> ## Documentation Index > Fetch the complete documentation index at: https://datum-4926dda5-mintlify-style-consistency-1774830500.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Activity # activity.miloapis.com/v1alpha1 Package v1alpha1 contains API Schema definitions for the activity v1alpha1 API group #### AuditLogFacetsQuerySpec AuditLogFacetsQuerySpec defines which facets to retrieve from audit logs. *Appears in:* * [AuditLogFacetsQuery](#auditlogfacetsquery) | Field | Description | Default | Validation | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `timeRange`
*[FacetTimeRange](#facettimerange)* | TimeRange limits the time window for facet aggregation.

If not specified, defaults to the last 7 days. | | | | `filter`
*string* | Filter narrows the audit logs before computing facets using CEL.

This allows you to get facet values for a subset of audit logs.

Available Fields:
verb - API action: get, list, create, update, patch, delete, watch
user.username - who made the request (user or service account)
user.uid - unique user identifier
responseStatus.code - HTTP response code (200, 201, 404, 500, etc.)
objectRef.namespace - target resource namespace
objectRef.resource - resource type (pods, deployments, secrets, configmaps, etc.)
objectRef.apiGroup - API group of the resource
objectRef.name - specific resource name
Operators: ==, !=, \<, >, \<=, >=, &&, \|\|, !, in
String Functions: startsWith(), endsWith(), contains()
Examples:
"verb in \['create', 'update', 'delete']" - Facets for write operations only
"!(verb in \['get', 'list', 'watch'])" - Exclude read-only operations
"!user.username.startsWith('system:')" - Exclude system users
"objectRef.namespace == 'production'" - Facets for production namespace | | | | `facets`
*[FacetSpec](#facetspec) array* | Facets specifies which fields to get distinct values for.

Each facet returns the top N values with counts.

Supported fields:
- verb: API action (get, list, create, update, patch, delete, watch)
- user.username: Actor display names
- user.uid: Unique user identifiers
- responseStatus.code: HTTP response codes
- objectRef.namespace: Namespaces
- objectRef.resource: Resource types
- objectRef.apiGroup: API groups | | | #### AuditLogFacetsQueryStatus AuditLogFacetsQueryStatus contains the facet results. *Appears in:* * [AuditLogFacetsQuery](#auditlogfacetsquery) | Field | Description | Default | Validation | | -------------------------------------------------- | ----------------------------------------------------- | ------- | ---------- | | `facets`
*[FacetResult](#facetresult) array* | Facets contains the results for each requested facet. | | | #### AuditLogQuery AuditLogQuery searches your control plane's audit logs. Use this to investigate incidents, track resource changes, generate compliance reports, or analyze user activity. Results are returned in the Status field, ordered newest-first. Quick Start: apiVersion: activity.miloapis.com/v1alpha1 kind: AuditLogQuery metadata: name: recent-deletions spec: startTime: "now-30d" # last 30 days endTime: "now" filter: "verb == 'delete'" # optional: narrow your search limit: 100 Time Formats: * Relative: "now-30d" (great for dashboards and recurring queries) * Absolute: "2024-01-01T00:00:00Z" (great for historical analysis) *Appears in:* * [AuditLogQueryList](#auditlogquerylist) | Field | Description | Default | Validation | | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ------- | ---------- | | `metadata`
*[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)* | Refer to Kubernetes API documentation for fields of `metadata`. | | | | `spec`
*[AuditLogQuerySpec](#auditlogqueryspec)* | | | | | `status`
*[AuditLogQueryStatus](#auditlogquerystatus)* | | | | #### AuditLogQuerySpec AuditLogQuerySpec defines the search parameters. Required: startTime and endTime define your search window. Optional: filter (narrow results), limit (page size, default 100), continue (pagination). Performance: Smaller time ranges and specific filters perform better. The maximum time window is typically 30 days. If your range is too large, you'll get an error with guidance on splitting your query into smaller chunks. *Appears in:* * [AuditLogQuery](#auditlogquery) | Field | Description | Default | Validation | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `startTime`
*string* | StartTime is the beginning of your search window (inclusive).

Format Options:
- Relative: "now-30d", "now-2h", "now-30m" (units: s, m, h, d, w)
Use for dashboards and recurring queries - they adjust automatically.
- Absolute: "2024-01-01T00:00:00Z" (RFC3339 with timezone)
Use for historical analysis of specific time periods.

Examples:
"now-30d" → 30 days ago
"2024-06-15T14:30:00-05:00" → specific time with timezone offset | | | | `endTime`
*string* | EndTime is the end of your search window (exclusive).

Uses the same formats as StartTime. Commonly "now" for current moment.

Must be greater than StartTime.

Examples:
"now" → current time
"2024-01-02T00:00:00Z" → specific end point | | | | `filter`
*string* | Filter narrows results using CEL (Common Expression Language). Leave empty to get all events.

