API Audit

[TroyV]

I have been looking but I can't seem to find a way to audit what API keys have been setup for my users and what they are accessing. Does anyone know of a way to audit active API keys for all users in your organization?

[ShawnHu]

@TroyV Since the API key is part of the administrator profile and the access permission is based on what privilege the administrator is assigned with in a specific organization. For audit purposes, there are two endpoints you can leverage.

getOrganizationApiRequestsOverview  and getOrganizationApiRequests 

You can use the adminId from the latter endpoint linking to a specific user(with the getOrganizationAdmins endpoint). Here is a request example from getOrganizationApiRequests.

{ "adminId": "212406", "method": "GET", "host": "server.example.com", "path": "/api/v1/organizations/12345/apiRequests", "queryString": "timespan=604800", "userAgent": "PostmanRuntime/7.6.0", "ts": "2018-02-11T00:00:00.090210Z", "responseCode": 200, "sourceIp": "123.123.123.1", "version": 1, "operationId": "getOrganizationApiRequests" }

[sungod]

You can use https://developer.cisco.com/meraki/api-v1/#!get-organization-admins to identify admins and detect which have API key(s).

Then as above get the requests and see which admin(s) are using the API.