Agent-ready OpenAPI document · curated by JenticSecurityCompliancehmac44 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Configure AWS CloudTrail trails, run CloudTrail Lake queries against event data stores, and look up recent management events across an AWS account. Backed by 44 endpoints covering trails, channels, queries, and event lookup.
Use for: I need to create a CloudTrail trail that logs S3 data events, Run a CloudTrail Lake query to find all root account logins last week, Look up the last 50 management events for a specific IAM user, Start logging on an existing CloudTrail trail
Not supported: Does not handle real-time threat detection, log forwarding to non-AWS destinations, or in-account log retention beyond CloudTrail Lake - use for trail configuration, event lookup, and CloudTrail Lake queries only.
Jentic publishes the only available OpenAPI specification for AWS CloudTrail, keeping it validated and agent-ready. AWS CloudTrail records management and data events across an AWS account, delivers them to S3 or an event data store, and lets you query the log with CloudTrail Lake. The API covers trails, channels, event data stores, query execution, and resource policies, so an agent can configure logging, run SQL-like queries, and pull recent events without touching the console.
Install Jentic One Beta
Connect the AWS CloudTrail to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS CloudTrail, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fcloudtrail" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fcloudtrail" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS CloudTrail API.
Create, describe, update, and delete CloudTrail trails for management and data events
Create CloudTrail Lake event data stores and run SQL-style queries against captured events
Look up the last 90 days of management events by attribute through LookupEvents
Configure event selectors and insight selectors for fine-grained event capture
Manage CloudTrail channels for ingesting events from external sources
Attach and remove resource policies on CloudTrail resources for cross-account access
Tag CloudTrail trails, event data stores, and channels for inventory and cost allocation
Use Cases
Patterns agents use AWS CloudTrail API for, with concrete tasks.
★ Security Investigation with CloudTrail Lake
Security engineers use CloudTrail Lake to run SQL queries over months of event history without exporting logs to a separate SIEM. The API lets an agent create an event data store, start a query with StartQuery, poll DescribeQuery for completion, and pull rows with GetQueryResults. Common investigation queries include 'all ConsoleLogin events from a country' or 'every IAM policy change touching a role'.
Create a CloudTrail Lake query that returns all ConsoleLogin failures in the past 7 days, then fetch the results
Compliance Logging Setup
Auditors expect every AWS account to have a multi-region CloudTrail trail covering management events. CreateTrail provisions the trail with an S3 bucket destination, PutEventSelectors enables data event capture for S3 and Lambda, and StartLogging activates delivery. DescribeTrails confirms configuration so agents can verify accounts against a baseline before a SOC 2 or ISO 27001 audit.
Create a multi-region trail named org-audit, attach S3 data event selectors for every bucket, and start logging
Recent Event Lookup for Incident Response
When responding to an alert, an agent uses LookupEvents to retrieve the last 90 days of management events filtered by attribute (Username, EventName, ResourceName). This is faster than spinning up CloudTrail Lake when the question is 'what did this principal do recently?'. Results include the full event JSON for direct triage.
Look up the last 100 events where Username equals attacker-role over the past 24 hours and return the EventName values
AI Agent Integration via Jentic
Through Jentic, an AI agent calls CloudTrail by searching for an intent like 'look up CloudTrail events for a user', loading the LookupEvents schema, and executing it with a LookupAttributes filter. Jentic signs the SigV4 request server-side using IAM credentials in your Jentic One instance.
