[{"data":1,"prerenderedAt":1840},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fgovernance\u002Faudit-log":3,"docs-nav":1621},{"id":4,"title":5,"body":6,"description":16,"extension":1613,"meta":1614,"navigation":1616,"path":1617,"seo":1618,"stem":1619,"__hash__":1620},"docs\u002Fdocs\u002Fgovernance\u002Faudit-log.md","Audit log",{"type":7,"value":8,"toc":1601},"minimark",[9,13,17,22,117,121,124,238,248,266,270,275,316,323,332,336,927,933,977,1015,1019,1034,1253,1266,1269,1314,1355,1359,1404,1407,1410,1489,1496,1500,1527,1531,1567,1571,1597],[10,11,5],"h1",{"id":12},"audit-log",[14,15,16],"p",{},"The audit log records, one entry per action, who signed in, who changed what, what ran,\nwhat data left the installation and who changed the permissions. It is for whoever must\nanswer \"who did this, and when\": administrators, auditors, the security team. The log is\nappend-only, outlives the accounts that wrote it, and can be forwarded to a SIEM.",[18,19,21],"h2",{"id":20},"at-a-glance","At a glance",[23,24,25,36],"table",{},[26,27,28],"thead",{},[29,30,31,34],"tr",{},[32,33],"th",{},[32,35],{},[37,38,39,52,60,72,80,88,104],"tbody",{},[29,40,41,45],{},[42,43,44],"td",{},"Where",[42,46,47,51],{},[48,49,50],"strong",{},"Administration → Audit",": active sessions, sign-ins of the last 24 hours, and the log",[29,53,54,57],{},[42,55,56],{},"Who reads it",[42,58,59],{},"administrators in full; observers with emails masked and without addresses",[29,61,62,65],{},[42,63,64],{},"Over the API",[42,66,67,71],{},[68,69,70],"code",{},"GET \u002Faudit",", with the same rules",[29,73,74,77],{},[42,75,76],{},"What an entry holds",[42,78,79],{},"when, who, the action, success or failure, the target, a detail, the client address and browser",[29,81,82,85],{},[42,83,84],{},"Changing or deleting entries",[42,86,87],{},"not possible: only the retention window removes them",[29,89,90,93],{},[42,91,92],{},"Retention",[42,94,95,96,99,100,103],{},"forever by default (",[68,97,98],{},"AUDIT__RETENTION_MINUTES","); addresses emptied after 90 days (",[68,101,102],{},"AUDIT__IP_RETENTION_DAYS",")",[29,105,106,109],{},[42,107,108],{},"To a SIEM",[42,110,111,112,103],{},"Splunk, through the HTTP Event Collector (",[113,114,116],"a",{"href":115},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",[18,118,120],{"id":119},"how-it-works","How it works",[14,122,123],{},"Every action that matters writes one row. Writing it never fails the action: if the\naudit cannot be written, the error goes to the gateway's log and the person's action\ngoes on.",[23,125,126,135],{},[26,127,128],{},[29,129,130,133],{},[32,131,132],{},"Field",[32,134],{},[37,136,137,145,164,180,194,222,230],{},[29,138,139,142],{},[42,140,141],{},"When",[42,143,144],{},"the time of the action, in UTC",[29,146,147,150],{},[42,148,149],{},"Who",[42,151,152,153,156,157,160,161],{},"the account's email at that moment, and its id. The email stays even when the account is later renamed or deleted. A failed sign-in carries the email as typed; an email the scheduler sends carries ",[68,154,155],{},"scheduler","; the administrator the gateway creates at start from ",[68,158,159],{},"AUTH__ADMIN_EMAIL"," carries ",[68,162,163],{},"startup",[29,165,166,169],{},[42,167,168],{},"Action",[42,170,171,172,175,176,179],{},"a stable name such as ",[68,173,174],{},"flow.run"," or ",[68,177,178],{},"permission.grant",", listed