Skip to content

Audit Log

The audit log records who did what, when and from where across your organization. Viewing it requires the Admin role: Organization > Audit.

Entries

Each entry shows the Timestamp, the Actor with its type, the Action, the Resource it acted on with its type, the Result and the IP Address.

Actor types are User, Worker, System, Job and Service. An action taken with an API key is attributed to the user who created the key, with the key's ID in the entry's details; the API Key option in the Actor Type filter matches nothing today.

Resource types cover spaces, stacks, bundles, runs, worker pools and workers, users and invitations, the organization, VCS and cloud integrations, policies, tokens and API keys, and artifacts.

What is recorded

  • Authentication: sign-in and sign-out, registration, password changes and resets, MFA enabled or disabled, sign-in verifications and admin MFA resets.
  • Tokens: creation, revocation and refresh of tokens and keys.
  • Resources: create, update and delete of every managed object, with the created object's ID and name.
  • Runs: created, approved, cancelled, completed and failed.
  • Downloads, policy and approvals: download redemptions, policy evaluations and approval gates.
  • Source control: integration created, updated, deleted and verified; connector events.
  • Cloud integrations: created, updated, deleted, verified, attached to and detached from stacks.
  • State: rollbacks of Zenfra-managed state.

Filtering and paging

Filter by Actor Type, Resource Type, Action, Result (Success, Failure, Denied) and a From date / To date range. The Action filter offers the common actions; sign-in verifications, admin MFA resets, connector events and state rollbacks are recorded but cannot be selected in the filter yet. Pages hold 25 entries by default (10, 25, 50 or 100).

Retention

The organization settings include an audit retention period (1 to 365 days) that can be set through the API. It is not enforced yet.