Audit log events
The audit log captures a structured record of every state-modifying administrative action in Agent Router. Entries are immutable and support compliance frameworks such as SOC 2 and ISO 27001. The wire schema returned by the management API and shown in Admin Console exports is documented here: the fields on every entry, the action and resource vocabulary, and how related rows join. For the surface that browses the log, see Audit Agent Router activity; for the OpenAPI operations that query entries, see QueryAuditLogs and GetAuditLog.
Event envelope
Every audit entry mirrors a row of the audit_logs table. The management API exposes that row as AuditLogEntry (JSON field names are camelCase; OpenAPI also documents snake_case titles such as action_type).
| Field | Type | Description |
|---|---|---|
id | string | Server-generated audit entry UUID (primary key) |
timestamp | string (RFC 3339, UTC) | When the audited action occurred |
createdAt | string (RFC 3339, UTC) | When the audit row was persisted (defaults to the event time) |
userId | string | Id of the user that performed the action; empty for system actions |
userEmail | string | Email of the acting user, captured at write time |
actorType | string | Actor category (for example user, system, or service_account) |
actionType | string | Action performed (for example CREATE, UPDATE, DELETE, CREATE_SECRET, or SET_GUARDRAIL_STATUS) |
resourceType | string | Type of the affected resource (for example secret, provider, guardrail, or api_key) |
resourceId | string | Id of the affected resource |
success | boolean | Whether the action succeeded |
statusCode | integer | HTTP status code of the response |
errorMessage | string | Error detail when the action failed; empty on success |
sourceIp | string | Client IP the request originated from |
userAgent | string | User-Agent header of the originating request |
httpMethod | string | HTTP method of the originating request (for example POST) |
endpoint | string | Request path or RPC endpoint that triggered the action |
correlationId | string | Correlation id grouping the audit entries that one administrative call produced; distinct from the request X-Request-ID used by data-plane telemetry |
metadata | object | Additional structured context attached to the entry |
requestParams | object | Request path or query parameters captured for the action |
requestBody | object | Request body captured for the action (sensitive values may be redacted) |
responseData | object | Response payload captured for the action |
userId, userEmail, and actorType answer who. actionType, resourceType, and resourceId answer what and to which thing. metadata, requestBody, requestParams, and responseData carry operation-specific context. correlationId joins the audit rows produced by one administrative call. It is an audit-scoped identifier, not the request X-Request-ID, so it does not join audit entries to data-plane telemetry such as traces or request logs.
The Admin Console Audit Logs table projects a subset of these fields (timestamp, actor, action, resource, source, and result). The UI may show a human-readable resource label next to resourceId; that label is a presentation detail, not a separate wire field on AuditLogEntry.
Action and resource vocabulary
actionType and resourceType are stable strings that dashboard filters and SIEM consumers use. They are not dotted <resource>.<verb> names.
Action types
Many mutations use a verb-plus-resource form such as CREATE_SECRET, UPDATE_GUARDRAIL, or DELETE_DATAPLANE. Shorter verbs such as CREATE, UPDATE, DELETE, and UPGRADE also appear. Representative values include:
actionType | Typical when |
|---|---|
CREATE_SECRET / DELETE_SECRET / ROTATE_SECRET | Secret lifecycle |
CREATE_GUARDRAIL / UPDATE_GUARDRAIL / DELETE_GUARDRAIL / SET_GUARDRAIL_STATUS | Guardrail lifecycle and enablement |
CREATE_GUARDRAIL_RULE / UPDATE_GUARDRAIL_RULE / DELETE_GUARDRAIL_RULE | Guardrail rule changes |
CREATE_GUARDRAIL_PROVIDER / UPDATE_GUARDRAIL_PROVIDER / DELETE_GUARDRAIL_PROVIDER | Guardrail provider changes |
ADD_PROJECT_MODEL / REMOVE_PROJECT_MODEL | Project model catalog changes |
ADD_PROJECT_PROVIDER / REMOVE_PROJECT_PROVIDER | Project provider attachment |
CREATE_CLIENT_KEY / ADD_CLIENT_KEY / ROTATE_CLIENT_KEY / DISABLE_CLIENT_KEY / ENABLE_CLIENT_KEY / DESTROY_CLIENT_KEY | API key and client-key lifecycle |
CREATE_PROJECT / UPDATE_PROJECT / DELETE_PROJECT | Project lifecycle |
ADD_PROJECT_MEMBER / UPDATE_PROJECT_MEMBER / REMOVE_PROJECT_MEMBER | Project membership |
CREATE_DATAPLANE / UPDATE_DATAPLANE / DELETE_DATAPLANE | Data plane lifecycle |
SET_DATAPLANE_URL | An address stored for a data plane through the admin API. Deprecated in 0.7.0, when a data plane declares its hostnames in its own Helm values, so the action becomes rare and stops once no supported data plane predates 0.7.0 |
QUEUE_DATAPLANE_ZEROIZE | Since 0.7.0. Deleting a data plane left a zeroize directive for the data plane to collect on its next configuration poll, beside the DELETE_DATAPLANE entry |