Available Fields:
verb - API action: get, list, create, update, patch, delete, watch
auditID - unique event identifier
requestReceivedTimestamp - when the API server received the request (RFC3339 timestamp)
user.username - who made the request (user or service account)
user.uid - unique user identifier (stable across username changes)
responseStatus.code - HTTP response code (200, 201, 404, 500, etc.)
objectRef.namespace - target resource namespace
objectRef.resource - resource type (pods, deployments, secrets, configmaps, etc.)
objectRef.name - specific resource name
Operators: ==, !=, \<, >, \<=, >=, &&, \|\|, !, in
String Functions: startsWith(), endsWith(), contains()
Common Patterns:
"verb == 'delete'" - All deletions
"objectRef.namespace == 'production'" - Activity in production namespace
"verb in \['create', 'update', 'delete', 'patch']" - All write operations
"!(verb in \['get', 'list', 'watch'])" - Exclude read-only operations
"responseStatus.code >= 400" - Failed requests
"user.username.startsWith('system:serviceaccount:')" - Service account activity
"!user.username.startsWith('system:')" - Exclude system users
"user.uid == '550e8400-e29b-41d4-a716-446655440000'" - Specific user by UID
"objectRef.resource == 'secrets'" - Secret access
"verb == 'delete' && objectRef.namespace == 'production'" - Production deletions
Note: Use single quotes for strings. Field names are case-sensitive.

CEL reference: [https://cel.dev](https://cel.dev) | | | | `limit`
*integer* | Limit sets the maximum number of results per page.

Default: 100, Maximum: 1000.

Use smaller values (10-50) for exploration, larger (500-1000) for data collection.

Use continue to fetch additional pages. | | | | `continue`
*string* | Continue is the pagination cursor for fetching additional pages.

Leave empty for the first page. If status.continue is non-empty after a query,
copy that value here in a new query with identical parameters to get the next page.

Repeat until status.continue is empty.

Important: Keep all other parameters (startTime, endTime, filter, limit) identical
across paginated requests. The cursor is opaque - copy it exactly without modification. | | | #### AuditLogQueryStatus AuditLogQueryStatus contains the query results and pagination state. *Appears in:* * [AuditLogQuery](#auditlogquery) | Field | Description | Default | Validation | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | ---------- | | `results`
*Event array* | Results contains matching audit events, sorted newest-first.

Each event follows the Kubernetes audit.Event format with fields like:
verb, user.username, objectRef.\{namespace,resource,name}, requestReceivedTimestamp,
stageTimestamp, responseStatus.code, requestObject, responseObject
Empty results? Try broadening your filter or time range.

Full documentation: [https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/](https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/) | | | | `continue`
*string* | Continue is the pagination cursor.

Non-empty means more results are available - copy this to spec.continue for the next page.

Empty means you have all results. | | | | `effectiveStartTime`
*string* | EffectiveStartTime is the actual start time used for this query (RFC3339 format).

When you use relative times like "now-7d", this shows the exact timestamp that was
calculated. Useful for understanding exactly what time range was queried, especially
for auditing, debugging, or recreating queries with absolute timestamps.

Example: If you query with startTime="now-7d" at 2025-12-17T12:00:00Z,
this will be "2025-12-10T12:00:00Z". | | | | `effectiveEndTime`
*string* | EffectiveEndTime is the actual end time used for this query (RFC3339 format).

When you use relative times like "now", this shows the exact timestamp that was
calculated. Useful for understanding exactly what time range was queried.

Example: If you query with endTime="now" at 2025-12-17T12:00:00Z,
this will be "2025-12-17T12:00:00Z". | | | #### FacetResult FacetResult contains the distinct values for a single facet. *Appears in:* * [AuditLogFacetsQueryStatus](#auditlogfacetsquerystatus) | Field | Description | Default | Validation | | ------------------------------------------------ | ----------------------------------------------------- | ------- | ---------- | | `field`
*string* | Field is the field path that was queried. | | | | `values`
*[FacetValue](#facetvalue) array* | Values contains the distinct values and their counts. | | | #### FacetSpec FacetSpec defines a single facet to retrieve. *Appears in:* * [AuditLogFacetsQuerySpec](#auditlogfacetsqueryspec) | Field | Description | Default | Validation | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `field`
*string* | Field is the activity field path to get distinct values for.

Supported fields:
- spec.actor.name: Actor display names
- spec.actor.type: Actor types (user, serviceaccount, controller)
- spec.resource.apiGroup: API groups
- spec.resource.kind: Resource kinds
- spec.resource.namespace: Namespaces
- spec.changeSource: Change sources (human, system) | | | | `limit`
*integer* | Limit is the maximum number of distinct values to return.

Default: 20, Maximum: 100. | | | #### FacetTimeRange FacetTimeRange specifies the time window for facet queries. *Appears in:* * [AuditLogFacetsQuerySpec](#auditlogfacetsqueryspec) | Field | Description | Default | Validation | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ------- | ---------- | | `start`
*string* | Start is the beginning of the time window (inclusive).

Supports RFC3339 timestamps and relative times (e.g., "now-7d"). | | | | `end`
*string* | End is the end of the time window (exclusive).

Supports RFC3339 timestamps and relative times. Defaults to "now". | | | #### FacetValue FacetValue represents a single distinct value with its occurrence count. *Appears in:* * [FacetResult](#facetresult) | Field | Description | Default | Validation | | ----------------------- | -------------------------------------------------- | ------- | ---------- | | `value`
*string* | Value is the distinct field value. | | | | `count`
*integer* | Count is the number of activities with this value. | | |