Litmus Edge Manager 3.0.x - Admin Console: Logs

Get Logs (Paginated) [DEPRECATED]

GET {{LEM_adminURL}}/admin/v1/logs

DEPRECATED since 2.35. Use GET /admin/v1/logs/v2 (Logs > Get Audit Records).

Updated in 3.0. New optional query parameters: action, module, origin.

Get Logs (Paginated)

Returns the paginated audit log. Still served on 3.0, with the same filters as before; new integrations should use Get Audit Records (GET /logs/v2), which adds categories, free-text, username and source-IP filters.

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

companyName, projectId, from, to, context, contextId, level, action, origin, module, filter, order, requestedPage, limit (default 10). Same meaning as in Get Audit Records, but context takes a single value.

Response

Paged { pageNum, pagesCount, size, totalSize, elements: [ActionLogRecord] }.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "pageNum": 0,
    "pagesCount": 166,
    "size": 1,
    "totalSize": 166,
    "elements": [
        {
            "companyName": "",
            "projectId": null,
            "eventTime": 1767978201000,
            "level": "INFO",
            "username": "tokenname=postman;tokenhash=14d5816014a6b7e3dc21a71f51360b66",
            "context": "",
            "contextId": "",
            "contextDescription": null,
            "message": "generic messaeg",
            "accessLevel": "USER",
            "realCompanyName": null,
            "projectName": null
        }
    ]
}

Get Log Contexts [DEPRECATED]

GET {{LEM_adminURL}}/admin/v1/logs/contexts

DEPRECATED since 2.35. Use GET /admin/v1/logs/v2/categories (Logs > Get Audit Categories).

Get Log Contexts

Returns the flat list of context codes an audit record can carry. Still served on 3.0; use Get Audit Categories (GET /logs/v2/categories), which groups the same contexts under the 12 audit categories.

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs/contexts

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

An array of { code, description }, e.g. { "code": "activation", "description": "Edge device activation" }.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[
    {
        "code": "activation",
        "description": "Edge device activation"
    },
    {
        "code": "async-subtask",
        "description": "Async subtask"
    },
    {
        "code": "batch-dm",
        "description": "Batch edge device management"
    },
    {
        "code": "company",
        "description": "Company"
    },
    {
        "code": "deactivation",
        "description": "Edge device deactivation"
    },
    {
        "code": "device",
        "description": "Edge device"
    },
    {
        "code": "device-analytics",
        "description": "Edge device analytics"
    },
    {
        "code": "device-certificate",
        "description": "Edge device certificate"
    },
    {
        "code": "device-license-pool",
        "description": "Edge device license pool"
    },
    {
        "code": "edge-ca-certificate-update",
        "description": "Edge device CA certificate update"
    },
    {
        "code": "files",
        "description": "Files"
    },
    {
        "code": "grafana",
        "description": "Grafana"
    },
    {
        "code": "gcp-sa-keys-rotation",
        "description": "GCP SA keys rotation"
    },
    {
        "code": "license-generation",
        "description": "Edge license generation"
    },
    {
        "code": "license-provisioning",
        "description": "Edge license provisioning"
    },
    {
        "code": "mpcs",
        "description": "MPCS"
    },
    {
        "code": "mqtt-dm-account",
        "description": "MQTT DM account"
    },
    {
        "code": "mqtt-account",
        "description": "MQTT account"
    },
    {
        "code": "project",
        "description": "Project"
    },
    {
        "code": "grant",
        "description": "Project grant permissions"
    },
    {
        "code": "revoke",
        "description": "Project revoke permissions"
    },
    {
        "code": "report-stats",
        "description": "Report stats"
    },
    {
        "code": "ssl-certificate",
        "description": "SSL certificate"
    },
    {
        "code": "team",
        "description": "Team"
    },
    {
        "code": "team-member",
        "description": "Team member"
    },
    {
        "code": "digital-twins",
        "description": "Digital Twins"
    },
    {
        "code": "audit",
        "description": "Audit"
    },
    {
        "code": "git-sync",
        "description": "Git synchronization"
    }
]

Get Audit Records

GET {{LEM_adminURL}}/admin/v1/logs/v2?requestedPage=0&limit=1

New in 2.35.

Get Audit Records

Returns audit records across the whole installation, newest first by default. This is the v2 audit trail: every record carries a category (one of 12 functional areas) on top of the older context, plus the action, origin, module, source IP and a details object. Replaces Get Logs (Paginated).

