Query Tailscale Logs via API

Posted on by

See documentation here: https://tailscale.com/kb/1203/audit-logging/

$ curl -u tskey-api-1234567890123456789012345678901234567890123456: -X GET "https://api.tailscale.com/api/v2/tailnet/aimsparking.com/logs?start=2023-01-01T00:00:00Z&end=2023-01-31T00:00:00Z"

Returned Results

{
    "version": "1.1",
    "tailnetId": "itsmetor.com",
    "logs": [{
            "eventTime": "2023-01-04T18:49:19.694535511Z",
            "type": "CONFIG",
            "deferredAt": "0001-01-01T00:00:00Z",
            "eventGroupID": "09b34d595b4b84765026e46b98f5033d",
            "origin": "NODE",
            "actor": {
                "id": "uq9qAw4CNTRL",
                "type": "USER",
                "loginName": "[email protected]",
                "displayName": "Chris"
            },
            "target": {
                "id": "ncB4io1CNTRL",
                "name": "desktop-dupd2cd.tail63dd3.ts.net",
                "type": "NODE"
            },
            "action": "LOGIN"
        }, {
            "eventTime": "2023-01-05T14:08:31.600023506Z",
            "type": "CONFIG",
            "deferredAt": "0001-01-01T00:00:00Z",
            "eventGroupID": "e62b7b9cceac63dc85f2da0eb215a770",
            "origin": "ADMIN_CONSOLE",
            "actor": {
                "id": "uT4thg4CwqRL",
                "type": "USER",
                "loginName": "[email protected]",
                "displayName": "Tor"
            },
            "target": {
                "id": "itsmetor.com",
                "name": "itsmetor.com",
                "type": "TAILNET",
                "property": "MAX_KEY_DURATION"
            },
            "action": "UPDATE",
            "old": "180 days",
            "new": "1 days"
        }
    ]
}