action enum Only generate this audit action. Omit for a mix.
allowed: login | logout | create | update | delete | permissionChange
example: action=permissionChange
Fake Audit Log API
MOCK DATAGenerate coherent fake audit records for authentication, CRUD and permission changes — safely seeded, filterable and bounded by time.
Generated test data for fixtures and development
- Base URL
- /api/audit-logs
- Category
- Developer Tools
- Capabilities
- 1 route Seedable
- Last updated
- July 29, 2026
GET /api/audit-logs
Route reference
Code samples Ready-to-copy requests in 4 languages
Parameters Route-specific request inputs 5
| Parameter | Type | Default & allowed | Description |
|---|---|---|---|
action | enum | allowed: login | logout | create | update | delete | permissionChange example: permissionChange | Only generate this audit action. Omit for a mix. |
outcome | enum | allowed: success | failure | denied example: denied | Only generate this outcome. Failure and denied records include metadata.reason. |
service | enum | allowed: auth | billing | catalog | storage | admin example: auth | Only generate resources from this application service; echoed as metadata.service. |
from | date | example: 2026-01-01 | Earliest timestamp, inclusive. With only from, to resolves exactly 30 days later; with neither bound, defaults to 30 UTC days before today. |
to | date | example: 2026-01-31T23:59:59.999Z | Latest timestamp, inclusive. With only to, from resolves exactly 30 days earlier; with neither bound, defaults to the end of the current UTC day. |
outcome enum Only generate this outcome. Failure and denied records include metadata.reason.
allowed: success | failure | denied
example: outcome=denied
service enum Only generate resources from this application service; echoed as metadata.service.
allowed: auth | billing | catalog | storage | admin
example: service=auth
from date Earliest timestamp, inclusive. With only from, to resolves exactly 30 days later; with neither bound, defaults to 30 UTC days before today.
example: from=2026-01-01
to date Latest timestamp, inclusive. With only to, from resolves exactly 30 days earlier; with neither bound, defaults to the end of the current UTC day.
example: to=2026-01-31T23:59:59.999Z
Universal parameters Shared response and formatting options 7
| Parameter | Type | Default & allowed | Description |
|---|---|---|---|
count | int | default: 10 allowed: 1 – 100 example: 3 | How many records to generate (1–100). |
seed | int | example: 42 | Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed). |
fields | list | example: id,timestamp | Return only these fields (comma-separated). Mutually exclusive with 'exclude'. |
exclude | list | example: metadata | Return all fields except these (comma-separated). |
format | enum | default: json allowed: json | ndjson | csv example: csv | Response format: json envelope, ndjson (one record per line) or csv. |
pretty | boolean | default: false example: true | Pretty-print the JSON response. |
unwrap | boolean | default: false example: true | Drop the envelope: return the raw array/object without data/meta wrapper. |
count int How many records to generate (1–100).
default: 10
allowed: 1 – 100
example: count=3
seed int Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
example: seed=42
fields list Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
example: fields=id,timestamp
exclude list Return all fields except these (comma-separated).
example: exclude=metadata
format enum Response format: json envelope, ndjson (one record per line) or csv.
default: json
allowed: json | ndjson | csv
example: format=csv
pretty boolean Pretty-print the JSON response.
default: false
example: pretty=true
unwrap boolean Drop the envelope: return the raw array/object without data/meta wrapper.
default: false
example: unwrap=true
Response schema Fields returned in each record 11
| Field | Type | Description | Example |
|---|---|---|---|
id | string | Fictional audit-event id prefixed aud_. | aud_66f327f2-76cc-47a8-b2ca-a2cf7131537a |
timestamp | string (ISO 8601) | Event instant inside the resolved from/to window. | 2026-01-18T14:27:31.488Z |
actor | object | Fictional actor with id, name and kind (user or serviceAccount). | {"id":"usr_a81c42","name":"Jamie Carter","kind":"user"} |
action | string | login | logout | create | update | delete | permissionChange. | update |
resourceType | string | Resource type coherent with action and service. | user |
resourceId | string | Fictional id whose prefix derives from resourceType. | user_31f0a82d9c41 |
outcome | string | success | failure | denied. | success |
ipAddress | string | Safe IPv4/IPv6 documentation address, never a claimed client address. | 192.0.2.42 |
userAgent | string | Fixed fictional/example client user-agent string. | randomapi-test-client/1.0 |
requestId | string | Fictional request correlation id prefixed req_. | req_53a4b81f9d0e7a2c |
metadata | object | Action-specific details. Success uses applied-state fields; failures/denials use attempted/requested fields plus reason. Always includes service. | {"service":"admin","changedFields":["status"],"previousVersion":2,"newVersion":3} |
id string Fictional audit-event id prefixed aud_.
