Skip to main content
Settings → Audit Log is the compliance view of every sensitive action that has occurred in your workspace — API-key creation and revocation, member changes, project mutations, evaluation triggers, billing-plane events, trace reads, and control-plane actions.

​
Who can view this page

The audit log is restricted to two roles: If you land on the page without sufficient permissions, you will see a “You don’t have permission to view the audit log” notice instead of the table. Ask an owner in your workspace to assign you the viewer role — intended for compliance teams and external auditors that need read access without mutation privileges.

​
Columns

Click the chevron on any row to expand the typed metadata payload and confirm the metadata_schema_version. Fields follow the typed schema documented in the backend security reference.

​
Filtering

  • Event type — restrict the table to a single event class.
  • From / To — inclusive ISO timestamp range (input uses your local timezone and is converted to UTC when the query is issued).
Filter changes immediately re-fetch the first page. Use Clear to reset and return to the full stream.

​
Pagination

The backend returns up to 50 entries per page plus an opaque next_cursor. Click Load more to append the next page; the table scrolls continuously until the cursor is exhausted.

​
Hash chain and tamper evidence

Every entry carries a curr_hash = sha256(prev_hash || canonical_json(entry)). Together the entries form an append-only chain. TruLayer signs the chain head each UTC day and writes the manifest to S3 under Object Lock COMPLIANCE for one year — so even an attacker with database admin cannot rewrite history without leaving evidence. For third-party verification, fetch the daily anchor via GET /v1/audit/verify?tenant_id=...&date=YYYY-MM-DD and compare the manifest head_hash to the curr_hash of the last entry in the same window.

​
Exports

Programmatic export is not currently exposed on this page. If you need a full archive for evidence collection, contact support — SOC 2 evidence bundles are generated out-of-band against the same underlying table.