Audit log
The audit log records who changed the keys, the members and the guardrails of a workspace. Use it to answer "who did this, and when?".
Only owners and admins can read it, because a row can name a colleague. A member gets 403 permission_denied. To open it, choose Settings in the console, then Audit log.
Find a change
- Open the Audit log. The newest row is first.
- Type in the filter box. It searches the person, the action and the subject.
- Choose the export button to save every row as a CSV file, not only the rows on screen.
The file has the columns at, workspace, actor, actor_email, action, subject and detail. The workspace column is empty for a row of this workspace.
A row records the change. It does not record the secret of a key or the text of a call.
What it records
| Action | Meaning |
|---|---|
ISSUE_KEY, REVOKE_KEY |
Someone issued or revoked an API key. |
MEMBER_ROLE, MEMBER_REMOVE |
Someone changed the role of a member, or removed a member. |
INVITE_MEMBER, RESEND_INVITATION, REVOKE_INVITATION |
Someone invited a person, sent the invitation again, or withdrew it. |
ACCEPT_INVITATION, DECLINE_INVITATION |
The invited person accepted the invitation, or declined it. |
GUARDRAIL_CREATE, GUARDRAIL_UPDATE, GUARDRAIL_REMOVE |
Someone created, changed or deleted a guardrail. |
GUARDRAIL_KEY_ASSIGN, GUARDRAIL_KEY_UNASSIGN |
Someone gave a key a guardrail, or removed it. |
MOVE_WORKSPACE |
Someone moved the workspace under an organization, or out of it. |
SET_WORKSPACE_ACCESS_MODE |
Someone chose whether all members of the organization can access the workspace. |
Each row shows:
- When: the time of the action.
- Who: the name of the person, or the email address when there is no name. A change made with a CLI token shows the person who owns the token. An action of the exchange itself shows "The exchange".
- What: the action, in words, and what it was on: a key, a guardrail, or a member.
- Detail: the fields of the change. For example, a role change holds the old role and the new role.
Workspaces under an organization
The owners and admins of an organization also read the rows of the workspaces under it. Each of those rows shows the handle of its workspace. The rows follow the current parent: when a workspace moves under the organization, its whole log shows, and when it moves out, its rows go with it.
Limits of the log
- The log starts on the day that the exchange began to record the workspace of each action. An action from before that day is not in it.
- The log records changes to keys, members and guardrails only. It does not record the jobs that you send. Receipts record those.
- The exchange never deletes or changes a row.