PROJECT_SERVED_NOWHERE | Since 0.7.0. The last data plane serving a project stopped serving it: a detach or label removal took the project off its last data plane, or a change landing during a data plane delete left the project unserved. The entry names the project and the data plane. Alert on it, because the project's API keys are accepted nowhere until a data plane serves the project again |
SET_DATAPLANE_CONFIG_OVERRIDE / CLEAR_DATAPLANE_CONFIG_OVERRIDE | Since 0.7.0. A provider address or key set or cleared for one data plane |
ACKNOWLEDGE_CONFIG_DIFFERENCE | Since 0.7.0. An administrator or project owner acknowledged a configuration difference a data plane reported |
RESOLVE_DATAPLANE_CREDENTIAL | Since 0.7.0. A data plane asked for a key override's credential and was refused. Successful resolutions are not recorded |
CREATE_PROJECT_GATEWAY / UPDATE_PROJECT_GATEWAY / DELETE_PROJECT_GATEWAY | Project gateway lifecycle |
SET_PROJECT_GATEWAY_URL | A project gateway URL set through the admin API. Deprecated in 0.7.0 together with SET_DATAPLANE_URL |
ATTACH_PROJECT_GATEWAY_PROJECT / DETACH_PROJECT_GATEWAY_PROJECT | Gateway-to-project binding |
CREATE_TELEMETRY_CONFIG / UPDATE_TELEMETRY_CONFIG / DELETE_TELEMETRY_CONFIG | Telemetry and SIEM forward configuration |
UPSERT_SYSTEM_SETTING / UPSERT_PROJECT_SETTING / DELETE_PROJECT_SETTING | Settings changes |
This table is representative, not exhaustive. New management APIs can introduce additional actionType values; filter on observed values from QueryAuditLogs or the Audit Logs UI when building SIEM rules.
Spellings before 0.5.0
API key entries written before 0.5.0 use an older vocabulary: dotted action names (apikey.create, apikey.update, apikey.rotate, apikey.delete), the resource_type value apikey, and lowercase actor_type values. Entries written before the change keep their old values, and nothing rewrites them, so a SIEM rule that spans the upgrade has to match both vocabularies: the old spellings for historical entries and the tables above for everything written since.
Two more properties of the 0.5.0 change matter to a SIEM consumer:
- The envelope's four request columns (
sourceIp,userAgent,httpMethod,endpoint) are populated for management-plane services only. Developer Console entries leave them empty; a blank column there is a gap that is still open, not a sign the entry was altered. - Entries are append-only either side of the boundary: the spelling change is visible as a discontinuity in the values, never as a modified historical row.
Query by subject
Since 0.5.0, audit queries also take subject_user_id. The two user filters answer different questions: user_id names the admin who performed the action, and subject_user_id names the identity the action was about. Finding every change made by an administrator filters on user_id; finding every change made to a user (their roles, their team, their keys) filters on subject_user_id, whoever performed it.
Resource types
resourceType | Resource family |
|---|---|
secret | Stored secrets |
guardrail / guardrail_rule / guardrail_provider | Guardrails |
project / project_member / project_model / project_provider / project_setting / project_mcp_server | Project-scoped resources |
project_gateway | Project gateways |
dataplane | Data planes |
client / client_key | Clients and API keys |
user_token | User tokens |
service_account | Service accounts |
customer | Customers |
telemetry_config | Telemetry forward configs |
system_setting | Deployment-global settings |
mcp_route | MCP route status |
Example event
{
"id": "8f14e45f-ceea-467f-a8f0-6b2a1c3d4e5f",
"timestamp": "2026-07-25T19:11:11Z",
"createdAt": "2026-07-25T19:11:11Z",
"userId": "c631d6d5-afb2-41fe-a284-eaf7be377c14",
"actorType": "user",
"actionType": "CREATE_SECRET",
"resourceType": "secret",
"resourceId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"success": true,
"statusCode": 200,
"errorMessage": "",
"sourceIp": "203.0.113.10",
"userAgent": "Mozilla/5.0",
"httpMethod": "POST",
"endpoint": "/v1/secrets",
"correlationId": "corr-7c9e6679-7425-40de-944b-e07fc1f90ae7",
"metadata": {
"name": "0-salesforce"
},
"requestParams": {},
"requestBody": {},
"responseData": {}
}
Sensitive values in requestBody, responseData, and metadata may be redacted. Credential material is not written in cleartext to the audit log.
Coverage and immutability
- Coverage. Every state-modifying administrative action generates an audit event. There is no path through the Admin Console that changes Agent Router state without leaving a record.
- Immutability. Audit entries cannot be edited or deleted by any user, regardless of role. There is no "delete from the log" operation anywhere in Agent Router. Signed Merkle checkpoints support tamper-evidence for sealed windows of the log; see the Admin API's audit checkpoint operations.
Retention is configured per deployment. For long-horizon retention beyond the in-Console window, the audit stream is exported to an external SIEM or log store; see Export audit decisions to SIEM.
Related
- Audit Agent Router activity, the surface for browsing audit events and usage analytics
- QueryAuditLogs and GetAuditLog, management API operations that return
AuditLogEntry - OTel metrics, metric stream that complements the audit stream
Where to go next