Skip to content
Zautha

Audit log

The audit log records who changed what in your workspace and its applications, and when. Every member of the workspace can read it in the dashboard: Audit log in the workspace’s header, or the Audit log tab of an application for that application’s events.

What is recorded

Section titled “What is recorded”

Changes made in the dashboard or with a secret key through the Backend API:

  • Workspace: created or renamed, plan changes, members joining, leaving, removed or given another role, invitations sent, resent or revoked, the billing email changed.
  • Applications: created, renamed or deleted; instance settings; secret keys created or revoked; domains; social connections; OAuth clients; webhook endpoints (including revealing or rotating a signing secret, test events, resent and recovered messages).
  • Users and sessions: users created, updated, deleted, banned or unbanned, two-step verification removed, an authorized app removed, impersonation started or revoked, sessions revoked.
  • Organizations: organizations, memberships, roles, permissions and invitations created, changed or deleted.

Changes Zautha makes itself are recorded too: a domain verified or disabled, a failing webhook endpoint disabled, usage above the plan reported for billing.

What your users do themselves (signing in, changing their profile, creating an organization in your application) is not in the audit log; webhooks tell your server about those changes. Reading data is never recorded.

A change and its entry are saved together: if the entry cannot be written, the change is not made.

An entry

Section titled “An entry”
  • When it happened and what happened (the event, such as “Banned user”).
  • The actor: a workspace member (dashboard), a secret key (Backend API) or Zautha.
  • The application and its environment, and the target: the user, key, domain or other object that changed.
  • The request’s IP address and user agent, for members and secret keys.
  • Details that explain the event, such as the names of the changed fields, an application’s or key’s name, a role or a domain’s host name. An entry never holds the values of your users’ data, secrets, tokens, email addresses, people’s names or webhook endpoint URLs.

Filter the log by application, environment, event, actor and time.

How long it is kept

Section titled “How long it is kept”

Entries are kept for 7 days on Free and 90 days on Pro (Usage and billing), then deleted. A workspace that returns to Free loses its entries older than 7 days.

Deleting an application keeps its entries (it is shown as “Deleted application”); deleting the workspace deletes its audit log. When a member deletes their account, the IP address and user agent of their entries are removed.

The audit log is read in the dashboard only: there is no API or export for it.