audit

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 15, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package audit provides typed access to Jamf Platform audit API endpoints.

Index

Constants

This section is empty.

Variables

View Source 
var Privileges = map[string]jamfplatform.MethodPrivileges{
	"GetResourceLineage":     {Method: "GetResourceLineage", HTTPMethod: "GET", Path: "/v1/audit/resources/{resourceId}/lineage", Scopes: []jamfplatform.ScopeKind{jamfplatform.ScopeEnvironment}, ScopesSource: "spec", Scoped: []string{"audit:read"}, Legacy: nil, Source: "spec"},
	"GetTransactionTimeline": {Method: "GetTransactionTimeline", HTTPMethod: "GET", Path: "/v1/audit/transactions/{txId}", Scopes: []jamfplatform.ScopeKind{jamfplatform.ScopeEnvironment}, ScopesSource: "spec", Scoped: []string{"audit:read"}, Legacy: nil, Source: "spec"},
	"ListAuditEvents":        {Method: "ListAuditEvents", HTTPMethod: "GET", Path: "/v1/audit", Scopes: []jamfplatform.ScopeKind{jamfplatform.ScopeEnvironment}, ScopesSource: "spec", Scoped: []string{"audit:read"}, Legacy: nil, Source: "spec"},
	"ListAuditSources":       {Method: "ListAuditSources", HTTPMethod: "GET", Path: "/v1/audit/sources", Scopes: []jamfplatform.ScopeKind{jamfplatform.ScopeEnvironment}, ScopesSource: "spec", Scoped: []string{"audit:read"}, Legacy: nil, Source: "spec"},
}

Privileges maps each audit SDK method name to the Jamf API privileges it requires, sourced from the x-required-privileges vendor extensions in the Jamf OpenAPI specs. Identifiers are GA capability permissions in {capability}:{action} form and a multi-entry Scoped slice means all of them are required.

Source names where each entry's Scoped set came from: "spec" for the operation's own x-required-privileges, "gateway-policy" for one the published spec omits and this SDK supplies from the gateway's authorization policy, and "" when Scoped is empty. An empty Scoped slice means nothing declares a privilege for the endpoint, which is NOT the same as none being required — see jamfplatform.MethodPrivileges. Do not render it as "no permission needed".

Scopes lists the scope kinds each endpoint accepts. It is an alternatives set: a client carries one scope, so a consumer needs a credential matching one of the listed kinds. ScopesSource names where the set came from — "spec" for the spec root's own x-scope-types, "config-override" for one this SDK supplies because the published spec understates what the gateway serves or declares no extension at all. A spec-sourced set is what the spec declares, which for the Platform APIs is currently stricter than the gateway — see jamfplatform.MethodPrivileges.

Synthetic Resolve<X>ByName / Apply<X> methods are not present; document the privileges of the operations they call instead.

Functions

func PrivilegesFor 

func PrivilegesFor(method string) (jamfplatform.MethodPrivileges, bool)

PrivilegesFor returns the privilege metadata for the named SDK method and true when the method is present in the registry, or the zero value and false otherwise.

Types

type Actor 

type Actor struct {
	// Human-readable actor name (when available).
	DisplayName string `json:"displayName"`
	// Actor identifier.
	ID string `json:"id"`
	// Actor type.
	Kind string `json:"kind"`
}

Actor The principal responsible for a gateway event. Present only on gateway events.

type ApiError 

type ApiError struct {
	Errors []ApiErrorErrorsItem `json:"errors"`
	// HTTP status code.
	HttpStatus int `json:"httpStatus"`
	// Trace id for support requests.
	TraceID string `json:"traceId"`
}

ApiError Standard error response body.

type ApiErrorErrorsItem 

type ApiErrorErrorsItem struct {
	// Error code.
	Code string `json:"code"`
	// Error description.
	Description string `json:"description"`
	// Field that caused the error.
	Field string `json:"field"`
}

ApiErrorErrorsItem represents a api error errors item.

