Audit Logs
The Vault maintains an immutable, append-only audit trail of every significant action taken within the platform. The audit log is a first-class compliance tool — it provides the evidence trail needed for internal controls reviews, external audits, and regulatory examinations.
What Is Logged
Every audit event captures:
- Timestamp — ISO 8601 UTC timestamp with millisecond precision
- Event type — Structured event code in
UPPER_SNAKE_CASE(e.g.,WALLET_CREATED,POLICY_CREATED) - Principal — The authenticated user or service account that performed the action
- Resource — The entity affected (wallet ID, transaction ID, user ID, etc.)
- Metadata — Event-specific detail (e.g., the old and new values for a policy change)
- IP address — The source IP of the request
- Session ID — The session that originated the action
Audited Event Categories
| Category | Example Events |
|---|---|
| Users | USER_REGISTRATION, USER_UPDATED, USER_DELETED, USER_PASSWORD_RESET_INITIATED |
| Wallets | WALLET_CREATED, WALLET_UPDATED, WALLET_DELETED |
| Transfers | TRANSFER_CREATED, TRANSFER_UPDATED, TRANSFER_DELIVERED, TRANSFER_FAILED |
| Policy | POLICY_CREATED, POLICY_UPDATED, POLICY_DELETED |
| Devices | DEVICE_APPROVED, CERTIFICATE_RENEWED, device status changes |
Audit events use UPPER_SNAKE_CASE codes, aligned with the
webhook event catalog.
Audit logging and webhook delivery are separate channels — the audit trail is
written regardless of whether any webhook is configured.
Immutability
Audit events are append-only and each event is cryptographically signed before it is stored by the dedicated audit service, so records cannot be silently altered after the fact. For the tamper-evidence architecture (signing, sealing, and immutable external storage), see Immutable Audit Logging.
For long-term retention beyond the Vault’s own database, configure the audit log export webhook or scheduled export to stream events to an immutable storage backend (e.g., AWS S3 with Object Lock, Azure Immutable Blob Storage).
Viewing Audit Logs
Navigate to Logs → Administrative Events in the dashboard. Columns include Date, Event, Initiator, Details, IP Address, and Result (success/failed). You can filter by date range, event type, initiator, and result. Click a row’s Details to see the full JSON payload.
Programmatic Access
Audit-log browsing and filtering is available in the dashboard. Programmatic audit-log access is not part of the public Client API; for machine ingestion use the SIEM streaming integration below or dashboard exports.
Exporting Audit Logs
A filtered set of administrative events can be exported to CSV from the Logs page (requires the export-logs permission) for offline analysis or SIEM ingestion.
Retention Policy
Audit logs are retained for a minimum of 7 years by default (configurable). Retention policy changes require Owner-level access and are themselves audit-logged.