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs/v2

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

Paged { pageNum, pagesCount, size, totalSize, elements: [ActionLogRecordEx] }. Each record:

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
  "pageNum": 0,
  "pagesCount": 297,
  "size": 1,
  "totalSize": 297,
  "elements": [
    {
      "companyName": "test",
      "projectId": null,
      "eventTime": 1791917896390,
      "level": "INFO",
      "username": "token=ps",
      "context": "audit-report",
      "contextId": null,
      "contextDescription": null,
      "message": "Report Exported: Audit report (106 rows) was exported by 'token=ps'.",
      "accessLevel": "ADMIN",
      "details": {
        "format": "csv",
        "exportedRows": 106,
        "totalMatched": 106,
        "filters": {
          "companyName": "test"
        }
      },
      "action": "EXECUTE",
      "origin": "API_TOKEN",
      "module": "API",
      "sourceIp": "10.17.4.128",
      "errorCode": null,
      "subtaskId": null,
      "category": "SYSTEM",
      "realCompanyName": "test",
      "projectName": null,
      "categoryLabel": "System"
    }
  ]
}

Get Audit Categories

GET {{LEM_adminURL}}/admin/v1/logs/v2/categories

New in 2.35.

Get Audit Categories

Returns the 12 audit categories and the context codes in each. Use it to build a category / context filter for Get Audit Records. Replaces Get Log Contexts, which returns the flat context list without categories.

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs/v2/categories

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

An array of { code, name, contexts: [{ code, description }] }.

[
  {
    "code": "USER_MANAGEMENT",
    "name": "User Management",
    "contexts": [
      { "code": "company", "description": "Company" },
      { "code": "edge-oauth-client", "description": "Edge device OAuth client" },
      { "code": "api-token", "description": "API token" }
    ]
  }
]

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

[
  {
    "code": "USER_MANAGEMENT",
    "name": "User Management",
    "contexts": [
      {
        "code": "company",
        "description": "Company"
      },
      {
        "code": "edge-oauth-client",
        "description": "Edge device OAuth client"
      },
      {
        "code": "mqtt-dm-account",
        "description": "MQTT DM account"
      },
      {
        "code": "mqtt-account",
        "description": "MQTT account"
      },
      {
        "code": "project",
        "description": "Project"
      },
      {
        "code": "grant",
        "description": "Project grant permissions"
      },
      {
        "code": "revoke",
        "description": "Project revoke permissions"
      },
      {
        "code": "team",
        "description": "Team"
      },
      {
        "code": "team-member",
        "description": "Team member"
      },
      {
        "code": "audit",
        "description": "Audit"
      },
      {
        "code": "api-token",
        "description": "API token"
      },
      {
        "code": "user-password",
        "description": "User password"
      },
      {
        "code": "role",
        "description": "Role"
      },
      {
        "code": "user",
        "description": "User"
      },
      {
        "code": "oidc-config",
        "description": "OIDC configuration"
      },
      {
        "code": "identity-provider",
        "description": "Identity provider"
      }
    ]
  },
  {
    "code": "DEVICE_LIFECYCLE",
    "name": "Device Lifecycle",
    "contexts": [
      {
        "code": "activation",
        "description": "Edge device activation"
      },
      {
        "code": "batch-dm",
        "description": "Batch edge device management"
      },
      {
        "code": "deactivation",
        "description": "Edge device deactivation"
      },
      {
        "code": "device",
        "description": "Edge device"
      },
      {
        "code": "device-connectivity",
        "description": "Edge device connectivity"
      },
      {
        "code": "device-ha",
        "description": "Edge device high availability"
      }
    ]
  },
  {
    "code": "APPLICATIONS",
    "name": "Applications",
    "contexts": [
      {
        "code": "device-service",
        "description": "Edge device system service"
      },
      {
        "code": "grafana",
        "description": "Grafana"
      },
      {
        "code": "marketplace-application",
        "description": "Marketplace application"
      },
      {
        "code": "mpcs",
        "description": "MPCS"
      },
      {
        "code": "template-applied",
        "description": "Template applied"
      },
      {
        "code": "template-updated",
        "description": "Template updated"
      },
      {
        "code": "template-parameterized",
        "description": "Template parameterized"
      },
      {
        "code": "template-variable-mapping-updated",
        "description": "Template variable mapping updated"
      }
    ]
  },
  {
    "code": "SOFTWARE_UPDATES",
    "name": "Software Updates",
    "contexts": [
      {
        "code": "le-upgrade",
        "description": "LE firmware upgrade"
      },
      {
        "code": "lem-upgrade",
        "description": "LEM self-upgrade"
      }
    ]
  },
  {
    "code": "DATA_PIPELINE",
    "name": "Data Pipeline",
    "contexts": [
      {
        "code": "device-analytics",
        "description": "Edge device analytics"
      },
      {
        "code": "device-log-forwarding",
        "description": "Edge device log forwarding"
      },
      {
        "code": "git-sync",
        "description": "Git synchronization"
      },
      {
        "code": "integration",
        "description": "Data pipeline integration configuration"
      },
      {
        "code": "device-events-forwarding",
        "description": "Edge device events forwarding"
      },
      {
        "code": "instance-data-export",
        "description": "Instance configuration export"
      },
      {
        "code": "instance-data-import",
        "description": "Instance configuration import"
      },
      {
        "code": "database-dump-download",
        "description": "Database dump download (sensitive-filtered)"
      },
      {
        "code": "registry-image",
        "description": "Docker registry image"
      },
      {
        "code": "registry-config",
        "description": "Docker registry configuration"
      },
      {
        "code": "data-lifecycle-policy",
        "description": "Data lifecycle (retention/purge) policy"
      },
      {
        "code": "audit-forwarding",
        "description": "Audit log forwarding to remote syslog"
      }
    ]
  },
  {
    "code": "ASSET_MANAGEMENT",
    "name": "Asset Management",
    "contexts": [
      {
        "code": "asset-hierarchy",
        "description": "Industrial Asset Hierarchy"
      },
      {
        "code": "digital-twins",
        "description": "Digital Twins"
      }
    ]
  }
]

