An audit event includes an ID, workspace, actor, action, resource, payload, optional correlation ID and occurrence time. The browser resolves readable record and member names where possible while retaining the technical identifiers in the expanded event.

Interpret events in context

Credential storage, metadata access, secret leasing and reading, rotation, archive/restore and permission changes are different actions. A metadata-read event does not mean plaintext was returned. A failed authorization records a different outcome from a successful read.

Use the credential’s Activity tab for a focused investigation. The workspace Activity & audit page loads the most recent 100 events, filters that set, and pages through 20 at a time. The client method listAudit({ limit }) is a separate API request; the browser’s filter is not a historical server-wide query.

Integrity, retention and export

Application writes are append-only, and covered events participate in a per-tenant hash chain. This helps detect covered tampering; it is not protection against every possible fully privileged compromise. Plan retention and configured export services determine what history and exports are available.

When reporting a problem, include the action, time, workspace and event/correlation ID. Do not include a decrypted value. See reviewing activity for the user workflow and security for the limits.

Screen reference

Open this screenshot at full size.