below",[29,181,182,185],{},[42,183,184],{},"Outcome",[42,186,187,175,190,193],{},[68,188,189],{},"success",[68,191,192],{},"failure"," (a wrong password, a refused send)",[29,195,196,199],{},[42,197,198],{},"Target",[42,200,201,202,205,206,205,209,205,212,205,215,205,218,221],{},"its kind (",[68,203,204],{},"flow",", ",[68,207,208],{},"datasource",[68,210,211],{},"connection",[68,213,214],{},"user",[68,216,217],{},"permission",[68,219,220],{},"export","…), id and name at that moment",[29,223,224,227],{},[42,225,226],{},"Detail",[42,228,229],{},"the context, as JSON: the engine, the cron, the export format, the SQL of a script run, the old and new value of a setting, the reason of a failure",[29,231,232,235],{},[42,233,234],{},"Address, browser",[42,236,237],{},"the client's IP address and user agent",[14,239,240,243,244,247],{},[48,241,242],{},"Secrets never go in."," A token appears by its name, never its value; a SIEM token, a\nconnection password or a scripting variable's value is never written; a setting\nchange records what changed. When an API token does something, its name is added to\nthe detail (",[68,245,246],{},"\"token\": \"nightly-export\"","), so the actions of a leaked token can be found\nand undone.",[14,249,250,253,254,257,258,261,262,265],{},[48,251,252],{},"The client address"," is the address of the connection as the gateway's server sees\nit. Behind a reverse proxy, the ",[68,255,256],{},"X-Forwarded-For"," header is believed only from the\naddresses in ",[68,259,260],{},"FORWARDED_ALLOW_IPS"," (on Kubernetes, the chart's\n",[68,263,264],{},"gateway.trustedProxies","): anyone else cannot choose the address they appear to come\nfrom.",[18,267,269],{"id":268},"the-audit-page","The Audit page",[14,271,272,274],{},[48,273,50],{}," has three parts:",[276,277,278,293,299],"ul",{},[279,280,281,284,285,288,289,292],"li",{},[48,282,283],{},"Active sessions",": one row per open session (a browser, a script), with the\naccount, the sign-in method, the last activity and the address. An administrator\ncloses one with ",[48,286,287],{},"Sign out this session",": the next click of whoever uses it lands on\nthe sign-in page (",[68,290,291],{},"auth.session_revoke",").",[279,294,295,298],{},[48,296,297],{},"Access · last 24 hours",": successful and failed sign-ins per hour, in the\ninstallation's time zone.",[279,300,301,303,304,307,308,311,312,315],{},[48,302,5],{},": newest first, 50 per page. ",[48,305,306],{},"Search actor, target, IP…"," searches the\nemail, the target's name, the action and the address; ",[48,309,310],{},"All actions"," narrows to one\naction; ",[48,313,314],{},"Any outcome"," to successes or failures.",[14,317,318],{},[319,320],"img",{"alt":321,"src":322},"The audit log table: when, who, action, target, detail, IP and outcome, with a flow group created, a SQL script run and written, connections created and an SFTP host key accepted","\u002Fmedia\u002Fguide\u002Fgovernance\u002Faudit-log-table.png",[14,324,325],{},[326,327,328,329,331],"em",{},"The ",[48,330,5],{}," part of the page: each row says when, who, what, on which object, with what detail, from which address, and whether it succeeded.",[18,333,335],{"id":334},"what-is-recorded","What is recorded",[23,337,338,348],{},[26,339,340],{},[29,341,342,345],{},[32,343,344],{},"Area",[32,346,347],{},"Actions",[37,349,350,383,422,464,492,511,539,567,587,605,620,645,677,722,751,783,814,845],{},[29,351,352,355],{},[42,353,354],{},"Sign-in