type AuditEnvelope 

type AuditEnvelope struct {
	// The principal responsible for a gateway event. Present only on gateway events.
	Actor *Actor `json:"actor,omitempty"`
	// Unique event id.
	AuditID string `json:"auditId"`
	// System that emitted this event, e.g. `api-gateway`, `blueprints`, `ai-policy`.
	AuditSource string `json:"auditSource"`
	// Event type, e.g. `api.call`, `blueprint.created`.
	AuditType string `json:"auditType"`
	// Event-specific payload (schema varies by source).
	Data *map[string]any `json:"data,omitempty"`
	// Environment id, when applicable.
	EnvironmentID *string `json:"environmentId,omitempty"`
	// Organization id.
	OrgID string `json:"orgId"`
	// HTTP request details for gateway events.
	RequestContext *RequestContext `json:"requestContext,omitempty"`
	// Affected resource id, when applicable.
	ResourceID *string `json:"resourceId,omitempty"`
	// Tenant id, when applicable.
	TenantID *string `json:"tenantId,omitempty"`
	// Event timestamp (ISO-8601).
	Time time.Time `json:"time"`
	// Transaction id linking related events.
	TxID string `json:"txId"`
}

AuditEnvelope A single audit event in canonical wire shape. Discriminated structurally into a gateway event (carries `actor` + `requestContext`) or a service event (carries `data`); the two never mix.

type AuditEventBase 

type AuditEventBase struct {
	// Unique event id.
	AuditID string `json:"auditId"`
	// System that emitted this event, e.g. `api-gateway`, `blueprints`, `ai-policy`.
	AuditSource string `json:"auditSource"`
	// Event type, e.g. `api.call`, `blueprint.created`.
	AuditType string `json:"auditType"`
	// Environment id, when applicable.
	EnvironmentID *string `json:"environmentId,omitempty"`
	// Organization id.
	OrgID string `json:"orgId"`
	// Affected resource id, when applicable.
	ResourceID *string `json:"resourceId,omitempty"`
	// Tenant id, when applicable.
	TenantID *string `json:"tenantId,omitempty"`
	// Event timestamp (ISO-8601).
	Time time.Time `json:"time"`
	// Transaction id linking related events.
	TxID string `json:"txId"`
}

AuditEventBase Fields common to every audit event, regardless of source. Gateway and service events both extend this base with their source-specific fields.

type AuditSourceInfo 

type AuditSourceInfo struct {
	// Whether your environment has events from this source in the time window.
	HasEvents bool `json:"hasEvents"`
	// The audit source identifier.
	Source string `json:"source"`
	// Distinct event types seen from this source, sorted alphabetically.
	Types []string `json:"types"`
}

AuditSourceInfo One audit source in the discovery view: the source identifier, whether your environment has events from it in the time window, and the distinct event types seen from it.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client provides typed methods for audit operations.

func New 

func New(base *jamfplatform.Client) *Client

New creates a audit client that shares the authenticated transport of the given root client.

func (*Client) GetResourceLineage 

func (c *Client) GetResourceLineage(ctx context.Context, resourceID string, auditType string, since string, until string) ([]TransactionGroup, error)

GetResourceLineage get resource lineage.

Required privileges: audit:read.

Parameters:

  • resourceID: Resource identifier (1-256 characters).
  • auditType: Optional event type filter. Supports trailing wildcards like `blueprint.*`.
  • since: Optional lower bound on event time (ISO-8601).
  • until: Optional upper bound on event time (ISO-8601).

func (*Client) GetTransactionTimeline 

func (c *Client) GetTransactionTimeline(ctx context.Context, txID string) ([]AuditEnvelope, error)

GetTransactionTimeline get transaction timeline.

Required privileges: audit:read.

Parameters:

  • txID: Transaction id (UUID).

func (*Client) ListAuditEvents 

func (c *Client) ListAuditEvents(ctx context.Context, since string, until string, actor string, auditSource []string, auditType []string, resourceID []string) ([]AuditEnvelope, error)

ListAuditEvents filter audit events.

Required privileges: audit:read.

Parameters:

  • since: Inclusive lower bound on event time (ISO-8601, required).
  • until: Inclusive upper bound on event time (ISO-8601); defaults to now.
  • actor: Actor id to filter by. The `|` in auth0 identifiers must be URI-encoded as `%7C`.
  • auditSource: Event sources to include (comma-separated, max 50).
  • auditType: Event types to include (comma-separated, max 50). Supports trailing wildcards like `blueprint.*`.
  • resourceID: Resource ids to include (comma-separated, max 50).

func (*Client) ListAuditSources 

func (c *Client) ListAuditSources(ctx context.Context, since string) ([]AuditSourceInfo, error)

ListAuditSources discover audit sources.

