Docs · Reference

Audit log.

An append-only record of who did what and when in your organization — secret reveals, deploys, sign-ins (including failures), and API-token changes. Available on Studio and up. Retained 13 months and exportable anytime as CSV or JSON.

Events captured

  • Environment variables — env_var.created, env_var.updated, env_var.deleted, and, distinctly, env_var.revealed when values are read back.
  • Deployments — deployment.created (manual and rollback), with who triggered it and the project.
  • Authentication — auth.login.succeeded and auth.login.failed, for the console and dashboard, across every sign-in method.
  • API tokens — api_token.created, api_token.revoked.
  • Exports — audit.exported, so the log records its own exports.

A note on env-var reads

Reads are logged at every layer we mediate: the dashboard reveal, the API GET, and the CLI env pull all cross our boundary and produce an env_var.revealed event. What we cannot log per-read is a variable that has already been injected into a running container and is then read from process.env in your own process — that read never returns to us, exactly as AWS CloudTrail records the GetSecretValue API call but not subsequent in-memory reads. For that layer, the injection is captured at deploy time. We log that a secret was read — who, when, which variable — never the value itself.

Fields on every event

  • occurred_at — UTC timestamp (ISO 8601).
  • action — the namespaced event type above.
  • actor_email and actor_type — the person, or an API token acting on their behalf (user / token / system).
  • source_ip and user_agent.
  • target_label / target_type — the resource acted on (project, variable, token).
  • outcome — success, failure, or denied.
  • request_id — correlates to a specific API call.
  • metadata — extra context (e.g. the keys changed), with any secret-shaped values redacted at write time.

Retention

Events are kept 13 months and then pruned. For anything longer — a Law 25 incident register runs five years — export on a schedule and keep the copies in your own store.

Export & access

Self-serve, from Identity → Audit log: filter by event, actor, or date, then Export CSVor Export JSON. The same data is available from the API at GET /audit and GET /audit/export?format=csv|jsonwith an API token, so you can pull it from CI or the CLI. Reading the log is restricted to organization admins, and each export is itself recorded.