example: aud_66f327f2-76cc-47a8-b2ca-a2cf7131537a
timestamp string (ISO 8601) Event instant inside the resolved from/to window.
example: 2026-01-18T14:27:31.488Z
actor object Fictional actor with id, name and kind (user or serviceAccount).
example: {"id":"usr_a81c42","name":"Jamie Carter","kind":"user"}
action string login | logout | create | update | delete | permissionChange.
example: update
resourceType string Resource type coherent with action and service.
example: user
resourceId string Fictional id whose prefix derives from resourceType.
example: user_31f0a82d9c41
outcome string success | failure | denied.
example: success
ipAddress string Safe IPv4/IPv6 documentation address, never a claimed client address.
example: 192.0.2.42
userAgent string Fixed fictional/example client user-agent string.
example: randomapi-test-client/1.0
requestId string Fictional request correlation id prefixed req_.
example: req_53a4b81f9d0e7a2c
metadata object Action-specific details. Success uses applied-state fields; failures/denials use attempted/requested fields plus reason. Always includes service.
example: {"service":"admin","changedFields":["status"],"previousVersion":2,"newVersion":3}
Documented examples
Build-generated requests and complete responses 3 Reproducible audit feed /api/audit-logs?seed=42&count=10
{
"data": [
{
"id": "aud_22019cec-2f1f-41b4-b62a-dd96ac094977",
"timestamp": "2026-07-26T11:00:49.199Z",
"actor": {
"id": "usr_ac58cdd40fb1",
"name": "Kaylie Ziemann",
"kind": "user"
},
"action": "create",
"resourceType": "product",
"resourceId": "product_8016cfb6a5c8",
"outcome": "denied",
"ipAddress": "198.51.100.97",
"userAgent": "randomapi-test-client/1.0",
"requestId": "req_c1d1cff8728448a0",
"metadata": {
"service": "catalog",
"requestedType": "product",
"reason": "authentication required"
}
},
{
"id": "aud_def349c6-8f36-4bd0-ab5e-920b1420de7a",
"timestamp": "2026-07-06T22:39:55.147Z",
"actor": {
"id": "svc_5df91c36673e",
"name": "catalog-automation",
"kind": "serviceAccount"
},
"action": "login",
"resourceType": "session",
"resourceId": "session_f248abeccba6",
"outcome": "success",
"ipAddress": "203.0.113.206",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/17.4",
"requestId": "req_e90de6555855da26",
"metadata": {
"service": "catalog",
…
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} Denied permission changes /api/audit-logs?action=permissionChange&outcome=denied&service=admin&count=20
{
"data": [
{
"id": "aud_22019cec-2f1f-41b4-b62a-dd96ac094977",
"timestamp": "2026-07-23T19:45:20.248Z",
"actor": {
"id": "usr_85eac58cdd40",
"name": "Kaylie Ziemann",
"kind": "user"
},
"action": "permissionChange",
"resourceType": "role",
"resourceId": "role_a958016cfb6a",
"outcome": "denied",
"ipAddress": "203.0.113.28",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36",
"requestId": "req_863c1d1cff872844",
"metadata": {
"service": "admin",
"requestedPermission": "delete",
"requestedChange": "revoked",
"requestedTargetType": "user",
"requestedTargetId": "target_b56b87c24316",
"reason": "insufficient permissions"
}
},
{
"id": "aud_c68f36bd-0b5e-4920-bb14-20de7a85dc4d",
"timestamp": "2026-07-19T15:53:15.586Z",
"actor": {
"id": "usr_6fd45df91c36",
"name": "Waino Friesen",
"kind": "user"
},
"action": "permissionChange",
"resourceType": "role",
"resourceId": "role_078f248abecc",
"outcome": "denied",
"ipAddress": "198.51.100.52",
"userAgent": "curl/8.7.1",
…
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} Authentication failures in January /api/audit-logs?service=auth&outcome=failure&from=2026-01-01&to=2026-01-31T23%3A59%3A59.999Z&count=25
{
"data": [
{
"id": "aud_22019cec-2f1f-41b4-b62a-dd96ac094977",
"timestamp": "2026-01-17T20:19:54.383Z",
"actor": {
"id": "usr_5eac58cdd40f",
"name": "Kaylie Ziemann",
"kind": "user"
},
"action": "create",
"resourceType": "session",
"resourceId": "session_958016cfb6a5",
"outcome": "failure",
"ipAddress": "192.0.2.96",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/17.4",
