The record of who did what
Every read and every write lands one entry that nobody in your workspace can edit or delete.
Every reveal is written down with who, what, and when. So is every write, every deletion, every credential issued, every member added and every plan change. This is the audit log, and it is what you hand a customer who asks how you manage production credentials.
What one entry holds
| Field | What it is |
|---|---|
| Actor | The person, or the machine identity. Never a credential id |
| Target | The full address the action touched |
| When and from where | The timestamp and the source IP |
| Result | Whether it succeeded |
A value never appears in an entry. Neither does a key's contents or a response body from a third party. What metadata may carry is timing, such as how many milliseconds a sealed operation took, which is how you see what your own encryption key costs you.
An entry made by a machine names the identity, and keeps the credential it authenticated with in the entry's metadata. That way rotating a credential does not split one machine's history into two strangers.
Nothing edits it, and nothing deletes it
The table has no update or delete permission for the application at the database level. That is a database privilege doing the work, so a bug in application code cannot rewrite history.
Browsing the log needs audit:read. Taking a copy away needs audit:export, which is a separate permission, so you can let somebody look without letting them walk out with the file.
A column is reserved for chaining each entry to the one before it, so tamper evidence can be switched on for a compliance program without a migration. It is off today.
What lands an entry
The console groups entries into six families, taken from the action's prefix.
| Family | Examples |
|---|---|
| Secret | secret.read, secret.read.previous, secret.write, secret.delete, and the five secret.reveal* entries |
| Machine | identity.create, identity.revoke, credential.issue, credential.revoke, credential.cloned |
| Member | account.signed_in, device.approved, member.provisioned, member.step_up_verified, member.deprovisioned |
| Billing | billing.checkout.started, billing.subscription.cancel_requested |
| Integration | integration.connected, integration.run_applied, and the engine and lease entries |
| Other | org.created, org.deleted, project.created, project.renamed, project.deleted, environment.created, environment.renamed, environment.deleted, audit.sink_connected |
Agent sessions leave their name on the entry
Every request the command line makes may carry the harness that is driving it and that session's id. The server puts both on the entry, treated as text and cut off at 128 characters. That is what lets you ask which files one agent session touched, weeks later.
An approval leaves four entries:
secret.reveal_requested, the request the agent madesecret.reveal_approvedorsecret.reveal_denied, the answer you gave in the consolesecret.read, the read itselfsecret.reveal, which names you beside the session that asked
A redemption the server turns away adds a fifth, secret.reveal_refused, carrying the state that turned it. See coding agents.
A read from CI names the run
A value read with a build credential stamps the repository, the workflow ref, the ref of the workflow whose job is executing, the run id, the run attempt and the platform actor. An incident then scopes to one execution instead of to every run since you set the trust up.
The actor on that entry is still the machine identity, as it is everywhere else.
How long it is kept, and getting a copy
| Plan | Kept for |
|---|---|
| Free | 7 days |
| Pro | 90 days |
| Enterprise | Set by your contract |
The console browses newest first and filters by action, actor and date, with the filters in the URL so you can share one. The export takes the range you are looking at, newest first, and says so when the range is longer than one export holds.
Enterprise workspaces can also stream the record to a destination you own. Batches are signed NDJSON delivered at least once, so deduplicate on event_id and watch sequence to notice a gap. Delivery follows activity rather than a clock, so a batch trails the events that produced it by minutes.
Next: the glossary.