Activity

The datumctl activity command lets you interact with the activity service. The activity service allows you to query for audit logs that are collected for all interactions with the platform.

You can see the full list of commands and CLI options by using the --help flag.

$ datumctl activity --help

This document will guide you through how to query the system using some of the most frequently used commands.

Querying Audit Logs

The datumctl activity query command is available to query the system for audit logs to understand what’s happening within your organization and projects.

Project and Organization Audit Logs

Use the --project and --organization flag to control which context audit logs are retrieved from.

$ datumctl activity query --project datum-cloud
TIMESTAMP             VERB     USER               NAMESPACE   RESOURCE          NAME       STATUS
2026-01-14 09:52:43   create   [e-mail]               auditlogqueries              201
2026-01-14 09:44:09   get      [e-mail]               dnszones                     201
2026-01-14 09:44:29   update   [e-mail]               dnszones          datum.net  201
2026-01-14 09:50:22   delete   [e-mail]               dnszones          datum.net  201

Filtering

The --filter command is available to filter the audit logs returned in the query. The filter option accepts a CEL expression to select which audit logs should be returned.

$ datumctl activity query --project datum-cloud --limit 10 --filter='user.username == "[e-mail]" && objectRef.apiGroup == "networking.datumapis.com"'
TIMESTAMP             VERB   USER               NAMESPACE   RESOURCE   NAME        STATUS
2026-01-14 10:08:33   get    [e-mail]   default     domains    datum.net   200
2026-01-14 10:08:40   get    [e-mail]   default     domains    datum.net   200
2026-01-14 10:08:27   get    [e-mail]   default     domains    datum.net   200
2026-01-14 10:08:40   get    [e-mail]   default     domains    datum.net   200

No more results.

Pagination

The --continue option is available to paginate requests when additional results are available. The CLI will provide the continue option to use for the next page of requests.

$ datumctl activity query --project datum-cloud --limit 10 --filter='user.username == "[e-mail]" && objectRef.apiGroup == "networking.datumapis.com"' --limit 3
TIMESTAMP             VERB   USER               NAMESPACE   RESOURCE   NAME        STATUS
2026-01-14 10:08:33   get    [e-mail]   default     domains    datum.net   200
2026-01-14 10:08:40   get    [e-mail]   default     domains    datum.net   200
2026-01-14 10:19:48   get    [e-mail]   default     domains    datum.net   200

More results available. Use --continue-after '{continue-token}' to get the next page.
Or use --all-pages to fetch all results automatically.

You can also use the --all-pages option to retrieve all pages.

Output

The --output or -o option is available to control the format that’s returned. By default the query command outputs a table with common fields to help you understand the activity. You can also output the results as yaml or json to see the full audit logs that were retrieved by the query.

$ datumctl activity query --project datum-cloud -o yaml
apiVersion: audit.k8s.io/v1
items:
- annotations:
    authorization.k8s.io/decision: allow
    authorization.k8s.io/reason: ""
    platform.miloapis.com/scope.name: datum-cloud
    platform.miloapis.com/scope.type: project
  auditID: 5b842c5a-001f-45c3-97af-d76a4114e9ee
  level: Request
  objectRef:
    apiGroup: networking.datumapis.com
    apiVersion: v1alpha
    name: datum.net
    namespace: default
    resource: domains
  requestReceivedTimestamp: "2026-01-14T16:08:33.274159Z"
  requestURI: /apis/networking.datumapis.com/v1alpha/namespaces/default/domains/datum.net
  responseStatus:
    code: 200
    metadata: {}
  stage: ResponseComplete
  stageTimestamp: "2026-01-14T16:08:33.278787Z"
  user:
    extra:
      iam.miloapis.com/parent-api-group:
      - resourcemanager.miloapis.com
      iam.miloapis.com/parent-name:
      - datum-cloud
      iam.miloapis.com/parent-type:
      - Project
      iam.miloapis.com/registrationApproval:
      - Approved
    groups:
    - system:authenticated
    uid: "328747448287632651"
    username: [e-mail]
  userAgent: axios/1.13.2
  verb: get
  ...
kind: EventList
metadata: {}