Who unregistered the service from an application

Products

• VMware Tanzu Application Service

Issue/Introduction

Customer is looking to track down who (the user) unregistered (delete the binding) the app to the service.

Environment

Tanzu Platform for Cloud Foundry

Resolution

 

You can try querying the audit event.

Example - to list the deleted service bindings:

    cf curl '/v3/audit_events?types=audit.service_binding.delete'

Then locate the app and service guid as shown below.

This will result to 
  {
      "guid": "fc589446-b7c8-4e40-b029-31c7393d37dd",
      "created_at": "2025-05-20T18:53:31Z",
      "updated_at": "2025-05-20T18:53:31Z",
      "type": "audit.service_binding.delete",
      "actor": {
        "guid": "9382419f-2a4b-4d93-a71f-55eb08399705",
        "type": "user",
        "name": "my-user-name"
      },
      "target": {
        "guid": "f8dbae17-1ab8-48ed-ba3a-f50f34dd6a7e",
        "type": "service_binding",
        "name": ""
      },
      "data": {
        "request": {
          "app_guid": "8f01330d-d9a6-46be-8bc2-795ae7694833",                        <<< app-guid
          "service_instance_guid": "9930307b-4d63-420b-b063-9ee2cb048fb3".           <<<< service-guid
        }
      },
      "space": {
        "guid": "ca1f99a0-17be-46f8-9d48-3f105f7d29d9"
      },
      "organization": {
        "guid": "cdf12270-621a-4337-8df9-3644e1decca5"
      },
      "links": {
        "self": {
          "href": "https://api.example.com/v3/audit_events/fc589446-b7c8-4e40-b029-31c7393d37dd"
        }


Reference:

https://docs.cloudfoundry.org/running/managing-cf/audit-events.html#service-bind-lifecycle