Events captured in configuration audit logs
This guide provides a reference for configuration audit log events generated across supported Akamai Cloud services. These events record configuration changes and other significant system actions. Logged events support security auditing, operational visibility, and analysis in external monitoring and observability platforms.
The tables in this guide list audit log events that can be generated for control plane operations across supported cloud services. Each entry includes a description of the event, the event code that appears in the log file, and the related API operation.
Read-only operations, such as GET requests, are not recorded in audit log files because they typically generate high-volume, low-signal data. Audit logging prioritizes configuration-changing or security-relevant actions to reduce noise and improve signal quality.
For information about log file format and fields, see Log files.
Platform
Profile
| Event description | Event code | Related API operation |
|---|---|---|
| Profiles | ||
| Attempt to update profile information | put-profile | Update a profile |
| Apps | ||
| Attempt to revoke app access | delete-profile-app | Revoke app access |
| Devices | ||
| Attempt to revoke a trusted device's access | delete-trusted-device | Revoke a trusted device |
| Phone number | ||
| Attempt to send a phone number verification code via SMS message | post-profile-phone-number | Send a phone number verification code |
| Attempt to verify a phone number by confirming the one-time code received via SMS message | post-profile-phone-number-verify | Verify a phone number |
| Attempt to delete the verified phone number for the user making the request | delete-profile-phone-number | Delete a phone number |
| Preferences | ||
| Attempt to update a user's preferences | put-user-preferences | Update a user's preferences |
| Security questions | ||
| Attempt to add responses to security questions | post-security-questions | Answer security questions |
| SSH keys | ||
| Attempt to add an SSH key to a user profile | post-add-ssh-key | Add an SSH key |
| Attempt to update the label for an SSH key | put-ssh-key | Update an SSH key |
| Attempt to delete an SSH key from a user's profile | delete-ssh-key | Delete an SSH key |
| Two factor authentication | ||
| Attempt to generate a two-factor secret | post-tfa-enable | Create a two factor secret |
| Attempt to enable two-factor authentication | post-tfa-confirm | Enable two factor authentication |
| Attempt to disable two-factor authentication | post-tfa-disable | Disable two factor authentication |
| Personal access tokens | ||
| Attempt to create a personal access token (PAT) | post-personal-access-token | Create a personal access token |
| Attempt to update a personal access token (PAT) | put-personal-access-token | Update a personal access token |
| Attempt to revoke a personal access token (PAT) | delete-personal-access-token | Revoke a personal access token |
Administration
| Event description | Event code | Related API operation |
|---|---|---|
| Child accounts | ||
| Attempt to create a short-lived bearer token for a parent user on a specified child account | post-child-account-token | Create a proxy user token |
| OAuth clients | ||
| Attempt to create an OAuth client | post-client | Create an OAuth client |
| Attempt to update OAuth client | put-client | Update an OAuth client |
| Attempt to delete an OAuth client | delete-client | Delete an OAuth client |
| Attempt to reset the OAuth client secret | post-reset-client-secret | Reset an OAuth client secret |
| Users | ||
| Attempt to create a user on an account | post-user | Create a user |
| Attempt to update user information | put-user | Update a user |
| Attempt to delete a user from an account | delete-user | Delete a user |
| Attempt to update grants for a restricted user | put-user-grants | Update a user's grants |
Compute
Linodes
| Event description | Event code | Related API operation |
|---|---|---|
| Linode instances | ||
| Attempt to create a Linode | post-linode-instance | Create a Linode |
| Attempt to update a Linode | put-linode-instance | Update a Linode |
| Attempt to delete a Linode | delete-linode-instance | Delete a Linode |
| Attempt to boot a Linode | post-boot-linode-instance | Boot a Linode |
| Attempt to boot a Linode in rescue mode | post-rescue-linode-instance | Boot a Linode into rescue mode |
| Attempt to reboot a Linode | post-reboot-linode-instance | Reboot a Linode |
| Attempt to clone a Linode's disks, configuration profiles, and interfaces to another Linode | post-clone-linode-instance | Clone a Linode |
| Attempt to resize a Linode to a different plan | post-resize-linode-instance | Resize a Linode |
| Attempt to upgrade a Linode from a now-deprecated plan to the next generation | post-mutate-linode-instance | Upgrade a Linode |
| Attempt to rebuild a Linode | post-rebuild-linode-instance | Rebuild a Linode |