and sessions",[42,356,357,205,360,205,363,205,366,205,369,205,372,205,374,205,377,205,380],{},[68,358,359],{},"auth.login",[68,361,362],{},"auth.login_failed",[68,364,365],{},"auth.sso_login",[68,367,368],{},"auth.sso_login_failed",[68,370,371],{},"auth.logout",[68,373,291],{},[68,375,376],{},"auth.password_change",[68,378,379],{},"auth.first_run_setup",[68,381,382],{},"auth.bootstrap_login",[29,384,385,388],{},[42,386,387],{},"Accounts and groups",[42,389,390,205,393,396,397,205,400,205,403,205,406,205,409,412,413,205,416,205,419],{},[68,391,392],{},"user.create",[68,394,395],{},"user.update"," (a new name, or the email the identity provider changed), ",[68,398,399],{},"user.deactivate",[68,401,402],{},"user.reactivate",[68,404,405],{},"user.delete",[68,407,408],{},"group.create",[68,410,411],{},"group.update"," (its description), ",[68,414,415],{},"group.delete",[68,417,418],{},"group.member_add",[68,420,421],{},"group.member_remove",[29,423,424,427],{},[42,425,426],{},"Roles and access",[42,428,429,205,431,205,434,205,437,205,440,205,443,205,446,205,449,205,452,205,455,205,458,205,461],{},[68,430,178],{},[68,432,433],{},"permission.revoke",[68,435,436],{},"user.promote",[68,438,439],{},"user.demote",[68,441,442],{},"group.promote",[68,444,445],{},"group.demote",[68,447,448],{},"group.admin_join",[68,450,451],{},"group.admin_leave",[68,453,454],{},"user.observer_grant",[68,456,457],{},"user.observer_revoke",[68,459,460],{},"group.observer_grant",[68,462,463],{},"group.observer_revoke",[29,465,466,469],{},[42,467,468],{},"Tokens and integrations",[42,470,471,205,474,205,477,205,480,205,483,205,486,205,489],{},[68,472,473],{},"token.create",[68,475,476],{},"token.revoke",[68,478,479],{},"service_account.create",[68,481,482],{},"service_account.delete",[68,484,485],{},"webhook.create",[68,487,488],{},"webhook.update",[68,490,491],{},"webhook.delete",[29,493,494,497],{},[42,495,496],{},"Folders",[42,498,499,205,502,205,505,205,508],{},[68,500,501],{},"folder.create",[68,503,504],{},"folder.update",[68,506,507],{},"folder.move",[68,509,510],{},"folder.delete",[29,512,513,516],{},[42,514,515],{},"Flows",[42,517,518,205,521,205,524,205,527,205,529,205,532,205,535,538],{},[68,519,520],{},"flow.create",[68,522,523],{},"flow.update",[68,525,526],{},"flow.delete",[68,528,174],{},[68,530,531],{},"flow.schedule",[68,533,534],{},"flow.promote",[68,536,537],{},"transform.run"," (an unsaved flow run from the editor)",[29,540,541,544],{},[42,542,543],{},"Datasources and contracts",[42,545,546,205,549,205,552,205,555,205,558,205,561,205,564],{},[68,547,548],{},"datasource.create",[68,550,551],{},"datasource.update",[68,553,554],{},"datasource.delete",[68,556,557],{},"datasource.refresh",[68,559,560],{},"datasource.schedule",[68,562,563],{},"contract.save",[68,565,566],{},"contract.delete",[29,568,569,572],{},[42,570,571],{},"Connections",[42,573,574,205,577,205,580,205,583,586],{},[68,575,576],{},"connection.create",[68,578,579],{},"connection.update",[68,581,582],{},"connection.delete",[68,584,585],{},"connection.host_key_accept"," (an SFTP server's key accepted)",[29,588,589,592],{},[42,590,591],{},"Data leaving",[42,593,594,597,598,601,602],{},[68,595,596],{},"export.download"," (a CSV or Excel export), ",[68,599,600],{},"email.send"," (an Output node's email, a