> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

> An append-only record of every execution, denial, and governance change in your organization

Every governance-relevant action in an organization writes one row to an append-only audit log: tool executions, denied calls, membership changes, policy changes, API key lifecycle, and events streamed from [data-plane agents](/organizations/data-plane). Rows are never updated or deleted.

## What a row contains

| Field                                | Meaning                                                                                                                                                         |
| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `action`                             | What happened, for example `tool.execute` or `tool.denied`                                                                                                      |
| `status`                             | `success`, `denied`, `error`, or `info`                                                                                                                         |
| `actor_type` and `actor_profile_id`  | Who acted: a signed-in user, an agent using an API key, or a data-plane agent                                                                                   |
| `api_key_id`                         | The key the call came through, when it came through a key                                                                                                       |
| `service_id`, `tool_id`, `tool_name` | What was called                                                                                                                                                 |
| `args_hash`                          | A SHA-256 digest of the call's parameters. The parameters themselves are never stored, so the log can prove which arguments were used without holding the data. |
| `denial_reason`                      | Why a call was denied, when it was                                                                                                                              |
| `ip`, `request_id`                   | Where the request came from, and the id to correlate with your own logs                                                                                         |
| `dataplane_agent_id`, `seq`          | For events from a data-plane agent: which agent, and its monotonic sequence number                                                                              |
| `created_at`                         | When it happened                                                                                                                                                |

## Read the log

<Steps>
  <Step title="Open the viewer">
    Go to [Dashboard > Organization > Audit Log](https://danubeai.com/dashboard/organization/audit). Admins and owners only.
  </Step>

  <Step title="Filter">
    Filter by action, status, actor, tool, and a time range. The list is newest first and paginated.
  </Step>
</Steps>

Or query it directly:

```bash theme={null}
curl "https://api.danubeai.com/v1/organizations/ORG_ID/audit?status=denied&start=2026-09-01T00:00:00Z&page_size=100" \
  -H "danube-api-key: YOUR_API_KEY"
```

| Query parameter     | Notes                                   |
| ------------------- | --------------------------------------- |
| `action`            | Exact match, for example `tool.execute` |
| `status`            | `success`, `denied`, `error`, or `info` |
| `actor`             | Actor profile id                        |
| `tool_id`           | One tool                                |
| `start`, `end`      | ISO-8601 bounds on `created_at`         |
| `page`, `page_size` | `page_size` is at most 100              |

The response is `{"events": [...], "total": N, "page": 1, "page_size": 50}`.

## Guarantees

* **Append-only.** The table rejects updates and deletes at the database level.
* **Never blocks the call.** A failed audit write is logged as a warning and the audited operation still completes. A silent gap is not possible: the failure is visible in server logs.
* **No raw parameters.** Only the `args_hash` digest is stored.
* **Data-plane events are idempotent.** Agents inside your network stream events with a per-agent sequence number, buffer them while offline, and retry. Intermittent connectivity neither loses nor duplicates rows.

## Not yet available

Export to a SIEM and retention controls are on the roadmap. Until then, page through the endpoint above to copy events into your own system.