SFTP Action Logs

An SFTPActionLog is an audit log for monitoring and troubleshooting operations made to your site through SFTP protocol.

Logs available through this endpoint are retained for 6 months, after which they are automatically discarded. For longer retention, use Files.com SIEM integrations to stream logs in real time to your preferred SIEM, or configure SIEM streaming to a file.

List SFTP Action Logs

Endpoint

GET/sftp_action_logs

Return Object

SftpActionLog[]

Authorization Requirement

Requires either a Site-Wide API key or User API key or session from a User with Site Admin permissions.

Additional Arguments

Example Request

curl https://app.files.com/api/rest/v1/sftp_action_logs.json \
  -H 'X-FilesAPI-Key: YOUR_API_KEY'

Example Response

[
  {
    "timestamp": "2000-01-01T01:00:00Z",
    "remote_ip": "example",
    "server_ip": "example",
    "username": "example",
    "ssh_client_identification": "example",
    "session_uuid": "example",
    "seq_id": 1,
    "auth_method": "example",
    "auth_ciphers": "example",
    "action_type": "example",
    "path": "example",
    "true_path": "example",
    "name": "example",
    "sftp_response_code": "example",
    "sftp_response_message": "example",
    "md5": "example",
    "size": 1,
    "data_length": 1,
    "bytes_transferred": 1,
    "entries_returned": 1,
    "success": true,
    "status": "SUCCESS",
    "duration_ms": 1,
    "created_at": "2000-01-01T01:00:00Z"
  }
]

The SftpActionLog Object

Some of the endpoints above return a SftpActionLog object. The attributes of this object are listed below.

AttributeDescription
timestamp
date-time		Start Time of Action. Deprecrated: Use created_at.
remote_ip
string		IP Address of SFTP Client
server_ip
string		IP Address of SFTP Server
username
string		Username
ssh_client_identification
string		Name of the SFTP Client provided at initial connection
session_uuid
string		Unique ID of the Session
seq_id
int64		SFTP Sequence ID
auth_method
string		Authentication Method
auth_ciphers
string		Authentication Ciphers
action_type
string		Action Type
path
string		Path as sent by the Client (may not match Files.com path due to user root folders for SFTP). This must be slash-delimited, but it must neither start nor end with a slash. Maximum of 5000 characters.
true_path
string		Path on Files.com
name
string		Name of File
sftp_response_code
string		SFTP Response Code Returned to the Client.
sftp_response_message
string		SFTP Response Message Returned to the Client.
md5
string		MD5 Hash of the file. Not always available.
size
int64		Size of File That was Uploaded or Downloaded.
data_length
int64		Data Length in Bytes. Present for actions that transfer data.
bytes_transferred
int64		The number of bytes transferred for uploads and downloads.
entries_returned
int64		Number of entries returned when listing files and folders
success
boolean		Whether SFTP Action was successful.
status
string		SFTP Action status.
Possible values: SUCCESS, FAILURE, PARTIAL_TRANSFER
duration_ms
int64		Duration (in milliseconds)
created_at
date-time		Start Time of Action

Example SftpActionLog Object

{
  "timestamp": "2000-01-01T01:00:00Z",
  "remote_ip": "example",
  "server_ip": "example",
  "username": "example",
  "ssh_client_identification": "example",
  "session_uuid": "example",
  "seq_id": 1,
  "auth_method": "example",
  "auth_ciphers": "example",
  "action_type": "example",
  "path": "example",
  "true_path": "example",
  "name": "example",
  "sftp_response_code": "example",
  "sftp_response_message": "example",
  "md5": "example",
  "size": 1,
  "data_length": 1,
  "bytes_transferred": 1,
  "entries_returned": 1,
  "success": true,
  "status": "SUCCESS",
  "duration_ms": 1,
  "created_at": "2000-01-01T01:00:00Z"
}