Pushmail cell, a contract notice), ",[68,603,604],{},"sql_script.export",[29,606,607,610],{},[42,608,609],{},"Free queries on the data",[42,611,612,615,616,619],{},[68,613,614],{},"sql_script.run"," (with its SQL and what it read), ",[68,617,618],{},"ai.query"," (each query the assistant runs for someone)",[29,621,622,625],{},[42,623,624],{},"SQL scripts",[42,626,627,205,630,205,633,205,636,205,639,205,642],{},[68,628,629],{},"sql_script.create",[68,631,632],{},"sql_script.update",[68,634,635],{},"sql_script.delete",[68,637,638],{},"sql_script.restore",[68,640,641],{},"sql_script.publish",[68,643,644],{},"sql_script.schedule",[29,646,647,650],{},[42,648,649],{},"Reports",[42,651,652,205,655,205,658,205,661,205,664,205,667,205,670,205,673,676],{},[68,653,654],{},"report.create",[68,656,657],{},"report.update",[68,659,660],{},"report.delete",[68,662,663],{},"report.move",[68,665,666],{},"report.rename",[68,668,669],{},"report.duplicate",[68,671,672],{},"report.restore",[68,674,675],{},"report.render"," (every render, with its format, the values of its parameters, the outcome and where it came from: the interface, the API, a notebook or a flow group)",[29,678,679,682],{},[42,680,681],{},"Dashboards",[42,683,684,205,687,205,690,205,693,205,696,205,699,205,702,205,705,205,708,711,712,205,715,205,718,721],{},[68,685,686],{},"dashboard.create",[68,688,689],{},"dashboard.update",[68,691,692],{},"dashboard.delete",[68,694,695],{},"dashboard.move",[68,697,698],{},"dashboard.rename",[68,700,701],{},"dashboard.duplicate",[68,703,704],{},"dashboard.restore",[68,706,707],{},"dashboard.open",[68,709,710],{},"dashboard.render"," (with its format, its parameters, its clicks and where it came from: ",[68,713,714],{},"interface",[68,716,717],{},"api",[68,719,720],{},"flow_group","). A click and an automatic refresh are not recorded",[29,723,724,727],{},[42,725,726],{},"Python and R scripts",[42,728,729,205,732,205,735,205,738,205,741,205,744,205,747,750],{},[68,730,731],{},"script.create",[68,733,734],{},"script.update",[68,736,737],{},"script.delete",[68,739,740],{},"script.restore",[68,742,743],{},"script.run",[68,745,746],{},"script.schedule",[68,748,749],{},"scripting.trial"," (a Script node run from the editor)",[29,752,753,756],{},[42,754,755],{},"Containers",[42,757,758,761,762,205,765,205,768,205,771,205,774,205,777,205,780],{},[68,759,760],{},"container.trial"," (a Container node run from the editor), ",[68,763,764],{},"registry.create",[68,766,767],{},"registry.update",[68,769,770],{},"registry.delete",[68,772,773],{},"registry.test",[68,775,776],{},"registry.cluster_test",[68,778,779],{},"registry.variable_set",[68,781,782],{},"registry.variable_delete",[29,784,785,788],{},[42,786,787],{},"Scripting environments",[42,789,790,205,793,205,796,205,799,205,802,205,805,205,808,205,811],{},[68,791,792],{},"scripting.storage_update",[68,794,795],{},"scripting.storage_test",[68,797,798],{},"scripting.environment_create",[68,800,801],{},"scripting.environment_update",[68,803,804],{},"scripting.environment_delete",[68,806,807],{},"scripting.version_current",[68,809,810],{},"scripting.variable_set",[68,812,813],{},"scripting.variable_delete",[29,815,816,819],{},[42,817,818],{},"Saved views and flow