# Litmus Edge Manager 3.0.x - Admin Console: Action Log

## Returns current action log migration status

**GET** `{{LEM_adminURL}}/admin/v1/action-log/migration`

# Returns current action log migration status

Reports the status of the action-log migration (the one-time move of action-log data to its 2.34 storage). Check this after upgrading to confirm the migration completed.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/action-log/migration
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

`ActionLogMigrationResponse` (migration state and progress).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "status": "completed",
  "startedAt": 1781559354657,
  "completedAt": 1781559355772,
  "cursor": null,
  "windowStart": 1778967354265,
  "windowEnd": 1781559354265,
  "estimatedProgressPct": 100
}
```

---

## Retries a failed action log migration

**POST** `{{LEM_adminURL}}/admin/v1/action-log/migration/retry`

# Retries a failed action log migration

Restarts the action-log migration if it previously failed. Safe to call when the status reports a failure.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/action-log/migration/retry
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

`ApiResponse` (`{ code, message }`).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---

## Returns current action log retention settings and live storage usage

**GET** `{{LEM_adminURL}}/admin/v1/action-log/settings`

# Returns current action log retention settings and live storage usage

Returns the current action-log retention policy together with live storage usage, so you can size retention against disk.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/action-log/settings
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

`ActionLogSettingsResponse` (retention settings + current storage usage).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "retentionPeriod": "30d",
  "retentionMaxDiskSpaceUsageBytes": 10737418240,
  "storage": {
    "usedBytes": 16788,
    "usedHuman": "16.39 KB",
    "limitBytes": 10737418240,
    "limitHuman": "10.00 GB",
    "dataPath": "/var/lib/lem/victorialogs",
    "available": true
  }
}
```

---

## Updates action log retention settings

**PUT** `{{LEM_adminURL}}/admin/v1/action-log/settings`

# Updates action log retention settings

Updates the action-log retention policy (how long action-log records are kept).
## Endpoint

```http
PUT {{LEM_adminURL}}/admin/v1/action-log/settings
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

`ActionLogSettingsRequest` with the new retention settings.
## Response

`ApiResponse` (`{ code, message }`).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "retentionPeriod": "30d",
  "retentionMaxDiskSpaceUsageBytes": 10737418240
}
```

---

## Get API Activity Settings

**GET** `{{LEM_adminURL}}/admin/v1/action-log/settings/api-activity`

> **New in 2.35.**

# Get API Activity Settings

Returns how long the API-activity log (the per-request log behind `Get API Activity Records`) is kept, and how much disk it uses. It is retained separately from the business audit trail, whose settings are under `Returns current action log retention settings and live storage usage`.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/action-log/settings/api-activity
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

| Field | Description |
|---|---|
| `retentionPeriod` | How long records are kept: `Nd`, `Nmo` or `Ny` (e.g. `7d`). |
| `retentionMaxDiskSpaceUsageBytes` | Disk cap in bytes. |
| `storage.usedBytes` / `storage.usedHuman` | Current usage. |
| `storage.limitBytes` / `storage.limitHuman` | Effective cap. |
| `storage.dataPath`, `storage.available` | Where the log store lives and whether it is reachable. |

```json
{
  "retentionPeriod": "7d",
  "retentionMaxDiskSpaceUsageBytes": 5368709120,
  "storage": {
    "usedBytes": 306599,
    "usedHuman": "299.41 KB",
    "limitBytes": 5368709120,
    "limitHuman": "5.00 GB",
    "dataPath": "/var/lib/lem/victorialogs",
    "available": true
  }
}
```

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "retentionPeriod": "7d",
  "retentionMaxDiskSpaceUsageBytes": 5368709120,
  "storage": {
    "usedBytes": 313999,
    "usedHuman": "306.64 KB",
    "limitBytes": 5368709120,
    "limitHuman": "5.00 GB",
    "dataPath": "/var/lib/lem/victorialogs",
    "available": true
  }
}
```

---

## Update API Activity Settings

**PUT** `{{LEM_adminURL}}/admin/v1/action-log/settings/api-activity`

> **New in 2.35.**

# Update API Activity Settings

Sets the retention period and disk cap of the API-activity log.
## Endpoint

```http
PUT {{LEM_adminURL}}/admin/v1/action-log/settings/api-activity
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

| Field | Type | Description |
|---|---|---|
| `retentionPeriod` | string | `Nd`, `Nmo` or `Ny`, e.g. `7d`, `3mo`, `1y`. |
| `retentionMaxDiskSpaceUsageBytes` | integer | Disk cap in bytes. |

```json
{
  "retentionPeriod": "7d",
  "retentionMaxDiskSpaceUsageBytes": 5368709120
}
```

## Response

`ApiResponse` `{ code, message, messageDetails }`.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "retentionPeriod": "30d",
  "retentionMaxDiskSpaceUsageBytes": 10737418240
}
```

---