| Attempt to shut down a Linode | post-shutdown-linode-instance | Shut down a Linode |
| Attempt to reset a Linode's root password | post-reset-linode-password | Reset a Linode's root password |
| Attempt to initiate a pending host migration scheduled by a Linode or initiate a cross data center migration | post-migrate-linode-instance | Launch a DC migration/pending host migration |
| Configuration profiles | ||
| Attempt to add a new configuration profile to a Linode | post-add-linode-config | Create a configuration profile |
| Attempt to update a configuration profile on a Linode | put-linode-config | Update a configuration profile |
| Attempt to delete a configuration profile from a Linode | delete-linode-config | Delete a configuration profile |
| Configuration profile interfaces (legacy) | ||
| Attempt to create an interface and append it to the interfaces array of an existing configuration profile | post-linode-config-interface | Add a configuration profile interface |
| Attempt to reorder the interfaces of a configuration profile | post-linode-config-interfaces | Reorder configuration profile interfaces |
Attempt to update a vpc or public configuration profile interface for a specific configuration profile on a specific Linode | put-linode-config-interface | Update a configuration profile interface |
| Attempt to delete an interface from a specific configuration profile on a specific Linode | delete-linode-config-interface | Delete a configuration profile interface |
| Linode interfaces | ||
| Attempt to create a Linode interface for a specific Linode | post-linode-interface | Add a Linode interface |
| Attempt to update the configuration of a Linode interface | put-linode-interface | Update a Linode interface |
| Attempt to delete a Linode interface from a specific Linode | delete-linode-interface | Delete a Linode interface |
| Attempt to upgrade legacy configuration interfaces to Linode interfaces | post-upgrade-linode-interfaces | Upgrade to Linode interfaces |
| Attempt to update Network Helper and default route settings on a Linode | put-linode-interface-settings | Update Linode interface settings |
| IP addresses | ||
| Attempt to allocate a public or private IPv4 address to a Linode | post-add-linode-ip | Allocate an IPv4 address |
| Attempt to update the reverse DNS (RDNS) for a Linode's IP address | put-linode-ip | Update an IP address's RDNS for a Linode |
| Attempt to delete a public or private IPv4 address assigned to a Linode | delete-linode-ip | Delete an IPv4 address |
| Disks | ||
| Attempt to add a new disk to a Linode | post-add-linode-disk | Create a disk |
| Attempt to update a disk on a Linode | put-disk | Update a disk |
| Attempt to delete a disk from a Linode | delete-disk | Delete a disk |
| Attempt to clone a disk to a new disk on the same Linode | post-clone-linode-disk | Clone a disk |
| Attempt to reset a disk's root password | post-reset-disk-password | Reset a disk root password |
| Attempt to resize a disk | post-resize-disk | Resize a disk |
| Firewalls | ||
| Attempt to update the list of firewalls assigned to a Linode | put-linode-firewalls | Update a Linode's firewalls |
| Attempt to reapply assigned firewalls to a Linode | post-apply-firewalls | Apply a Linode's firewalls |
| Backups | ||
| Attempt to enable backups for a Linode | post-enable-backups | Enable backups |
| Attempt to create a snapshot backup of a Linode | post-snapshot | Create a snapshot |
| Attempt to cancel the Backups service on a Linode | post-cancel-backups | Cancel backups |
| Attempt to restore a backup to a Linode | post-restore-backup | Restore a backup |
Linode Kubernetes Engine (LKE)
| Event description | Event code | Related API operation |
|---|---|---|
| Clusters | ||
| Attempt to create a Kubernetes cluster | post-lke-cluster | Create a Kubernetes cluster |
| Attempt to update a Kubernetes cluster | put-lke-cluster | Update a Kubernetes cluster |
| Attempt to delete a Kubernetes cluster | delete-lke-cluster | Delete a Kubernetes cluster |
| Attempt to regenerate the Kubeconfig file or service account token for a cluster | post-lke-cluster-regenerate | Regenerate a Kubernetes cluster |
| Attempt to recycle all nodes in all pools of a Kubernetes cluster | post-lke-cluster-recycle | Recycle cluster nodes |
| Control Plane ACL | ||
| Attempt to update a Kubernetes cluster's control plane access control list (ACL) | put-lke-cluster-acl | Update the control plane access control list |
| Attempt to disable A Kubernetes cluster's control plane access and delete all rules | delete-lke-cluster-acl | Delete the control plane access control list |
| Kubeconfigs | ||
| Attempt to delete and regenerate the Kubeconfig file for a cluster | delete-lke-cluster-kubeconfig | Delete a Kubeconfig |
| Nodes | ||
| Attempt to remove a node from a node pool in a Kubernetes cluster | delete-lke-cluster-node | Delete a node |