groups",[42,820,821,205,824,205,827,205,830,205,833,205,836,205,839,205,842],{},[68,822,823],{},"saved_view.create",[68,825,826],{},"saved_view.update",[68,828,829],{},"saved_view.delete",[68,831,832],{},"flow_group.create",[68,834,835],{},"flow_group.update",[68,837,838],{},"flow_group.delete",[68,840,841],{},"flow_group.run",[68,843,844],{},"flow_group.schedule",[29,846,847,850],{},[42,848,849],{},"Administration",[42,851,852,205,855,205,858,205,861,205,864,205,867,205,870,205,873,205,876,205,879,205,882,205,885,205,888,205,891,205,894,205,897,205,900,205,903,205,906,205,909,205,912,205,915,205,918,205,921,205,924],{},[68,853,854],{},"settings.update",[68,856,857],{},"settings.rollout",[68,859,860],{},"settings.rollout_cancel",[68,862,863],{},"engine_settings.update",[68,865,866],{},"engine.allow",[68,868,869],{},"engine.disallow",[68,871,872],{},"ai.provider_create",[68,874,875],{},"ai.provider_update",[68,877,878],{},"ai.provider_delete",[68,880,881],{},"ai.model_enable",[68,883,884],{},"ai.model_disable",[68,886,887],{},"ai.prompt_update",[68,889,890],{},"ai.prompt_reset",[68,892,893],{},"privacy.update",[68,895,896],{},"banner.create",[68,898,899],{},"banner.delete",[68,901,902],{},"siem.update",[68,904,905],{},"siem.test",[68,907,908],{},"backup.update",[68,910,911],{},"backup.request",[68,913,914],{},"backup.run",[68,916,917],{},"backup.download",[68,919,920],{},"workers.scaling_update",[68,922,923],{},"workers.scaling_reset",[68,925,926],{},"queue.job_stop",[14,928,929,930,932],{},"A schedule switched off because someone else widened what it does is recorded too, as\na ",[68,931,531],{}," (or the object's own schedule action) with the reason, so \"why did my\nnightly run stop\" has an answer in the log.",[14,934,935,938,939,942,943,946,947,175,950,953,954,956,957,959,960,962,963,965,966,968,969,175,971,973,974,976],{},[48,936,937],{},"Accounts and groups."," An entry names the account or the group, and what changed from\nwhat to what (",[68,940,941],{},"{\"full_name\": {\"from\": \"Anna\", \"to\": \"Anna Bianchi\"}}","); a password never\nappears. A membership's target is the person, with the group in the detail\n(",[68,944,945],{},"{\"group\": \"finance\", \"group_id\": 4}",", plus ",[68,948,949],{},"\"admin\": true",[68,951,952],{},"\"observer\": true"," when\nthe group carries that role). Joining or leaving an administrators' group writes\n",[68,955,418],{}," (or ",[68,958,421],{},") and then ",[68,961,448],{}," (or\n",[68,964,451],{},"): the first action holds a group's whole membership history, the\nsecond every change of privileges. Deleting a group writes one ",[68,967,415],{}," with the\nnumber of its members, not a removal per person, and a role the group carried is\nwithdrawn as ",[68,970,445],{},[68,972,463],{},". A change that changes nothing (a\nform saved again, an account deactivated twice) writes nothing. The first administrator\nof a try-it stack, created at the sign-in page, is ",[68,975,379],{},".",[14,978,979,982,983,986,987,989,990,992,993,996,997,999,1000,205,1002,1004,1005,996,1008,205,1010,1012,1013,976],{},[48,980,981],{},"What single sign-on does by itself"," goes with the same actions and ",[68,984,985],{},"\"via\": \"sso\""," in\nthe detail: the account created at its first sign-in (",[68,988,392],{},"), the email or name\nthe identity provider changed (",[68,991,395],{},"), a group created by\n",[68,994,995],{},"OIDC__AUTO_CREATE_GROUPS"," (",[68,998,408],{},"), each membership the synchronization adds or\nremoves (",[68,1001,418],{},[68,1003,421],{},"), and