Audit logs
List workspace audit events via session, tRPC, and the v1 API.
Audit events record who did what (actorType user | apiKey | system), action, resourceType, optional resource id/name, severity (info | warning | critical), message, optional metadata, and createdAt.
Resource types used in filters/UI: apiKey, workflow, schedule, run, credential, document, database, customTool, system (plus mail_message on the type).
Endpoints
| Method | Path | Auth | Body |
|---|---|---|---|
| GET | /api/v1/audit-logs | Bearer API key (any scope) | { auditEvents[] } |
| GET | /api/audit-logs | Session | { auditEvents[] } |
| tRPC | workspaceShell.auditLogs.list | Session | { auditEvents[] } |
v1 missing token: 401 { "error": "Valid bearer API key is required" }. Session foreign workspace: 403 { "error": "Cannot access audit logs for another workspace." } unless the user is a member of that workspace.
There is no create/update/delete HTTP API; writers call recordAuditEvent internally. In-memory copies keep the newest 250 events; Prisma persist is fire-and-forget (console.warn on failure).
Query parameters
| Param | Notes |
|---|---|
action | Exact action string (for example api_key.create) |
resourceType | Exact resource type |
limit | Default 100, clamped 1–200 |
v1 always filters to the API key workspace (no workspaceId query). Session uses workspaceId or the session workspace.
UI Settings → Audit Logs searches client-side (text, resource, severity, exact action) after fetching up to the selected limit, then Refresh.
Retention
FLUXUS_AUDIT_RETENTION_DAYS (default 365, clamped 1–3650) deletes old Prisma rows when observability retention runs. This is separate from Recently Deleted.