Secret store audit

The secret store provides auditing functionality to track and analyze user activities. Audit logs help you identify potential security issues and ensure compliance with organizational policies.

As a global admin you can access secret store audit logs to track and analyze user activity. This is essential for identifying potential security issues and ensuring compliance with organizational policies.

Audit logs are retained for 60 days and do not contain sensitive information, such as passwords or access tokens.

Retrieve audit logs

You can retrieve secret store audit logs through the events service endpoint of the Knime REST API.

Prerequisites

Before you begin, ensure that you have global admin permissions.

Steps

1. Log into your Knime instance as a global admin.
2. Open the events service OpenAPI documentation at https://api.<base-url>/api-doc/?service=events.
3. Find the GET /events/adhoc/{resource} endpoint, expand it, and click Try it out.
4. Set the resource parameter to audit-secret-store.
5. Leave the remaining parameters empty, or adjust them to your scenario, for example to retrieve all audit logs from the last 24 hours.
6. Click Execute to retrieve the matching audit log entries.

To view only the events for a particular secret, add a filter parameter alongside the time range, for example:

{ "itemId": "secret:106841c6-3567-4865-9cd2-7390dc9f4d3c" }

Audit log contents

Each audit log entry contains structured information about an action that occurred in the secret store:

• Action type: Describes what happened to the item, for example, added, updated, consumed, or removed.
• Event identifiers: Correlation ID Groups related events into a single flow. Event ID Unique identifier of the individual event.
• Event initiator: Identifies who triggered the event, including their username and account ID.
• Item details: Provides information about the affected item, including:
  • Unique item ID
  • Item type (e.g., secret, workflow)
  • Subject information such as name, schema, or configuration
• Scope information: Defines the organizational context in which the item resides, such as the team or workspace name and the scope account ID.
• Format version: Internal version number of the audit log format.
• Timestamp: Records when the event occurred.
• Job details (only included if the event originates from a job on your Knime instance): Contains metadata about the executed job, including:
  • Job ID and name
  • Scope and environment
  • Deployment type
  • Workflow reference (Hub ID, path, version)
  • Job initiator details (name and account ID)

Example audit log entries

The following JSON example shows audit log entries for creating, editing, consuming, and deleting a secret:

[
  {
    "action": "added",
    "correlationId": "c5bd2e2e-c831-437a-be41-ef171919b923:01",
    "eventId": "1aeeebf0-9dd5-4eca-be43-db996db55c1b",
    "eventInitiator": "knimeadmin",
    "eventInitiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
    "formatVersion": 1,
    "itemId": "secret:bd071853-bfcc-47de-8779-e22ed2cf99df",
    "itemType": "secret",
    "scope": "Initial Team",
    "scopeAccountId": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
    "subject": {
      "config": {
        "username": "sdasad"
      },
      "configSchema": "credentials",
      "name": "mysecret"
    },
    "timestamp": "2025-09-04T13:26:07.708Z"
  },
  {
    "action": "updated",
    "correlationId": "ef07e583-a507-4eaf-b15c-e4bd6c254df6:01",
    "eventId": "8e48231c-5654-495c-b739-eb50cf9d09f4",
    "eventInitiator": "knimeadmin",
    "eventInitiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
    "formatVersion": 1,
    "itemId": "secret:bd071853-bfcc-47de-8779-e22ed2cf99df",
    "itemType": "secret",
    "scope": "Initial Team",
    "scopeAccountId": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
    "subject": {
      "config": {
        "username": "sdasad"
      },
      "configSchema": "credentials",
      "name": "mysecret"
    },
    "timestamp": "2025-09-04T13:27:11.401Z"
  },
  {
    "action": "consumed",
    "correlationId": "99c3a5d7-936e-4f2b-a349-7f3606860a58:01",
    "eventId": "831dc182-7ba0-4602-a40a-87244b38930a",
    "eventInitiator": "knimeadmin",
    "eventInitiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
    "formatVersion": 1,
    "itemId": "secret:bd071853-bfcc-47de-8779-e22ed2cf99df",
    "itemType": "secret",
    "scope": "Initial Team",
    "scopeAccountId": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
    "subject": {
      "config": {
        "username": "sdasad"
      },
      "configSchema": "credentials",
      "name": "mysecret"
    },
    "timestamp": "2025-09-04T13:43:09.029305015Z"
  },
  {
    "action": "consumed",
    "correlationId": "e5087688-9f18-4643-8ef3-45de6064a2e2:02",
    "eventId": "ea3a6d56-dcbb-4ae4-8e58-224c12414a32",
    "eventInitiator": "knimeadmin",
    "eventInitiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
    "formatVersion": 1,
    "itemId": "secret:bd071853-bfcc-47de-8779-e22ed2cf99df",
    "itemType": "secret",
    "job": {
      "executionContextId": "2319a554-81d7-47a9-82a9-846cbb0fcbd8",
      "id": "80a42d53-bd32-4ca1-beb6-4e849df248da",
      "initiator": "knimeadmin",
      "initiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
      "name": "SecretConsumeTest 2025-09-04 13.43.38",
      "scope": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
      "workflow": "/Users/Initial Team/Initial Space/SecretConsumeTest",
      "workflowId": "*d3Xjp31o9gbSjjBw"
    },
    "scope": "Initial Team",
    "scopeAccountId": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
    "subject": {
      "config": {
        "username": "sdasad"
      },
      "configSchema": "credentials",
      "name": "mysecret"
    },
    "timestamp": "2025-09-04T13:43:51.778383302Z"
  },
  {
    "action": "removed",
    "correlationId": "a1c1c21a-24b7-494b-a57b-8680d747eb50:01",
    "eventId": "e448132e-3956-49bd-b813-a39abe1b9893",
    "eventInitiator": "knimeadmin",
    "eventInitiatorAccountId": "account:user:618a54bf-894a-45c4-84a4-2105e78c68dc",
    "formatVersion": 1,
    "itemId": "secret:bd071853-bfcc-47de-8779-e22ed2cf99df",
    "itemType": "secret",
    "scope": "Initial Team",
    "scopeAccountId": "account:team:02a80269-dc98-47f6-8b57-024df090a472",
    "subject": {
      "configSchema": "credentials",
      "name": "mysecret"
    },
    "timestamp": "2025-09-04T13:46:34.090026679Z"
  }
]