the administrator rights of\n",[68,1006,1007],{},"OIDC__SUPERUSER_GROUP",[68,1009,436],{},[68,1011,439],{},"). Their actor is the person\nsigning in, the change happening in their sign-in; a sign-in that changes nothing writes\nonly its ",[68,1014,365],{},[18,1016,1018],{"id":1017},"example","Example",[14,1020,1021,1022,1025,1026,1029,1030,1033],{},"An administrator gives the ",[68,1023,1024],{},"finance"," group VIEW on the ",[48,1027,1028],{},"Sales"," folder. The entry, as\n",[68,1031,1032],{},"GET \u002Faudit?action=permission.grant"," returns it:",[1035,1036,1041],"pre",{"className":1037,"code":1038,"language":1039,"meta":1040,"style":1040},"language-json shiki shiki-themes github-dark-dimmed github-light","{\n  \"id\": 48213,\n  \"ts\": \"2026-10-27T08:14:03.512000+00:00\",\n  \"actor_id\": 1,\n  \"actor_label\": \"marta.bianchi@example.com\",\n  \"action\": \"permission.grant\",\n  \"outcome\": \"success\",\n  \"target_type\": \"permission\",\n  \"target_id\": 57,\n  \"target_label\": \"view\",\n  \"detail\": {\"project_id\": 7, \"user_id\": null, \"group_id\": 4, \"capability\": \"view\"},\n  \"ip\": \"10.20.4.17\",\n  \"user_agent\": \"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) …\"\n}\n","json","",[68,1042,1043,1052,1069,1083,1096,1109,1122,1135,1148,1161,1174,1223,1236,1247],{"__ignoreMap":1040},[1044,1045,1048],"span",{"class":1046,"line":1047},"line",1,[1044,1049,1051],{"class":1050},"ssh_m","{\n",[1044,1053,1055,1059,1062,1066],{"class":1046,"line":1054},2,[1044,1056,1058],{"class":1057},"sJK54","  \"id\"",[1044,1060,1061],{"class":1050},": ",[1044,1063,1065],{"class":1064},"swcJU","48213",[1044,1067,1068],{"class":1050},",\n",[1044,1070,1072,1075,1077,1081],{"class":1046,"line":1071},3,[1044,1073,1074],{"class":1057},"  \"ts\"",[1044,1076,1061],{"class":1050},[1044,1078,1080],{"class":1079},"sXfbr","\"2026-10-27T08:14:03.512000+00:00\"",[1044,1082,1068],{"class":1050},[1044,1084,1086,1089,1091,1094],{"class":1046,"line":1085},4,[1044,1087,1088],{"class":1057},"  \"actor_id\"",[1044,1090,1061],{"class":1050},[1044,1092,1093],{"class":1064},"1",[1044,1095,1068],{"class":1050},[1044,1097,1099,1102,1104,1107],{"class":1046,"line":1098},5,[1044,1100,1101],{"class":1057},"  \"actor_label\"",[1044,1103,1061],{"class":1050},[1044,1105,1106],{"class":1079},"\"marta.bianchi@example.com\"",[1044,1108,1068],{"class":1050},[1044,1110,1112,1115,1117,1120],{"class":1046,"line":1111},6,[1044,1113,1114],{"class":1057},"  \"action\"",[1044,1116,1061],{"class":1050},[1044,1118,1119],{"class":1079},"\"permission.grant\"",[1044,1121,1068],{"class":1050},[1044,1123,1125,1128,1130,1133],{"class":1046,"line":1124},7,[1044,1126,1127],{"class":1057},"  \"outcome\"",[1044,1129,1061],{"class":1050},[1044,1131,1132],{"class":1079},"\"success\"",[1044,1134,1068],{"class":1050},[1044,1136,1138,1141,1143,1146],{"class":1046,"line":1137},8,[1044,1139,1140],{"class":1057},"  \"target_type\"",[1044,1142,1061],{"class":1050},[1044,1144,1145],{"class":1079},"\"permission\"",[1044,1147,1068],{"class":1050},[1044,1149,1151,1154,1156,1159],{"class":1046,"line":1150},9,[1044,1152,1153],{"class":1057},"  \"target_id\"",[1044,1155,1061],{"class":1050},[1044,1157,1158],{"class":1064},"57",[1044,1160,1068],{"class":1050},[1044,1162,1164,1167,1169,1172],{"class":1046,"line":1163},10,[1044,1165,1166],{"class":1057},"  \"target_label\"",[1044,1168,1061],{"class":1050},[1044,1170,1171],{"class":1079},"\"view\"",[1044,1173,1068],{"class":1050},[1044,1175,1177,1180,1183,1186,1188,1191,1193,1196,1198,1201,1203,1206,1208,1211,1213,1216,1218,1220],{"class":1046,"line":1176},11,[1044,1178,1179],{"class":1057},"  \"detail\"",[1044,1181,1182],{"class":1050},": {",[1044,1184,1185],{"class":1057},"\"project_id\"",[1044,1187,1061],{"class":1050},[1044,1189,1190],{"class":1064},"7",[1044,1192,205],{"class":1050},[1044,1194,1195],{"class":1057},"\"user_id\"",[1044,1197,1061],{"class":1050},[1044,1199,1200],{"class":1064},"null",[1044,1202,205],{"class":1050},[1044,1204,1205],{"class":1057},"\"group_id\"",[1044,1207,1061],{"class":1050},[1044,1209,1210],{"class":1064},"4",[1044,1212,205],{"class":1050},[1044,1214,1215],{"class":1057},"\"capability\"",[1044,1217,1061],{"class":1050},[1044,1219,1171],{"class":1079},[1044,1221,1222],{"class":1050},"},\n",[1044,1224,1226,1229,1231,1234],{"class":1046,"line":1225},12,[1044,1227,1228],{"class":1057},"  \"ip\"",[1044,1230,1061],{"class":1050},[1044,1232,1233],{"class":1079},"\"10.20.4.17\"",[1044,1235,1068],{"class":1050},[1044,1237,1239,1242,1244],{"class":1046,"line":1238},13,[1044,1240,1241],{"class":1057},"  \"user_agent\"",[1044,1243,1061],{"class":1050},[1044,1245,1246],{"class":1079},"\"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) …\"\n",[1044,1248,1250],{"class":1046,"line":1249},14,[1044,1251,1252],{"class":1050},"}\n",[14,1254,1255,1256,1068,1259,1262,1263,976],{},"An observer reading the same entry sees ",[68,1257,1258],{},"\"actor_label\": \"m***@example.com\"",[68,1260,1261],{},"\"ip\": null"," and ",[68,1264,1265],{},"\"user_agent\": null",[14,1267,1268],{},"Reading the log from a script, with the token of an administrator or a service account\nthat may read it:",[1035,1270,1274],{"className":1271,"code":1272,"language":1273,"meta":1040,"style":1040},"language-bash shiki shiki-themes github-dark-dimmed github-light","curl -s -H \"Authorization: Bearer tab_…\" \\\n  \"https:\u002F\u002Ftabularia.example.com\u002Fapi\u002Faudit?action=export.download&since=2026-10-01T00:00:00&limit=200\" \\\n  | jq '.items[] | {ts, actor_label, target_label, detail}'\n","bash",[68,1275,1276,1295,1302],{"__ignoreMap":1040},[1044,1277,1278,1282,1285,1288,1291],{"class":1046,"line":1047},[1044,1279,1281],{"class":1280},"sqRhv","curl",[1044,1283,1284],{"class":1064}," -s",[1044,1286,1287],{"class":1064}," -H",[1044,1289,1290],{"class":1079}," \"Authorization: Bearer tab_…\"",[1044,1292,1294],{"class":1293},"sxsTv"," \\\n",[1044,1296,1297,1300],{"class":1046,"line":1054},[1044,1298,1299],{"class":1079},"  \"https:\u002F\u002Ftabularia.example.com\u002Fapi\u002Faudit?action=export.download&since=2026-10-01T00:00:00&limit=200\"",[1044,1301,1294],{"class":1293},[1044,1303,1304,1308,1311],{"class":1046,"line":1071},[1044,1305,1307],{"class":1306},"s6PUj","  |",[1044,1309,1310],{"class":1280}," jq",[1044,1312,1313],{"class":1079}," '.items[] | {ts, actor_label, target_label, detail}'\n",[14,1315,1316,1317,1320,1321,205,1324,1068,1327,205,1330,205,1333,205,1336,1262,1339,1342,1343,1346,1347,1350,1351,1354],{},"The answer is a page, ",[68,1318,1319],{},"{\"items\": […], \"total\": n}","; the filters are ",[68,1322,1323],{},"q",[68,1325,1326],{},"action",[68,1328,1329],{},"target_type",[68,1331,1332],{},"outcome",[68,1334,1335],{},"actor_id",[68,1337,1338],{},"since",[68,1340,1341],{},"until"," (UTC), ",[68,1344,1345],{},"limit"," (up to 200) and ",[68,1348,1349],{},"offset",".