| Attempt to recycle a node in a Kubernetes cluster | post-lke-cluster-node-recycle | Recycle a node |
| Node pools | ||
| Attempt to create a node pool for a Kubernetes cluster | post-lke-cluster-pools | Create a node pool |
| Attempt to update a node pool for a Kubernetes cluster | put-lke-node-pool | Update a node pool |
| Attempt to remove a specific node pool from a Kubernetes cluster | delete-lke-node-pool | Delete a node pool |
| Attempt to recycle a node pool in a Kubernetes cluster | post-lke-cluster-pool-recycle | Recycle a node pool |
| LKE service tokens | ||
| Attempt to delete and regenerate the service account token for a Kubernetes cluster | delete-lke-service-token | Delete a service token |
Storage
Object Storage
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to cancel Object Storage on an account | post-cancel-object-storage | Cancel Object Storage |
| Buckets | ||
| Attempt to create an Object Storage bucket | post-object-storage-bucket | Create an Object Storage bucket |
| Attempt to delete an Object Storage bucket | delete-object-storage-bucket | Remove an Object Storage bucket |
| Attempt to allow access to an Object Storage bucket | post-object-storage-bucket-access | Allow access to an Object Storage bucket |
| Attempt to update access to an Object Storage bucket | put-object-storage-bucket-access | Update access to an Object Storage bucket |
| Attempt to create a pre-signed URL to access an object in an Object Storage bucket | post-object-storage-object-url | Create a URL for an object |
| Attempt to update an object's access control list (ACL) configuration | put-object-storage-bucket-acl | Update an object's ACL configuration |
| TLS/SSL certificates | ||
| Attempt to upload a TLS/SSL certificate and private key for an Object Storage bucket | post-object-storage-ssl | Upload an Object Storage TLS/SSL certificate |
| Attempt to delete a user-uploaded TLS/SSL certificate and private key for an Object Storage bucket | delete-object-storage-ssl | Delete an Object Storage TLS/SSL certificate |
| Keys | ||
| Attempt to provision a new Object Storage key for authentication | post-object-storage-keys | Create an Object Storage key |
| Attempt to update an Object Storage key | put-object-storage-key | Update an Object Storage key |
| Attempt to revoke an Object Storage key | delete-object-storage-key | Revoke an Object Storage key |
Volumes (Block Storage)
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to create a Block Storage volume | post-volume | Create a volume |
| Attempt to update a Block Storage volume | put-volume | Update a volume |
| Attempt to delete a Block Storage volume | delete-volume | Delete a volume |
| Attempt to clone a Block Storage volume | post-clone-volume | Clone a volume |
| Attempt to attach a Block Storage volume to a Linode | post-attach-volume | Attach a volume |
| Attempt to detach a Block Storage volume from a Linode | post-detach-volume | Detach a volume |
| Attempt to increase the size of a Block Storage volume | post-resize-volume | Resize a volume |
Networking
Firewalls
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to create a Cloud Firewall to filter network traffic | post-firewalls | Create a firewall |
| Attempt to update a Cloud Firewall | put-firewall | Update a firewall |
| Attempt to delete a Cloud Firewall | delete-firewall | Delete a firewall |
| Attempt to update the inbound and outbound rules for a Cloud Firewall | put-firewall-rules | Update firewall rules |
| Firewall settings | ||
| Attempt to add or update an entity's default Cloud Firewall | put-firewall-settings | Update default firewalls |
| Firewall devices | ||
| Attempt to create a firewall device | post-firewall-device | Create a firewall device |
| Attempt to delete a firewall device | delete-firewall-device | Delete a firewall device |
| Rule sets | ||
| Attempt to create a rule set for a Cloud Firewall | post-firewall-ruleset | Create a Rule Set |
| Attempt to update a rule set for a Cloud Firewall | put-firewall-ruleset | Update a Rule Set |
| Attempt to delete a rule set for a Cloud Firewall | delete-firewall-ruleset | Delete a Rule Set |
IP addresses
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to allocate a new IPv4 address on an account | post-allocate-ip | Allocate an IP address |
| Attempt to assign any set of IPv4 addresses and/or IPv6 ranges to Linodes in a region | post-assign-ips | Assign IP addresses |
| Attempt to configure shared IPs | post-share-ips | Share IP addresses |
| Attempt to set reverse DNS (rDNS) on an IP address | put-ip | Update an IP address's RDNS |
| IPv4 addresses | ||
| Attempt to assign any set of IPv4 addresses and/or IPv6 ranges to Linodes in a region | post-assign-ipv4s | Assign IP addresses |
| Attempt to configure shared IPs (IPv4) | post-share-ipv4s | Configure IPv4 sharing |
| IPv6 ranges | ||
| Attempt to create an IPv6 range | post-ipv6-range | Create an IPv6 range |
| Attempt to delete an IPv6 range | delete-ipv6-range | Delete an IPv6 range |
