# Audit Logs

Collects and ingests audit logs and security events within your Postman organization.

**Sync Type: Incremental**

## Overview

The Postman Audit Logs input allows you to collect organization audit logs from the Postman API. This input provides visibility into security-related activities, user actions, and configuration changes within your Postman organization.

## Prerequisites

Before configuring the Postman Audit Logs input, ensure you have:

1. **Postman Account**: Access to a Postman organization with audit log capabilities
2. **Administrative Access**: Permissions to generate API keys with audit log access
3. **API Key**: A Postman API key with permissions to access audit logs

## Setup Instructions

### Step 1: Generate a Postman API Key

1. Log in to your Postman account
2. Navigate to **Settings** > **API keys** or visit [Postman API Keys](https://web.postman.co/settings/me/api-keys)
3. Click **Generate API Key**
4. Provide a descriptive name for the key (e.g., "Monad Audit Log Connector")
5. Copy the generated API key and store it securely

**Important**: API keys provide access to your organization's data. Store them securely and never commit them to version control.

### Step 2: Verify API Key Permissions

Ensure your API key has the necessary permissions to access audit logs:
- The key must be generated by a user with administrative privileges in the organization
- The user must have permissions to view audit logs in the Postman workspace

## Configuration

### Settings

| Setting | Type | Required | Default | Description |
|---------|------|----------|---------|-------------|
| Backfill Start Time | string | No | - | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | - | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| API Key | string | Yes | The API key from your Postman team with permissions to access audit logs |

## Technical Details

### Collection Behavior

The input follows an incremental collection pattern:
- **First run**: Collects all available audit logs
- **Subsequent runs**: Collects only new audit logs since the last successful run
- **Page size**: Processes up to 100 records per API request
- **State tracking**: Maintains cursor position to resume from last processed event

## Data Collected

The audit logs include information about:
- User authentication events (sign-in, sign-out)
- Collection management (create, update, delete, publish)
- Workspace activities (member additions, permission changes)
- API key management (generation, revocation)
- Team and organization changes
- Environment and variable modifications
- Mock server operations
- Monitor activities

Each audit log entry includes:
- Unique event ID and timestamp
- Action type and description
- Actor information (user who performed the action)
- Resource details (collections, workspaces, etc.)
- IP address and user agent information
- Additional contextual metadata

## Troubleshooting

### Common Issues

1. **Authentication failures**
   - Verify the API key is correct and hasn't expired
   - Ensure the API key belongs to a user with administrative privileges
   - Check that the user has audit log viewing permissions

2. **No events returned**
   - Verify that audit logging is enabled for your Postman organization
   - Check that the backfill start time is within the data retention period
   - Ensure there have been activities in the organization during the specified timeframe

3. **Missing recent events**
   - There may be a slight delay between when events occur and when they appear in the audit logs
   - Wait a few minutes and check if the events appear in subsequent runs

## Related Articles

- [Postman Audit Logs API Documentation](https://learning.postman.com/docs/administration/managing-your-team/audit-logs/)
- [Postman API Authentication](https://learning.postman.com/docs/developer/postman-api/authentication/)
- [Postman Team Management](https://learning.postman.com/docs/administration/managing-your-team/managing-your-team/)

## Sample Record

```json
{
  "id": "198021612",
  "timestamp": "2025-08-11T23:46:59.165961Z",
  "action": "user.signin",
  "actor": {
    "id": "3842560",
    "name": "John Doe",
    "email": "john.doe@example.com",
    "type": "user"
  },
  "resource": {
    "id": "team_12345",
    "name": "Engineering Team",
    "type": "team"
  },
  "client": {
    "ip": "192.168.1.100",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
  },
  "metadata": {
    "source": "web",
    "location": "San Francisco, CA"
  }
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.