Audit log

The audit log answers “who changed this?” for a workspace. Every accepted or rejected configuration write gets one entry with the actor, the action, the target resource and the names of the submitted fields.

What is recorded

Field	Example	Notes
Actor	Browser session, API key	How the caller authenticated, plus the user id
Action	endpoint.create	Resource and verb
Target	ep_…, dst_…	Resource id parsed from the request path
Status	201, 400	HTTP status the API returned
Outcome	success, failure	Derived from the status
Fields	name, provider	Top-level request body field names only
Timestamp	2026-11-06T00:47:02Z	When the request completed

Reads are not logged. Secret values, tokens and payloads are never written to the audit log: the entry records field names, not their contents, so a secret.create entry shows name, value as field names without either value.

Audit entries follow the workspace plan’s retention window and are pruned by the same cleanup job that removes old events and deliveries.

API

GET /v1/audit-log?limit=50
Authorization: Bearer hks_...

Query	Description
limit	Page size, 1–200 (default 50), newest first
action	Exact action, e.g. endpoint.create
targetId	Resource id, e.g. ep_…
since	ISO-8601 lower bound on createdAt
until	ISO-8601 upper bound on createdAt

{
  "data": [
    {
      "id": "aud_...",
      "actorType": "session",
      "actorId": "usr_...",
      "action": "endpoint.create",
      "method": "POST",
      "path": "/v1/endpoints",
      "targetType": "endpoint",
      "targetId": null,
      "status": 201,
      "outcome": "success",
      "fields": ["name", "provider"],
      "createdAt": "2026-11-06T00:47:02.000Z"
    }
  ]
}

Reading the log needs the endpoints:read scope; viewers can read it.

Console

Workspace → Audit log lists the newest 200 entries and filters them client-side by action, actor or resource id. The page shows the HTTP status per entry so failed attempts are visible next to successful ones.