Search Jentic for 'look up CloudTrail events for a user', load the LookupEvents schema, and execute it for Username=ci-deploy with MaxResults=50
Key Endpoints
44 endpoints — jentic publishes the only available openapi specification for aws cloudtrail, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.CreateTrail
Create a CloudTrail trail
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.DescribeTrails
Describe one or more trails
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.CreateEventDataStore
Create a CloudTrail Lake event data store
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetQueryResults
Fetch results of a CloudTrail Lake query
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.DescribeQuery
Describe the status of a query
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetEventSelectors
Get current event selectors for a trail
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetTrail
Get details of a specific trail
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.CreateTrail
Create a CloudTrail trail
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.DescribeTrails
Describe one or more trails
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.CreateEventDataStore
Create a CloudTrail Lake event data store
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetQueryResults
Fetch results of a CloudTrail Lake query
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.DescribeQuery
Describe the status of a query
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetEventSelectors
Get current event selectors for a trail
POST
/#X-Amz-Target=com.amazonaws.cloudtrail.v20131101.CloudTrail_20131101.GetTrail
Get details of a specific trail
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
AWS CloudTrail
- AI-Aware (B-)61/100
99
Foundational Compliance63
Developer Experience & Jentic Compatibility38
AI-Readiness & Agent Experience94
Agent Usability50
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
99
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A+Signals: 4
95%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
100%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
63
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
51%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
38
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
53%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
50
Security
Trust, risk posture, and security compliance.
Grade: C-Signals: 1
50%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring AWS CloudTrail by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature per request, resolving the correct regional cloudtrail host with the right X-Amz-Target action header, and handling query polling, pagination, and retries yourself. Through Jentic you install once, import AWS CloudTrail from the API Directory, store the AWS access key once, and your agent calls it.
Permission scoping
CloudTrail sends the trail name, event data store, and query identifiers in the request body rather than the URL path, so scope your agent by the operations it needs, such as looking up events or running a CloudTrail Lake query. You choose which operations it may call, so changes like creating or deleting a trail are not included unless you add them.
Credential isolation
Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'look up CloudTrail events for a user' or 'run a CloudTrail Lake query', and Jentic returns the matching CloudTrail operation with its input schema so the agent calls the right action without crawling the AWS reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS CloudTrail API through Jentic.
Why is there no official OpenAPI spec for AWS CloudTrail?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS CloudTrail via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the AWS CloudTrail API use?
CloudTrail uses AWS Signature Version 4 (HMAC) signed requests with an IAM access key ID and secret. Through Jentic, those credentials live encrypted in your Jentic One instance and the SigV4 signature is computed server-side, so the agent context never holds the raw secret.
Can I run CloudTrail Lake SQL queries with this API?
Yes. Call StartQuery with the SQL string and the EventDataStore ARN, poll DescribeQuery until the QueryStatus is FINISHED, then call GetQueryResults to page through rows. Queries support standard SELECT, WHERE, GROUP BY, and aggregate functions.
What are the rate limits for the AWS CloudTrail API?
AWS applies per-account, per-region throttling on CloudTrail control-plane calls; LookupEvents is limited to a small number of TPS per account and returns ThrottlingException when exceeded. Use exponential backoff - the AWS SDKs Jentic wraps implement this automatically.
How do I look up the last 90 days of events for a user with this API?
Call LookupEvents with a LookupAttributes entry of AttributeKey=Username and AttributeValue=<iam-user>. The response returns up to 50 events per page, including the full CloudTrailEvent JSON. Use NextToken to paginate.
How do I run a CloudTrail query through Jentic with an AI agent?
Run pip install jentic, then have the agent search for 'run a CloudTrail Lake query', load the StartQuery schema, and execute it with the SQL string. Follow with DescribeQuery and GetQueryResults to retrieve rows once QueryStatus is FINISHED.
Can I limit what my agent is allowed to do with the AWS CloudTrail API?
Yes. Jentic One is self-hosted, so you set the rules for which CloudTrail operations and AWS credentials your agent may use. Because CloudTrail passes the trail name, event data store, and query identifiers in the request body rather than the URL, you scope the agent by the operations it needs, such as LookupEvents for reading recent events or StartQuery and GetQueryResults for CloudTrail Lake queries. Higher-impact actions like CreateTrail or DeleteTrail stay off limits unless you explicitly grant them.
GET STARTED