--- title: API audit logging description: PingFederate provides API endpoints and management services on the administrative port (9999) and the runtime port (9031) that are logged for auditing purposes. component: pingfederate version: 13.1 page_id: pingfederate:administrators_reference_guide:pf_api_audit_logging canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_api_audit_logging.html llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: July 5, 2022 page_aliases: ["pf_audit_loggin.adoc"] section_ids: administrative-api-audit-log: Administrative API audit log runtime-apis-audit-log: Runtime APIs audit log --- # API audit logging PingFederate provides API endpoints and management services on the administrative port (9999) and the runtime port (9031) that are logged for auditing purposes. Actions performed through these endpoints are logged for auditing purposes, as described in the following table. | API | Port | Log File | | ------------------------------------- | ------------------- | ----------------- | | Administrative API | Administrative Port | `admin-api.log` | | OAuth Client Management Service | Runtime Port | `runtime-api.log` | | OAuth Access Grant Management Service | Runtime Port | `runtime-api.log` | | Session Revocation API | Runtime Port | `runtime-api.log` | ## Administrative API audit log PingFederate records actions performed through the administrative API in the `/pingfederate/log/admin-api.log` file. Although the events are not configurable, you can adjust the Log4j 2 configuration settings in the `/pingfederate/server/default/conf/log4j2.xml` file to deliver the desired level of detail surrounding each event. Each log entry contains information relating to the event, including: * Time the event occurred on the PingFederate server * Administrator username performing the action * Authentication method * Client IP * HTTP method * REST endpoint * HTTP status code * jti (JWT ID) | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The `jti` is the ID of the outbound JSON Web Token (JWT) request. This information is applicable when the PingFederate administrative API authentication scheme is OAuth2 and the client authentication method is *private\_key\_jwt*. | * The hash of the inbound access token | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The hash logging is applicable when the PingFederate administrative API authentication scheme is OAuth2. To calculate the hash value for a token or authorization code, run the `calculatehash.sh/bat` script in the PingFederate `bin` folder. | | | | | - | ------------------------------------------------------------------------------------------------------------------- | | | This feature should only be enabled in production environments when actively troubleshooting authentication issues. | * HTTP request header * TLS version | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The `/pingfederate/log/admin-api.log` does not include the HTTP request header and TLS version values by default. You can customize this log to include additional or less information by modifying the pattern elements in the `log4j2.xml` file. Learn more in [Log4j 2 logging service and configuration](pf_log4j_2_loggin_service_and_config.html). | Each of these fields is separated by a vertical pipe (`|`) for ease of parsing. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | PingFederate also records actions performed through the administrative API in the `/pingfederate/log/admin.log` file. Learn more in [Administrator audit logging](pf_admin_audit_loggin.html). | ## Runtime APIs audit log PingFederate records actions performed through the OAuth Client Management Service, the OAuth Access Grant Management Service, and the Session Revocation API in the `/pingfederate/log/runtime-api.log` file. Although the events are not configurable, you can adjust the Log4j 2 configuration settings in the `/pingfederate/server/default/conf/log4j2.xml` file to deliver the desired level of detail surrounding each event. Each log entry contains information relating to the event, including: * Time the event occurred on the PingFederate server * Administrator username performing the action * Authentication method * Client IP * HTTP method * REST endpoint * HTTP status code * HTTP request header * TLS version | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The `/pingfederate/log/runtime-api.log` doesn't include the HTTP request header and TLS version values by default. You can customize this log to include additional or less information by modifying the pattern elements in the `log4j2.xml` file. Learn more in [Log4j 2 logging service and configuration](pf_log4j_2_loggin_service_and_config.html). | Each of these fields is separated by a vertical pipe (`|`) for ease of parsing.