Skip to Content
v0.8.0 · shippedNative iOS / Android / Flutter / Capacitor SDKs, A2A discovery, SOC 2 readiness, residency, BYO storage, BYOK. Read the changelog →
Admin consoleAudit log
Export CSV for the next SOC 2 review · · open live demo ↗

Audit log

Route: /audit

Scenario 1: A fix-worker PR was opened for the wrong repository last night and you want to know which admin action or agent run triggered it.

Scenario 2: Your security team wants to know who generated API keys in the last 30 days and whether any were revoked.

The audit log is an immutable record of every action taken in the system — by humans, agents, and automated pipelines. Every entry is timestamped, attributed, and expandable to show the full before/after payload.

What’s logged

Every action that mutates data produces an audit entry. Examples:

ActionDescription
report.createdA new report was ingested
report.triagedA human triaged a report
fix.dispatchedA fix-worker run was started
fix.completedA fix-worker run succeeded
fix.failedA fix-worker run failed
lesson.promotedA mistake cluster was promoted to a lesson
key.createdAn API key was generated
key.revokedAn API key was revoked
sso.registeredAn SSO provider was added
project.deletedA project was deleted
pdca.run.startedA PDCA run was queued
user.invitedA teammate was invited

Columns

ColumnDescription
TimeTimestamp (relative + absolute on hover)
ActionColour-coded badge — green for success, red for failures, amber for warnings
ActorEmail address for human actors, function name for agents, “system” for cron
Resourcetype:id-prefix — the object the action affected
▶Expand to see the full JSON metadata payload and complete resource ID

Hero metrics

Three stat cards at the top of the page show counts for the selected time window: Total events, FAIL events, WARN events.

Filtering

FilterOptions
ActionDropdown of all action types
Resource typereport, fix, lesson, key, project, user, etc.
Actor typeHuman / Agent / System
WhenLast 1h / 24h / 7d / 30d / all time
Actor emailType and press Enter to filter to a specific person
SearchFree-text search on action and resource (press Enter or blur)

Active filters appear as chips in a rail below the toolbar. Click the × on any chip to remove it, or Clear all to reset.

Expanding a row

Click any row to expand it and see the full JSON metadata payload. This includes the before/after state for mutations, the triggering agent ID, and any error detail for failed actions.

Export

Click Export CSV to download all entries matching the current filters. The export includes all columns plus the full metadata JSON.

Common tasks

Tracing an unexpected fix-worker action

  1. Set Action filter to fix.dispatched.
  2. Set When to last 24h.
  3. Find the relevant entry — expand it to see the report_id, triggered_by (human or agent), and project_id.
  4. Click the report_id in the payload to navigate directly to the report.

Security review: who created API keys this month

  1. Set Action to key.created.
  2. Set When to last 30d.
  3. Set Actor type to Human.
  4. Review the Actor column — each entry shows the email of who generated the key.
  5. Click Export CSV to share with your security team.

Finding out when a project was deleted

  1. Set Action to project.deleted.
  2. Expand the row — the payload includes the full project name, slug, and the actor who confirmed deletion.

API

GET /v1/admin/audit?action=&resource_type=&actor=&actor_type=&since=&q=&limit=50&offset=
Last updated on
SSOCompliance