Cloud IAM Audit API Key Activity and History
A 3-step recipe with IBM. We can help you get access.
Recipe · 3 steps
Cloud IAM Audit API Key Activity and History
with IBM · Identity & Access Management
Inventory account API keys and retrieve the history and activity of a single key.
- Exchange the auditor's API key for an IAM access token. The audit runs as whichever identity this key belongs to, so it must hold sufficient account privileges to enumerate keys.
- List every API key in the account, oldest first, so the longest-lived credentials — the usual audit finding — surface at the top of the report.
- Pull the target key with its full change history and authentication activity so the reviewer can see the last authentication timestamp, the total authentication count, and every recorded modification to the key.
What you'll need to have ready
- apikey: The API key used to authenticate the audit itself.
- accountId: The IBM Cloud account ID whose API keys are being audited.
- auditApiKeyId: The unique identifier of the API key to inspect in depth.
- keyType: Restrict the inventory to user keys or service ID keys.
For your developer
Arazzo workflow ibm:audit-api-key-activity, 3 operations: createAccessToken → listApiKeys → getApiKey. Specs on APIs.io.