"requestId": "req_63c1d1cff8728448",
"metadata": {
"service": "auth",
"requestedType": "session",
"reason": "write conflict"
}
},
{
"id": "aud_c68f36bd-0b5e-4920-bb14-20de7a85dc4d",
"timestamp": "2026-01-13T02:11:29.573Z",
"actor": {
"id": "usr_fd45df91c366",
"name": "Waino Friesen",
"kind": "user"
},
"action": "login",
"resourceType": "user",
"resourceId": "user_78f248abeccb",
"outcome": "failure",
"ipAddress": "192.0.2.237",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/17.4",
"requestId": "req_fcae90de6555855d",
"metadata": {
"service": "auth",
…
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} About this API
Coverage & behavior
Generates fictional application audit records for testing tables, exports and security dashboards. Actions, resources and metadata agree: login/logout target users or sessions, permission changes target roles or policies, CRUD events use resources appropriate to the selected service, and every failed or denied event includes a reason. Successful records describe applied state; unsuccessful records use attempted* or requested* metadata and never claim that a mutation happened.
action, outcome and service are real filters. service is recorded inside metadata.service so the top-level record stays deliberately compact. from and to are inclusive timestamp bounds. With neither bound, they resolve to 30 UTC days before today through the end of today, keeping seeded defaults stable throughout a UTC day. With exactly one bound, the missing bound resolves exactly 30 elapsed days away (to = from + 30 days or from = to - 30 days). Both resolved values are echoed in meta.params.
All addresses come from RFC 5737 IPv4 or RFC 3849 IPv6 documentation ranges. IDs, actors, requests and user agents are mock values. This is a useful generic fixture shape, not a claim of OpenTelemetry, vendor or compliance-schema compatibility.
Use it for
- Populate an audit-log table with coherent authentication and administration events
- Exercise filters and CSV exports for failure and access-denied investigations
- Create reproducible security-dashboard fixtures without real users or IP addresses
Frequently asked questions
Are actions and resources internally consistent?
Yes. Login/logout events use user or session resources, permission changes use roles or policies, and CRUD resources come from the selected service's domain.
Do failed audit events include a reason?
Yes. Both failure and denied records include a human-readable metadata.reason; successful records do not invent an error.
Are the generated IP addresses safe for examples?
Yes. IPv4 values use RFC 5737 documentation blocks and IPv6 uses the RFC 3849 2001:db8::/32 documentation prefix.
Is this an OpenTelemetry audit-log schema?
No. It is an intentionally generic mock record for fixtures and UI testing, with no vendor or telemetry-conformance claim.
Standards & references
Related APIs
Fake Git Commit API MOCK DATA
Fake git commits — Conventional Commits or plain messages, 40-char hashes, safe author emails, dates in your range and realistic diff stats. Fully seedable.
Fake API Key & Token Generator MOCK DATA
Clearly fake API keys, JWTs and hex/base64 secrets — structurally valid enough to exercise parsers and middleware, cryptographically meaningless by design.
Random User Agent API MOCK DATA
Realistic, coherent browser user agents — filter by browser, OS and device; impossible combos like Safari-on-Windows get a clear 400, never a fake string.
Random User Data API MOCK DATA
Complete fake people — name, age-consistent birth date, email, phone, job and address — with working filters for gender, age range and email domain.
Fake Incident & Status Page API MOCK DATA
Generate coherent status-page incidents with affected components, ordered updates, exact lifecycle dates and impact/status filters.
Fake Webhook Delivery API MOCK DATA
Generate coherent webhook delivery histories with safe destinations, bounded retries, status-specific attempts and event-shaped payloads.