Audit log
What the audit log records, how to search it, how long it is kept, how to check it hasn't been altered and how it differs from request logs and version history.
The audit log is the record of who changed what: sign-ins, policy and table changes, deletions, restores and the rest of the events below, with the actor, the time and where it came from. Open it under Logs & Audit › Audit.
| Record | Answers | Where |
|---|---|---|
| Audit log (this page) | Who changed what, and when? | Logs & Audit › Audit |
| Request logs | Which requests came in, with status and timing? | Observability, Logs & Audit — Logs and log drains |
| Version history | What did the schema, policies or functions look like before, and can I go back? | Version history: see, undo and restore changes |
| Migration history | Which migrations ran, in which order? | Migrations |
What is recorded
| Area | Events |
|---|---|
| Sign-in | auth.login, auth.register, auth.logout |
| Organizations and projects | node.created, node.updated, node.deleted; memberships as edge.created, edge.deleted |
| Access policies | policy.created, policy.updated, policy.deleted, policy.evaluated |
| Tables | table.created, table.dropped; row changes row.inserted, row.updated, row.deleted where recorded |
| Version history | timeline.spawned, timeline.jumped, timeline.deleted, snapshot.created, snapshot.restored |
Each entry has the event type, the service that recorded it (axis, guard, gateway, atlas-rel, atlas-doc, echo, chrono, pulse, forge), the actor, the time and the details of the change. Security-relevant account events (new devices, password and two-factor changes) are also emailed to the person concerned.
Search and export
- Focus narrows to errors, security, policy, functions or data events; Source and Event type filter further.
- Select entries (Shift-click for a range) to Copy as JSON or Download them.
- Stream logs to your own tools continuously with log drains — Logs and log drains.
Tamper evidence
Entries are chained: each one includes a hash of the one before, so changing or removing an entry breaks the chain. Verify on the Audit page (or GET /api/v1/audit/verify) recomputes the chain and reports whether it is intact.
curl -s "https://<project-ref>.sovarias.in/api/v1/audit/verify" -H "Authorization: Bearer $TOKEN"
curl -s "https://<project-ref>.sovarias.in/api/v1/audit/count" -H "Authorization: Bearer $TOKEN"How long entries are kept
By plan; with HIPAA mode on, audit entries are kept for six years whatever the plan (HIPAA mode and PHI projects).
| Free | Pro | Ultra | Team | Enterprise | |
|---|---|---|---|---|---|
| Audit log retention | 1 day | 7 days | 30 days | 365 days | 365 days |
| Audit log retention while HIPAA mode is on | 2190 days | 2190 days | 2190 days | 2190 days | 2190 days |
Who can see it
Members with logs.read — every built-in role, including Viewer (Organizations, members and roles). App users never see it.