The audit log records who changed what in your organization and when. Every change to a project is in it: edits to the code, compiles, settings, deploys, secrets, members and API keys. A row is added after the change has gone through. The one exception is a refused deploy, which is recorded as deployment.blocked.
- Organization: the Audit log entry in the sidebar lists the rows of every project.
- Project: the Audit log tab under Manage lists the rows of that project. The dashboard guide shows where the tabs are.
- API:
GET /api/v1/audit-events takes a personal API key or an organization admin key. Add project_id to read one project. Use limit (up to 200) with cursor to page through the rows, or start for numbered pages of at most 50. Both return the action, the resource, the actor and the time of each row.
The tables show time, action, resource, actor and IP address, and can be filtered by action, actor and time range. Rows of ended sessions (session.end) are stored but hidden from the lists.
Every row names the actor: a person, an API key, or the system when there is no one to name. Each project row also carries the project id, so the project tab and the API filter find it.
- Code. A save or a template start stores the revision before and after, the paths that were added, changed and removed, the size in bytes of each file that was added or changed, and the total size before and after. File contents are never recorded.
- Compiles. The request is recorded when you start it. The result is recorded by the platform when the compile finishes, as
build.compile_succeeded or build.compile_failed, attributed to whoever requested it. It names the compile job, the build, the outcome and the duration, plus a failure code when it failed, and it is written once per job. - Settings. A change stores the keys that changed, each with its old and new value. Strings longer than 200 characters are cut and flagged as cut. A change that leaves every value as it was writes no row.
- Secrets and credentials. Only the name is recorded. The value of a secret, a registry credential or an API key is never stored in the log, and a setting whose key looks like a secret is recorded as changed without its values.
These are all the values of the action field.
| Action | What it records |
|---|
project.create | A project was created. |
project.delete | A project was deleted. |
project.template_change | Starting from a template changed the project's template. |
| Action | What it records |
|---|
source.update | The project's source files were saved. |
source.seed | The source was replaced with the files of a template. |
llm.eject | The LLM agent was ejected into editable source code in the Code tab. |
llm.tools.discover | Discover now connected to an MCP tool source of the LLM agent to list its tools. |
build.upload | A build was uploaded. |
build.promote | A build was promoted to the project's active build. |
build.rollback | The project went back to an earlier build. |
build.compile_requested | A compile of the source was requested. |
build.compile_succeeded | A compile finished and produced a build. The resource is the compile job. |
build.compile_failed | A compile finished with an error. The resource is the compile job. |
| Action | What it records |
|---|
deployment.create | A deploy was requested. |
deployment.undeploy | The project was undeployed. |
deployment.blocked | A deploy was refused, for example because the previous version was still finishing calls. |
deployment.force_end | A forced deploy ended the calls still running on an older version. |
deployment.completed | A deploy finished and the new version is live. |
deployment.failed | A deploy ended as failed. |
canary.start | A canary deployment was started. |
canary.update | The settings of the active canary were changed. |
canary.promote | The canary was promoted to the project's main version. |
canary.abort | The canary was stopped by a person. |
canary.auto_abort | The canary was stopped automatically. |
| Action | What it records |
|---|
project.settings_update | A runner setting of the project was changed. |
project.session_settings_update | A session setting of the project was changed. |
project.voice_settings_update | A voice setting of the project was changed. |
project.voice_advanced_settings_update | An advanced voice setting of the project was changed. |
project.billing_settings_update | A billing setting of the project was changed. |
project.cors_origins_update | The list of allowed browser origins (CORS) was changed. |
project.subscription_change | The project was moved to another subscription. |
| Action | What it records |
|---|
widget.update | The widget configuration was saved. |
widget.publish | The widget was published. |
| Action | What it records |
|---|
environment.upsert | An environment variable was created or changed. |
environment.delete | An environment variable was deleted. |
secret.create | A secret was created. Secrets cannot be edited, so a new value is a delete and a create. |
secret.delete | A secret was deleted. |
service.upsert | A project service was created or changed. |
service.delete | A project service was deleted. |
service.rotate_token | A project service's token was rotated. |
registry_credential.upsert | A registry credential for service images was created or changed. |
registry_credential.delete | A registry credential was deleted. |
| Action | What it records |
|---|
org.member.add | A member was added to the organization. |
org.member.remove | A member was removed from the organization. |
org.member.role_update | An organization member's role was changed. |
project.member.add | A member was given access to a project. |
project.member.remove | A member's access to a project was removed. |
project.member.role_update | A project member's role was changed. |
org.ownership_transfer | Ownership of the organization was transferred. |
| Action | What it records |
|---|
session.start | A session was started. |
session.end | A session ended. These rows are stored but not shown in the audit log lists. |
session.recording.delete | A session recording was deleted. |
conversation.export_requested | An export of the conversation history was requested. |
| Action | What it records |
|---|
api_key.create | A project API key was created. |
api_key.revoke | A project API key was revoked. |
user_api_key.create | A personal API key was created. |
user_api_key.revoke | A personal API key was revoked. |
user_api_key.rename | A personal API key was renamed. |
cli_device_authorize.approve | A CLI login was approved in the dashboard. |
cli_device_authorize.deny | A CLI login was denied in the dashboard. |
cli_device_authorize.consume | The CLI collected the credentials of an approved login. |
| Action | What it records |
|---|
subscription.expired | A subscription expired. |
project.undeployed_due_to_billing | A project was undeployed because its subscription expired. |
account.deletion_requested | Deletion of the account was requested. |
account.deletion_completed | Deletion of the account finished. |
| Action | What it records |
|---|
platform_admin.grant | VoiceThere staff access was granted for support. Only VoiceThere staff trigger this. |
platform_admin.revoke | VoiceThere staff access was revoked. Only VoiceThere staff trigger this. |
demo_limits.reset | VoiceThere staff reset public demo counters. Only VoiceThere staff trigger this. |
demo_limits.pause | VoiceThere staff switched off the per-visitor and per-IP public demo limits for a set time. Only VoiceThere staff trigger this. |
demo_limits.resume | VoiceThere staff turned the public demo limits back on. Only VoiceThere staff trigger this. |
demo_limits.settings_update | VoiceThere staff changed the public demo limits (daily budget, sessions per day, session length or cost estimate). Only VoiceThere staff trigger this. |
demo_limits.showcase_llm_update | VoiceThere staff changed the LLM setup (provider, model, temperature, max output tokens or API key secret name) of the public assistant demo. Only VoiceThere staff trigger this. |
