Audit reference
Entry fields
An audit entry as it is listed. The fields below are what each row carries.
| Field | Contains |
|---|---|
| Event type | What happened |
| Actor | Who did it |
| Resource type and identifier | What it happened to |
| Old value, new value | The change, for mutations |
| Timestamp | When |
| Sequence number | Position in the total order |
A merge produces many entries at once; read them together by resource and timestamp.
Guarantees
| Guarantee | Enforced by | Exception |
|---|---|---|
| No updates | A database trigger rejects them | None |
| No deletes | A database trigger rejects them | The retention purge, which disables the trigger for its own operation |
| Gap detection | A monotonic sequence number | A purge produces gaps legitimately |
| Ordering | The same sequence | None |
Immutability holds for every ordinary caller. The single exception is the retention purge, which is gated on its own permission and removes entries older than the retention window from both logs.
Two logs
| Log | Records |
|---|---|
| Audit | Data changes — creates, updates, deletes, merges |
| Security audit | Sign-ins, permission grants, policy changes, masking changes, rejected outbound destinations |
Separating them means a security review is not searching through routine record edits.
Masking
| Element | Masked |
|---|---|
| Old and new values | Yes, where a rule applies |
| Actor identity | Never |
| Event type, resource, timestamp | Never |
Retention
A purge endpoint deletes entries older than a window you pass with the request, defaulting to one year, from both the audit log and the security audit log. It is gated on its own permission and is the only operation that can remove an entry.
The window is a parameter of each call, not a stored setting, and nothing invokes the purge for you — there is no scheduler. Entries are retained indefinitely until you run it, so schedule it externally if your obligations require data to be removed.
The purge additionally requires an owner-level database connection to be configured, because the immutability trigger blocks deletion otherwise. Without it the call fails rather than silently doing nothing.
Export anything you must retain for longer before purging. A purge cannot be undone from within the platform.
Size the window against your audit obligations rather than record volume — for a regulated deployment this is usually the longest-retained data you hold.
Audit versus history
| Answers | Shape | |
|---|---|---|
| Audit log | Who did what, when | Append-only events |
| Temporal history | What a record looked like at a time | Versions of a record |
Next
Last verified against commit 74cecd91 (2026-08-03)