Export Audit Records

GET {{LEM_adminURL}}/admin/v1/logs/v2/export

New in 2.35.

Export Audit Records

Downloads the audit records matching the filters as a CSV or PDF file. The export itself is recorded in the audit trail (context audit-report).

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs/v2/export

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

200 OK with the file as an attachment, e.g. Content-Type: text/csv and Content-Disposition: attachment; filename="audit-report-20261013-184009.csv". The CSV columns are:

"Date & Time","Severity","Category","Sub-Category","User","Action","Origin","Source IP","Description","Outcome","Error Code","Module","Reason","Changes"

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

"Date & Time","Severity","Category","Sub-Category","User","Action","Origin","Source IP","Description","Outcome","Error Code","Module","Reason","Changes"

Get API Activity Records

GET {{LEM_adminURL}}/admin/v1/logs/v2/api-activity?requestedPage=0&limit=1

New in 2.35.

Get API Activity Records

Returns the API-activity log: one record per API request (method, URI, route, status, duration), kept apart from the business audit trail in Get Audit Records. Useful to see what an integration or API token has been calling.

Endpoint

GET {{LEM_adminURL}}/admin/v1/logs/v2/api-activity

Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

Response

Paged { pageNum, pagesCount, size, totalSize, elements }. Each element has context: "api-activity" and the request in details:

{
  "eventTime": 1791916790500,
  "level": "INFO",
  "username": "token=ps",
  "context": "api-activity",
  "message": "GET /logs -> 200",
  "details": { "method": "GET", "uri": "/admin/v1/logs", "route": "/logs", "status": 200, "durationMs": 35 },
  "action": "EXECUTE",
  "origin": "API_TOKEN",
  "module": "ADMIN",
  "category": "SYSTEM"
}

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
  "pageNum": 0,
  "pagesCount": 14781,
  "size": 1,
  "totalSize": 14781,
  "elements": [
    {
      "companyName": null,
      "projectId": null,
      "eventTime": 1791917896507,
      "level": "INFO",
      "username": "token=ps",
      "context": "api-activity",
      "contextId": null,
      "contextDescription": null,
      "message": "GET /project/platform-rule -> 200",
      "accessLevel": "ADMIN",
      "details": {
        "method": "GET",
        "uri": "/api/v1/project/platform-rule?projectId=c8con68kzh7hwgmc32raesiaw",
        "route": "/project/platform-rule",
        "status": 200,
        "durationMs": 44
      },
      "action": "EXECUTE",
      "origin": "API_TOKEN",
      "module": "API",
      "sourceIp": "10.17.4.128",
      "errorCode": null,
      "subtaskId": null,
      "category": "SYSTEM",
      "categoryLabel": "System"
    }
  ]
}