# Rootly Audit Logs

Ingests Rootly audit logs for tracking changes and activities within the Rootly platform. This connector captures user actions, system events, and configuration changes for security monitoring and compliance.

**Sync Type: Incremental**

## Requirements

- A Rootly account with API access
- API Key with read permissions for audit logs
- Organization Settings access to generate API keys

### Generating an API Key

1. Log in to your Rootly dashboard
2. Navigate to **Configuration** → **API Keys**
3. Click **Generate New API Key**
4. Copy the generated key and store it securely

## Details

| Property | Value |
|----------|-------|
| **State Management** | Ascending cursor based on `created_at` timestamp |
| **API Endpoint** | `GET /v1/audits` |
| **Pagination** | Cursor-based using JSON:API `links.next` |
| **Base URL** | `https://api.rootly.com` |
| **API Format** | JSON:API specification |

## Configuration

### Settings

| Setting | Type | Required | Default | Description |
|---------|------|----------|---------|-------------|
| Use Synthetic Data` | boolean | No | `false` | Generate synthetic demo data instead of connecting to the real data source |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | - | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| API Key | string | Yes | Bearer token for authenticating with the Rootly API |

## Rate Limits

| Scope | Limit | Window | Notes |
|-------|-------|--------|-------|
| GET, HEAD, OPTIONS | 3,000 requests | per minute | Per API key, sliding window |
| POST, PUT, PATCH, DELETE | 3,000 requests | per minute | Per API key, sliding window |
| Alert Creation | 50 requests | per minute | Per API key |

**Source**: [Rootly API Overview](https://docs.rootly.com/api-reference/overview)

## Troubleshooting

### Common Issues

**Issue**: Authentication failed (401 Unauthorized)

**Cause**: Invalid or expired API key

**Solution**:
1. Verify your API key is correct
2. Generate a new API key from Organization Settings
3. Ensure the key has not been revoked

---

**Issue**: No audit logs returned

**Cause**: No activity in the specified time range or insufficient permissions

**Solution**:
1. Check if there is recent activity in your Rootly account
2. Verify your API key has audit log read permissions
3. Try expanding the time range

---

**Issue**: Rate limit exceeded (429 Too Many Requests)

**Cause**: Exceeded 3,000 requests per minute

**Solution**:
1. Wait for the rate limit window to reset (1 minute)
2. The connector automatically handles rate limiting with retries

## Related Articles

- [Rootly API Documentation](https://docs.rootly.com/api-reference)
- [Rootly API Overview](https://docs.rootly.com/api-reference/overview)
- [Rootly Authentication Guide](https://docs.rootly.com/api-reference/authentication)

## Sample Record

```json
{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "type": "audit_logs",
  "attributes": {
    "action": "incident.created",
    "actor_id": "user-123",
    "actor_type": "User",
    "actor_name": "John Doe",
    "resource_id": "incident-456",
    "resource_type": "Incident",
    "changes": {
      "status": ["investigating", "resolved"],
      "severity": ["minor", "major"]
    },
    "metadata": {
      "ip_address": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
    },
    "created_at": "2024-01-15T10:30:00Z",
    "environment_id": "env-789"
  },
  "relationships": {
    "actor": {
      "data": {
        "id": "user-123",
        "type": "users"
      }
    },
    "resource": {
      "data": {
        "id": "incident-456",
        "type": "incidents"
      }
    }
  }
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.