SQL Audit Logs

[FabricH]

I tried to enable logging of UPDATE-Statements for the Warehouse (SQL Audits). I don't want to include SELECT-Statements, since this would increasy the volume of actions that are logged.

Bases on the documentation it should be possible (https://learn.microsoft.com/en-us/fabric/data-warehouse/sql-audit-logs#database-level-audit-action-g...). 

This doesn't work:

--- Begin ---

POST https://api.fabric.microsoft.com/v1/workspaces/<workspace_id>/warehouses/<warehouse_id>/settings/sqlAudit/setAuditActionsAndGroups
content-type: application/json

Authorization: Bearer <bearer_token_here>

[
"UPDATE"
]

--- End ---

However, it might be necessary to specify an object. I couldn't figure out how it works. Did anybody successfully achieve the above and can give me a hint?

[FabricH]

Thanks. The response returns "enabled".

I included the empty line after the bearer token (somehow removed it in this post).

In general, it works for audit action groups. 
However, I am not able to only capture UPDATE statements without capturing SELECT statements. 

[v-nmadadi-msft]

Hi @FabricH  ,
Thanks for reaching out to the Microsoft fabric community forum.

Please verify if SQL audit logs are enabled using GET request using the same REST Client extension.

The response should return ENABLED.

Also make a note In the extension example code, you must include an empty line immediately after providing the bearer token. This empty line signals the extension where the HTTP headers end and the API command body begins, allowing it to correctly distinguish between the two.

I hope this information helps. Please do let us know if you have any further queries.
Thank you