTROL_PLANE - DATA_PLANE type: string - description: >- Region to retrieve audit logs (e.g. eu-north2, us-central1, eu-west1) See https://docs.nebius.com/overview/regions Default: eu-north1 During a transition period (until 13-08-2026), events are written to both eu-north1 and their origin region. After that, events are only stored in their origin region, and this field becomes required. in: query name: region schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/v2ListAuditEventResponse' description: A successful response. components: schemas: v2ListAuditEventResponse: properties: items: items: $ref: '#/components/schemas/v2AuditEvent' type: array nextPageToken: type: string type: object v2AuditEvent: properties: action: description: Indicates an action taken on the resource. type: string authentication: $ref: '#/components/schemas/v2Authentication' authorization: $ref: '#/components/schemas/v2Authorization' eventVersion: description: >- Audit event version, in "X.Y" format, events within different Y's are backwards compatible, events with different X's are not. type: string id: description: Unique event id. type: string projectRegion: $ref: '#/components/schemas/v2Region' request: $ref: '#/components/schemas/v2Request' resource: $ref: '#/components/schemas/auditV2Resource' response: $ref: '#/components/schemas/v2Response' service: $ref: '#/components/schemas/v2Service' source: description: >- Identifies the context in which an event happened. Presented in the form of URI. type: string specVersion: title: >- Version of CloudEvents spec. See https://github.com/cloudevents/spec/blob/main/cloudevents/spec.md#specversion type: string status: $ref: '#/components/schemas/auditV2Status' time: description: Timestamp of when the occurrence happened. format: date-time type: string type: title: >- The type of event related to the originating occurrence. Formed according to template: `ai.nebius...` type: string type: object v2Authentication: properties: authenticated: description: >- Answers the question whether or not the subject has been successfully authenticated. type: boolean authenticationType: $ref: '#/components/schemas/v2AuthenticationType' federation: $ref: '#/components/schemas/auditV2Federation' staticKeyCredential: $ref: '#/components/schemas/auditV2StaticKey' subject: $ref: '#/components/schemas/v2Subject' tokenCredential: $ref: '#/components/schemas/v2AccessToken' type: object v2Authorization: properties: authorized: title: >- Field is required. We do not use `(buf.validate.field).required = true` here as false value considered as unset (validation violation) type: boolean type: object v2Region: properties: name: title: Region name type: string type: object v2Request: properties: clientIp: description: Ip of the subject who initiated the RPC call. type: string idempotencyId: description: >- Unique key that the server uses to recognize subsequent retries of the same request. type: string ja3Fingerprint: title: Client Ja3 fingerprint type: string parameters: description: Parameters of the request. type: object requestId: description: Unique identifier of the request. type: string traceId: description: >- A unique identifier that allows you to link calls to different services within an operation. type: string userAgent: description: User agent of the subject who initiated operation. type: string type: object auditV2Resource: properties: hierarchy: description: Top-down resources hierarchy from tenant to resource. items: $ref: '#/components/schemas/auditV2ResourceMetadata' type: array metadata: $ref: '#/components/schemas/auditV2ResourceMetadata' state: $ref: '#/components/schemas/v2ResourceState' type: object v2Response: properties: errorMessage: description: Error message if the call was not successful. type: string payload: description: The payload of the response. type: object statusCode: $ref: '#/components/schemas/rpcCode' type: object v2Service: properties: name: type: string type: object auditV2Status: default: RESPONSE_STATUS_UNSPECIFIED enum: - RESPONSE_STATUS_UNSPECIFIED - STARTED - DONE - ERROR title: |- - STARTED: Asynchronous action started - DONE: Action finished successfully - ERROR: Action finished with error type: string v2AuthenticationType: default: AUTHENTICATION_TYPE_UNSPECIFIED enum: - AUTHENTICATION_TYPE_UNSPECIFIED - ACCESS_TOKEN - STATIC_KEY type: string auditV2Federation: properties: id: description: Unique identifier of the federation. type: string name: description: Human-readable name of the federation. type: string type: object auditV2StaticKey: properties: id: description: Unique identifier of static key. type: string type: object v2Subject: properties: name: description: Username of the subject. type: string serviceAccountId: description: >- This field is filled in if the call was made on behalf of a service account. type: string tenantUserId: description: This field is filled in if the call was made on behalf of a user. type: string type: object v2AccessToken: properties: maskedToken: description: Token without signature. type: string type: object auditV2ResourceMetadata: properties: id: description: Unique identifier of the resource. type: string name: description: Name of the resource. type: string type: description: Type of the resource. type: string type: object v2ResourceState: properties: current: description: The state of the resource after the change in the call. type: object previous: description: The state of the resource before the change in the call. type: object type: object rpcCode: default: OK description: >- The canonical error codes for gRPC APIs. Sometimes multiple error codes may apply. Services should return the most specific error code that applies. For example, prefer `OUT_OF_RANGE` over `FAILED_PRECONDITION` if both codes apply. Similarly prefer `NOT_FOUND` or `ALREADY_EXISTS` over `FAILED_PRECONDITION`. - OK: Not an error; returned on success. HTTP Mapping: 200 OK - CANCELLED: The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request - UNKNOWN: Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error - INVALID_ARGUMENT: The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request - DEADLINE_EXCEEDED: The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout - NOT_FOUND: Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found - ALREADY_EXISTS: The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict - PERMISSION_DENIED: The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden - UNAUTHENTICATED: The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized - RESOURCE_EXHAUSTED: Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests - FAILED_PRECONDITION: The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an "rmdir" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request - ABORTED: The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict - OUT_OF_RANGE: The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request - UNIMPLEMENTED: The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented - INTERNAL: Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error - UNAVAILABLE: The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable - DATA_LOSS: Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error enum: - OK - CANCELLED - UNKNOWN - INVALID_ARGUMENT - DEADLINE_EXCEEDED - NOT_FOUND - ALREADY_EXISTS - PERMISSION_DENIED - UNAUTHENTICATED - RESOURCE_EXHAUSTED - FAILED_PRECONDITION - ABORTED - OUT_OF_RANGE - UNIMPLEMENTED - INTERNAL - UNAVAILABLE - DATA_LOSS type: string securitySchemes: bearerAuth: description: The Authorization header expects a Bearer token. scheme: bearer type: http ````