API audit logging Innovation Release

EDB Postgres® AI Hybrid Manager (HM) can emit structured audit logs for authenticated API requests passing through the ingress gateway. When enabled, every API call that requires authentication produces a JSON log entry providing a detailed record of who accessed what, when, and from where. This functionality is useful for compliance reporting, security incident investigation, and access auditing.

API audit logging is available from HM 2026.4.

What gets audited

HM emits an audit log entry for a request when both these conditions are met:

• The request requires authentication. Anonymous or exempt endpoints are not audited.
• The request targets an API path, such as REST APIs (/api/…), Iceberg catalog APIs, launchpad application APIs, or gRPC service endpoints.

These request types aren't audited:

• Static resources (for example, JavaScript, CSS, images)
• Exempt paths, including /api/ui and /api-docs

Disabling API audit logging

API audit logging is enabled by default. To disable it, set the enable_api_audit setting for the upm-istio-gateway component to "false" during installation.

Use the instructions for your installation type.

Operator installation

Edit your HybridControlPlane custom resource to add or update the enable_api_audit setting under spec.componentsParameters.upm-istio-gateway:

apiVersion: edbpgai.edb.com/v1alpha1
kind: HybridControlPlane
metadata:
  name: edbpgai
spec:
  componentsParameters:
    upm-istio-gateway:
      enable_api_audit: "false"

Apply the updated custom resource:

kubectl apply -f hybridmanager.yaml

Bootstrap installation

Edit your values.yaml by updating the parameters.upm-istio-gateway section to set enable_api_audit to "false":

parameters:
  upm-istio-gateway:
    enable_api_audit: "false"

Run the helm upgrade command to apply the changes:

helm upgrade \
  -n edbpgai-bootstrap \
  --install \
  -f values.yaml \
  edbpgai-bootstrap enterprisedb-edbpgai/edbpgai-bootstrap

Re-enabling API audit logging

To re-enable API audit logging after disabling it, set enable_api_audit to "true" and reapply using the same steps for your installation type.

Querying audit logs

Audit log entries are written to the ingress gateway's standard log output. You can query them using your cluster's log aggregation tool by filtering for the EDB-HM-AUDIT key.

Viewing audit logs in Grafana

Grafana is included in HM's observability stack and queries logs aggregated by Loki. You can access it as a service from the Launchpad in the HM console.

To view audit logs in Grafana:

1. From your user menu in the HM console, select Launchpad.

2. Select Grafana.

3. In Grafana, select Explore from the left side pane.

4. Select the Loki data source.

5. Run a LogQL query to filter audit entries. For example:

   → WrapCopy

   {namespace="istio-system", container="istio-proxy"} |= "EDB-HM-AUDIT" | json

Using kubectl

If you don't have a log aggregation tool available, use this command to stream logs directly from the ingress gateway pod for quick inspection:

kubectl logs -n istio-system -l istio=ingressgateway -c istio-proxy | grep EDB-HM-AUDIT

Log format

Each audit log entry is a JSON object nested under the EDB-HM-AUDIT key. You can use this key to filter audit entries in your log aggregation system, for example, with Loki.

Example log entry:

{
  "EDB-HM-AUDIT": {
    "method": "GET",
    "uri": "/api/v1/projects?page=1",
    "user_id": "usr_abc123",
    "user_name": "alice",
    "key_id": "ak_def456",
    "session_id": "aksid_a3f8c2e1b9d04f67",
    "request_id": "a1b2c3d4-e5f6-7890",
    "user_agent": "curl/7.68.0",
    "ip": "10.0.0.1",
    "status_code": 200
  }
}

Log fields

Each audit log entry contains these fields. Fields with empty or unavailable values are omitted to reduce noise.