NodeBalancers (nodebalancers)
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to create a NodeBalancer | post-node-balancer | Create a NodeBalancer |
| Attempt to update a NodeBalancer | put-node-balancer | Update a NodeBalancer |
| Attempt to delete a NodeBalancer | delete-node-balancer | Delete a NodeBalancer |
| Configurations | ||
| Attempt to create a NodeBalancer configuration that allows the NodeBalancer to accept traffic on a new port | post-node-balancer-config | Create a config |
| Attempt to update a NodeBalancer configuration | put-node-balancer-config | Update a config |
| Attempt to delete a NodeBalancer configuration | delete-node-balancer-config | Delete a config |
| Attempt to rebuild a NodeBalancer configuration | post-rebuild-node-balancer-config | Rebuild a config |
| Nodes | ||
| Attempt to create a backend node for a NodeBalancer configuration | post-node-balancer-node | Create a node |
| Attempt to update a backend node for a NodeBalancer configuration | put-node-balancer-node | Update a node |
| Attempt to delete a backend node from a NodeBalancer configuration | delete-node-balancer-config-node | Delete a NodeBalancer's node |
| Firewalls | ||
| Attempt to update the Cloud Firewalls assigned to a NodeBalancer | put-node-balancer-firewalls | Update a NodeBalancer's firewalls |
VPC
| Event description | Event code | Related API operation |
|---|---|---|
| VPCs | ||
| Attempt to create a new VPC | post-vpc | Create a VPC |
| Attempt to update a VPC | put-vpc | Update a VPC |
| Attempt to delete a VPC and all of its subnets | delete-vpc | Delete a VPC |
| VPC subnets | ||
| Attempt to create a VPC subnet | post-vpc-subnet | Create a VPC subnet |
| Attempt to update a VPC subnet | put-vpc-subnet | Update a VPC subnet |
| Attempt to delete a VPC subnet | delete-vpc-subnet | Delete a VPC subnet |
VLANs
| Event description | Event code | Related API operation |
|---|---|---|
| Attempt to delete a legacy configuration profile for a VLAN interface | delete-vlan | Delete a VLAN |
Databases
| Event description | Event code | Related API operation |
|---|---|---|
| MySQL Managed Databases | ||
| Attempt to provision a MySQL Managed Database | post-databases-mysql-instances | Create or restore a MySQL Managed Database |
| Attempt to make changes to a MySQL Managed Database | put-databases-mysql-instance | Update a MySQL Managed Database |
| Attempt to remove a MySQL Managed Database from an account | delete-databases-mysql-instance | Delete a MySQL Managed Database |
| Attempt to apply security patches or updates to the underlying operating system of a MySQL Managed Database | post-databases-mysql-instance-patch | Patch a MySQL Managed Database |
| Attempt to resume a suspended MySQL Managed Database | resume-databases-mysql-instance | Resume a MySQL Managed Database |
| Attempt to suspend a MySQL Managed Database | suspend-databases-mysql-instance | Suspend a MySQL Managed Database |
| Attempt to reset the root password for a MySQL Managed Database | post-databases-mysql-instance-credentials-reset | Reset MySQL Managed Database credentials |
| PostgreSQL Managed Databases | ||
| Attempt to provision a PostgreSQL Managed Database | post-databases-postgre-sql-instances | Create or restore a PostgreSQL Managed Database |
| Attempt to make changes to a PostgreSQL Managed Database | put-databases-postgre-sql-instance | Update a PostgreSQL Managed Database |
| Attempt to remove a PostgreSQL Managed Database from an account | delete-databases-postgre-sql-instance | Delete a PostgreSQL Managed Database |
| Attempt to apply security patches or updates to the underlying operating system of a PostgreSQL Managed Database | post-databases-postgre-sql-instance-patch | Patch a PostgreSQL Managed Database |
| Attempt to resume a suspended PostgreSQL Managed Database | resume-databases-postgre-sql-instance | Resume a PostgreSQL Managed Database |
| Attempt to suspend a PostSQL Managed Database | suspend-databases-postgre-sql-instance | Suspend a PostgreSQL Managed Database |
| Attempt to reset the root password for a PostgreSQL Managed Database | post-databases-postgre-sql-instance-credentials-reset | Reset PostgreSQL Managed Database credentials |
Monitoring
Log delivery
| Event description | Event code | Related API operation |
|---|---|---|
| Streams | ||
| Attempt to create a stream to deliver log data to a configured destination | post-stream | Create a stream |
| Attempt to update a log delivery stream | put-stream | Update a stream |
| Attempt to delete a log delivery stream | delete-stream | Delete a stream |
| Destinations | ||
| Attempt to create a destination for streamed log data | post-stream-destination | Create a destination |
| Attempt to update a log delivery destination | put-stream-destination | Update a destination |
| Attempt to delete a log delivery destination | delete-stream-destination | Delete a destination |
Updated about 4 hours ago