Skip to content

tinker_cookbook.scripts.save_audit_log

Source on GitHub

Persist Tinker audit log entries to disk on a recurring schedule.

The Tinker audit log endpoint returns events for a single UTC day at a time. To build a durable archive of your organization's audit events, you need to poll the endpoint regularly and store the results yourself.

This script does that. It writes one JSON Lines file per UTC day to a local output directory:

audit_logs/
  audit_log_2026-05-11.jsonl  # complete day, written once and skipped after
  audit_log_2026-05-12.jsonl  # complete day, written once and skipped after
  audit_log_2026-05-13.jsonl  # in-progress day, re-fetched on every tick

Days other than "today (UTC)" are treated as immutable once written. Today's file is rewritten on every poll because new events are still arriving.

Requirements: - The caller's API key must have the VIEW_AUDIT_LOG capability (tinker-admin RBAC role).

Usage:

# One-shot: fetch today's audit log and exit.
python -m tinker_cookbook.scripts.save_audit_log --once

# Backfill the last 7 days, then poll every hour.
python -m tinker_cookbook.scripts.save_audit_log \
    --output-dir ./audit_logs \
    --backfill-days 7 \
    --interval-seconds 3600