1. Docs
  2. API Reference
  3. Create or replace a saved audit-log view

Create or replace a saved audit-log view

POST/portal/v1/me/audit-views

Creates or replaces a saved audit-log view for the calling admin, keyed on (name, surface) — re-posting the same name and surface overwrites the prior entry, while the same name may coexist across the two surfaces. filters is validated as a strict AuditQueryDto so a stored view can always be replayed by the query endpoint. Enforces a per-admin cap of 20 views summed across both surfaces; exceeding it returns 400 (audit.view_limit_exceeded). Returns 201 with the stored view.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Request body

application/json

namestring Required

Display label for the chip. Trimmed; allowed characters: letters, numbers, spaces, hyphens, underscores. 1–60 chars.

max length 60

surfaceenum Required

Audit-log surface the view belongs to. Uniqueness is per-`(name, surface)` so a 'Last 24h' chip can live on both tabs.

one of "admin" · "identities"

filtersobject Required

Filter set snapshot — same shape as the query endpoint.

Responses

application/json

  • dataAuditViewResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Returned object

AuditViewResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/me/audit-views" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string",
    "surface": "admin",
    "filters": {
      "from": "2026-04-20T12:00:00.000Z",
      "to": "2026-04-20T12:00:00.000Z",
      "action": [
        "string"
      ],
      "category": "auth",
      "severity": "info",
      "outcome": "success",
      "actor_id": "00000000-0000-0000-0000-000000000000",
      "actor_type": "string",
      "resource_type": "string",
      "resource_id": "00000000-0000-0000-0000-000000000000",
      "correlation_id": "00000000-0000-0000-0000-000000000000",
      "application_id": "00000000-0000-0000-0000-000000000000",
      "environment_id": "00000000-0000-0000-0000-000000000000",
      "q": "string",
      "cursor": "string",
      "limit": 50
    }
  }'
Response
{
  "data": {
    "name": "string",
    "surface": "admin",
    "filters": {}
  }
}
 Related endpoints
GETList saved audit-log views for the current admin
DELETEDelete a saved audit-log view
 Was this page helpful?

Tell us how we can improve this guide.

Canopy