Skip to main content
Every governance-relevant action in an organization writes one row to an append-only audit log: tool executions, denied calls, membership changes, policy changes, API key lifecycle, and events streamed from data-plane agents. Rows are never updated or deleted.

​
What a row contains

​
Read the log

1

Open the viewer

Go to Dashboard > Organization > Audit Log. Admins and owners only.
2

Filter

Filter by action, status, actor, tool, and a time range. The list is newest first and paginated.
Or query it directly:
The response is {"events": [...], "total": N, "page": 1, "page_size": 50}.

​
Guarantees

  • Append-only. The table rejects updates and deletes at the database level.
  • Never blocks the call. A failed audit write is logged as a warning and the audited operation still completes. A silent gap is not possible: the failure is visible in server logs.
  • No raw parameters. Only the args_hash digest is stored.
  • Data-plane events are idempotent. Agents inside your network stream events with a per-agent sequence number, buffer them while offline, and retry. Intermittent connectivity neither loses nor duplicates rows.

​
Not yet available

Export to a SIEM and retention controls are on the roadmap. Until then, page through the endpoint above to copy events into your own system.