Hello! I’m looking into the audit logs built into ...
# permit-saas
t
Hello! I’m looking into the audit logs built into Permit. Is there a native way to configure log forwarding to an external sink (e.g., S3, Grafana, or a webhook) for both API History and Activity Logs? I see these are available via the API, but I'm wondering if there’s a built-in push mechanism to stream these to us automatically?
a
Hi @Toby Aurelius, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Based on the available documentation, there isn't a native built-in push mechanism for automatically forwarding API History and Activity Logs to external sinks like S3, Grafana, or webhooks (1) (2) . However, for authorization decision logs (the audit logs generated by permission checks) , you can access them directly from your deployed PDP microservice (3) . Since these logs are written to stdout/stderr, you can stream them directly into your logging platform (4) (3) . This means you can use log aggregation tools like Elastic, Datadog, or Logstash to collect and forward these logs (4) . For the Activity Logs (who did what within the Permit.io dashboard) and API Logs (requests sent via API endpoints) , these are available through the Permit.io dashboard's Settings screen (1) . The documentation mentions you can access them via the API (2) , but doesn't describe a built-in streaming or webhook mechanism for automatic forwarding. To implement log forwarding for API History and Activity Logs, you would need to: • Pull logs via the API endpoints • Implement your own forwarding logic to your external sink For real-time authorization decision logs, the PDP's stdout/stderr o
To learn more, see the sources I considered: [[1] Permit logs](https://docs.permit.io/manage-your-account/permit-logs) [[2] Workspace Management API](https://docs.permit.io/manage-your-account/workspace-api) [[3] Audit Types & Filtering](https://docs.permit.io/how-to/use-audit-logs/types-and-filtering) [[4] Best Practices for Authorization Audit Logs](https://www.permit.io/blog/audit-logs)
d
Hi @Toby Aurelius, echoing what the bot said, you have essentially 2 options • Decision Logs → run an Edge PDP, enable the Logs Forwarder to Elasticsearch, or use
stdout
and let your existing log collector (Fluent Bit/Vector/Datadog agent/CloudWatch Logs → S3 via Firehose) ship it wherever you want (Grafana Loki, S3, webhook, SIEM). • API History / Activity Logs → write a small poller against the audit logs API on a cron and push to your sink yourself. There's no push option for these today.
t
Gotcha, thanks for confirming!