apache / apache/apisix

feat: As a user, I want audit logs for the APISIX Admin API, so that all configuration changes are transparent and traceable

Open
#12,640 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

As a user, I would like the APISIX Admin API to provide audit logs that record all configuration changes (e.g., route creation, updates, deletions, plugin configurations), along with details such as who made the change, when it was made, and what was changed.

Motivation:
* Transparency and accountability: making sure all changes are visible and traceable to specific users or automation processes.
* Troubleshooting and debugging: quickly identifying when and why a misconfiguration was introduced.
* Compliance and security: many organisations must comply with standards (like ISO 27001, etc.), which require detailed audit trails for system changes.
* Forensics and incident response: having audit logs helps reconstruct the sequence of events that led to a security incident or system outage.

Proposed criteria:
* Admin API operations (create, update, delete) are logged.
* Logs include: timestamp, user/actor identity, request details, and result (success/failure).
* Logs storage:
* Storage format: logs are stored in a structured and queryable format (e.g., JSON).
* Storage backend: configurable backends for audit log storage: e.g., file, database, external logging system, perhaps existing logging plugins can be reused?
* Dashboard integration:
* A dedicated audit logs viewer is available in the APISIX Dashboard where logs can be filtered and searched by actor, resource, action type, or time range.
* UI displays change diffs where applicable (e.g., before/after for route changes).
* export functionality (e.g., download as JSON or CSV) for compliance audits.

Example configuration by the user:
* The user would have to enable this in the APISIX config file. And if the implementation reuses existing logging plugins, then the user would have to choose a logging plugin and configure it for audit logging, for example this way:
```yaml
apisix:
admin_audit_logs:
enabled: true
logging_plugin_name: elasticsearch-logger
logging_plugin_config:
# configure the chosen plugin here
```

Contributor guide

Open the contributing guide

Research direction

Start by reading the APISIX Admin API entry points for create, update, and delete operations, then inspect the existing logging plugins and the APISIX configuration path mentioned in the issue. Done means configuration changes produce structured audit records with actor, timestamp, request, and result details, with the proposed storage and Dashboard requirements addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
api, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.