Audit Logs

Every state-changing operation and sensitive read is logged. Audit logs are immutable and cannot be deleted.

Query logs

coldrune audit list --org my-org

Filter by action

coldrune audit list --org my-org --action secret.set

Filter by actor

coldrune audit list --org my-org --actor <user-id>

Filter by resource type

coldrune audit list --org my-org --resource-type secret

Pagination

coldrune audit list --org my-org --limit 20 --after <cursor>

The cursor value is returned in the previous response when more entries are available.

Logged actions

Action	Trigger
auth.login	Login code requested
auth.logout	Session invalidated
org.create / org.update / org.delete	Organization changes
org.member_invite / org.member_remove / org.member_role_update	Membership changes
project.create / project.update / project.delete	Project changes
env.create / env.delete	Environment changes
secret.set / secret.read / secret.delete	Secret operations
acl.grant / acl.revoke	Access rule changes
service_account.create / service_account.revoke	Service account changes

What’s captured

Each log entry includes:

• Actor: user email or service account name
• Action: what happened
• Resource: type and ID of the affected resource
• Organization: which org context
• IP address: client IP (from reverse proxy X-Real-Ip header)
• Metadata: action-specific context (e.g., secret key name, version number)
• Timestamp: UTC

Access

Audit logs require org admin role or superadmin.

REST API

curl "http://localhost:7100/api/orgs/my-org/audit-logs?action=secret.set&limit=20" \
  -H 'Authorization: Bearer <token>'

Response:

{
  "data": [
    {
      "id": "...",
      "actor_type": "user",
      "actor_name": "alice@example.com",
      "action": "secret.set",
      "resource_type": "secret",
      "resource_id": "...",
      "ip_address": "203.0.113.1",
      "metadata": {"key": "DB_PASSWORD", "version": 2},
      "created_at": "2026-04-01T12:00:00Z"
    }
  ],
  "pagination": {
    "total": 142,
    "limit": 20,
    "has_next": true,
    "next_cursor": "..."
  }
}