Auth Logs API¶

Query authentication history — every accept/reject FreeRADIUS recorded in radpostauth. One endpoint, under /api/v1.

Method	Path	Scope
`GET`	`/auth-logs`	`auth_logs.read`

Query authentication history¶

GET /auth-logs returns the most recent authentication attempts first. Two query parameters:

Parameter	Default	Range	Purpose
`username`	—		Restrict to one user
`limit`	`100`	1–1000	How many rows to return

curl -H "X-API-Key: $KEY" \
     "https://your-host/api/v1/auth-logs?username=alice&limit=50"

{
  "auth_logs": [
    {
      "id": 90233,
      "username": "alice",
      "reply": "Access-Accept",
      "authdate": "2026-07-20T09:41:02Z",
      "nasipaddress": "10.0.0.1"
    }
  ],
  "count": 1
}

reply — the RADIUS outcome, typically Access-Accept or Access-Reject.
nasipaddress — which NAS sent the request, or null if it wasn't recorded.

This is a bounded list with a count, not a page envelope — raise limit (up to 1000) to pull more, and filter by username to narrow it.

Reads, not writes

Auth logs are a history you read; there's no write endpoint. To act on a failing login, look at the user or their session.

Logs (UI) — auth logs with geo-location and filters
Sessions & CoA — the sessions these accepts led to

Auth Logs API¶

Query authentication history¶

Related¶