Skip to content
downpipes docs

Pull the downpipes audit trail into Logpoint

Logpoint collects the downpipes audit trail by polling, not by receiving a push. You configure Logpoint’s Universal REST API Fetcher to poll the audit feed at /support/audit-feed with a bearer token, advancing by sequence number so it resumes without gaps or duplicates. Logpoint’s fetcher reads the JSON directly, so there is no separate parser to build on its side.

Because this is a pull, the Cloudflare Access perimeter matters here in a way it does not for a push. If Access fronts your console hostname, it turns the fetcher’s poll away before the engine answers, returning an HTML login redirect where JSON was expected. The credential mint, the Access exemption and the continuity checks are on Wiring the audit feed into your SIEM; this page is the downpipes + Logpoint setup.

A generic NDJSON push over HTTPS is also possible if you would rather the engine dial out, but the REST API Fetcher is the clean path because it needs no stored secret on the downpipes side.

One thing to expect in the console, so you are not hunting for a control that is not there: the Logpoint tile on the Integrations screen opens the NDJSON push, because that is the path the console itself configures. The REST API Fetcher path is set up from Logpoint’s side, and the only thing it needs from the console is an audit-feed credential, minted where the audit feed page describes. So if you are following the pull path, the tile is not where you start. Changing the push, if you take that path instead, is owner-only and asks for a fresh step-up sign-in like every other push change.

What you need

  • A Logpoint role that can add and configure a Universal REST API Fetcher.
  • An Owner in the downpipes console to mint an audit-feed credential, plus (if Cloudflare Access fronts your console hostname) an Access service token or a narrow path exemption for the fetcher.

Set it up

  1. As an Owner in the downpipes console, mint an audit-feed credential. It is shown once, stored as a hash, and revocable at any time. The exact screen and the Cloudflare Access handling are on the audit feed page.
  2. In Logpoint, add a Universal REST API Fetcher pointed at https://<your-console-host>/support/audit-feed, and set the credential as the bearer, sent as the Authorization header value Bearer <secret>.
  3. Configure the fetcher to page by the afterSeq query parameter and to persist nextAfterSeq from each response as the next cursor. Batches are bounded by limit, which clamps to 1000.
  4. If Cloudflare Access fronts your console hostname, give the fetcher an Access service token (the two CF-Access-* headers) or a narrow Bypass on the feed path, as described on the audit feed page. Without one, the poll gets an HTML redirect rather than JSON.
  5. Run one fetch and confirm events arrive in ascending seq order. Logpoint then polls on its own schedule.

What each poll returns

The fetcher sends a bearer and a cursor:

GET /support/audit-feed?afterSeq=4096&limit=500 HTTP/1.1
Host: console.example.com
Authorization: Bearer dpc_AbCdEfGhI.dps_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The response carries the batch and the chain head as { "kind": "downpipe-audit-feed", "afterSeq": ..., "nextAfterSeq": ..., "headSeq": ..., "headHash": ..., "count": ..., "events": [ ... ] }. Each event holds seq, actorEmail, sourceIp, action, outcome, target, prevHash and hash. The full field meanings and the continuity checks are on the audit feed page.

Good to know

  • The cursor is a sequence number, not a timestamp. Persist nextAfterSeq after each batch and send it as the next afterSeq; sequences are gap-free and monotonic, so a restart resumes exactly where it stopped. When count is zero you are caught up and the cursor does not move.
  • The feed carries operator identity (member emails, source IPs, roles and approver emails) and no backup data or secret values, so apply your Logpoint data-handling rules to it as you would any access log. For the credential mint, the Access exemption and continuity verification, see Wiring the audit feed into your SIEM. This feeds from the same hash-chained audit log described on the downpipes security page.

Last updated .