Audit

The immutable record of every change, and the means to prove it has not been altered.

📄️List audit entries

Returns what changed, who changed it and when, newest first. Entries come back in the order they were written, which under concurrent writes is not always the order of their timestamps — the numbering is the authoritative sequence. The log is append-only and numbered without gaps, so a missing entry is detectable rather than invisible. Values inside the recorded changes are masked for callers who may not see them. Requires `audit.read`.

📄️Get an audit entry

Returns one audit entry with the before and after values of the change. Requires `audit.read`.

📄️List recent activity

Returns the most recent changes, for an activity feed. Requires `audit.read`.

📄️List security audit entries

Returns authentication and authorization events — sign-ins, refusals, role grants, policy changes. Kept apart from data changes because the questions asked of it are different. Requires `audit.security.read`.

📄️Purge audit entries past retention

Removes entries older than the retention period. This is the only operation that deletes from the audit log, and it is itself audited. Requires `audit.purge`.