Required privileges: audit:read.

Parameters:

  • since: Optional lower bound on event time (ISO-8601). Defaults to 90 days ago.

type FilterPage 

type FilterPage struct {
	Items []AuditEnvelope `json:"items"`
	// Cursor for the next page; absent on the final page.
	NextCursor string `json:"nextCursor"`
}

FilterPage A page of audit events matching the filters — the events themselves, not their full transactions.

type GatewayEnvelope 

type GatewayEnvelope struct {
	// The principal responsible for a gateway event. Present only on gateway events.
	Actor *Actor `json:"actor,omitempty"`
	// Unique event id.
	AuditID string `json:"auditId"`
	// System that emitted this event, e.g. `api-gateway`, `blueprints`, `ai-policy`.
	AuditSource string `json:"auditSource"`
	// Event type, e.g. `api.call`, `blueprint.created`.
	AuditType string `json:"auditType"`
	// Environment id, when applicable.
	EnvironmentID *string `json:"environmentId,omitempty"`
	// Organization id.
	OrgID string `json:"orgId"`
	// HTTP request details for gateway events.
	RequestContext *RequestContext `json:"requestContext,omitempty"`
	// Affected resource id, when applicable.
	ResourceID *string `json:"resourceId,omitempty"`
	// Tenant id, when applicable.
	TenantID *string `json:"tenantId,omitempty"`
	// Event timestamp (ISO-8601).
	Time time.Time `json:"time"`
	// Transaction id linking related events.
	TxID string `json:"txId"`
}

GatewayEnvelope Gateway-sourced event (`auditSource = api-gateway`) — carries actor + request context, no `data`.

type RequestContext 

type RequestContext struct {
	ApiKeyHash string `json:"apiKeyHash"`
	// Platform Division the request was scoped to. Optional — present only when the request was
	// division-scoped.
	DivisionID    string `json:"divisionId"`
	Method        string `json:"method"`
	OauthClientID string `json:"oauthClientId"`
	Path          string `json:"path"`
	RemoteIp      string `json:"remoteIp"`
	Route         string `json:"route"`
	UserAgent     string `json:"userAgent"`
}

RequestContext HTTP request details for gateway events.

type ResourceLineageResponse 

type ResourceLineageResponse struct {
	// Cursor for the next page; absent on the final page.
	NextCursor   string             `json:"nextCursor"`
	Transactions []TransactionGroup `json:"transactions"`
}

ResourceLineageResponse A page of complete transactions that touched a resource.

type ServiceEnvelope 

type ServiceEnvelope struct {
	// Unique event id.
	AuditID string `json:"auditId"`
	// System that emitted this event, e.g. `api-gateway`, `blueprints`, `ai-policy`.
	AuditSource string `json:"auditSource"`
	// Event type, e.g. `api.call`, `blueprint.created`.
	AuditType string `json:"auditType"`
	// Event-specific payload (schema varies by source).
	Data *map[string]any `json:"data,omitempty"`
	// Environment id, when applicable.
	EnvironmentID *string `json:"environmentId,omitempty"`
	// Organization id.
	OrgID string `json:"orgId"`
	// Affected resource id, when applicable.
	ResourceID *string `json:"resourceId,omitempty"`
	// Tenant id, when applicable.
	TenantID *string `json:"tenantId,omitempty"`
	// Event timestamp (ISO-8601).
	Time time.Time `json:"time"`
	// Transaction id linking related events.
	TxID string `json:"txId"`
}

ServiceEnvelope Service-sourced event (`auditSource = blueprints | ai-policy | …`) — carries a free-form `data` payload, no actor.

type TransactionGroup 

type TransactionGroup struct {
	Events []AuditEnvelope `json:"events"`
	// Transaction id.
	TxID string `json:"txId"`
}

TransactionGroup One complete transaction: every event sharing the `txId` — gateway baseline included — ordered ascending by `time`.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.