\n",[68,1352,1353],{},"GET \u002Faudit\u002Factions"," lists the actions present in the log.",[18,1356,1358],{"id":1357},"permissions","Permissions",[23,1360,1361,1370],{},[26,1362,1363],{},[29,1364,1365,1367],{},[32,1366,149],{},[32,1368,1369],{},"Sees",[37,1371,1372,1380,1392],{},[29,1373,1374,1377],{},[42,1375,1376],{},"Administrators",[42,1378,1379],{},"every entry, in full; they close other people's sessions",[29,1381,1382,1385],{},[42,1383,1384],{},"Observers",[42,1386,1387,1388,1391],{},"every entry, with emails masked (",[68,1389,1390],{},"a***@example.com","), no address or browser, and in the detail no hosts, paths, SQL, recipients, identity-provider groups or people's names; their search covers only the action and targets that are not emails; they close nothing",[29,1393,1394,1397],{},[42,1395,1396],{},"Everyone else",[42,1398,1399,1400,1403],{},"nothing; ",[48,1401,1402],{},"Your sessions",", in the settings menu, lists their own sessions",[14,1405,1406],{},"An observer's own actions are recorded without their address and browser: what they did\nstays, where they came from does not. A failed sign-in keeps its address whoever it\nclaims to be, because that is what the defences against password guessing rest on.",[18,1408,92],{"id":1409},"retention",[23,1411,1412,1425],{},[26,1413,1414],{},[29,1415,1416,1419,1422],{},[32,1417,1418],{},"What",[32,1420,1421],{},"How long",[32,1423,1424],{},"Setting",[37,1426,1427,1440,1453,1463,1476],{},[29,1428,1429,1432,1435],{},[42,1430,1431],{},"Audit entries",[42,1433,1434],{},"forever, or the window you set, checked once a minute",[42,1436,1437,1439],{},[68,1438,98],{}," (0 = forever; 43200 = 30 days)",[29,1441,1442,1445,1448],{},[42,1443,1444],{},"Client addresses and browsers, in audit entries, sessions and API tokens",[42,1446,1447],{},"90 days, then emptied once an hour; the entry stays",[42,1449,1450,1452],{},[68,1451,102],{}," (0 = forever)",[29,1454,1455,1458,1461],{},[42,1456,1457],{},"A deleted account's addresses",[42,1459,1460],{},"emptied at once, failed sign-ins with its email included; its entries stay with the email",[42,1462],{},[29,1464,1465,1468,1471],{},[42,1466,1467],{},"Run logs (what a Script or Container node printed, the engine's full error)",[42,1469,1470],{},"30 days, then emptied; the run stays with its outcome and short error",[42,1472,1473],{},[68,1474,1475],{},"ORCHESTRATOR__LOG_RETENTION_DAYS",[29,1477,1478,1481,1484],{},[42,1479,1480],{},"The assistant's conversations",[42,1482,1483],{},"deleted 90 days after their last use",[42,1485,1486],{},[68,1487,1488],{},"ORCHESTRATOR__AI_CHAT_RETENTION_DAYS",[14,1490,1491,1492,292],{},"Deleting entries is never a person's choice: no route deletes them, and deleting an\naccount does not delete what it did. Turning on a retention window is the installer's\ndecision; with SIEM forwarding on, entries older than the window are deleted even if\nSplunk has not received them yet (",[113,1493,1495],{"href":1494},"\u002Fdocs\u002Fsiem-splunk#delivery","delivery",[18,1497,1499],{"id":1498},"privacy-notice","Privacy notice",[14,1501,1502,1505,1506,205,1509,1512,1513,1516,1517,1520,1521,1524,1525,292],{},[48,1503,1504],{},"Administration → Privacy"," sets the notice shown in a bar at the top of every\npage: ",[48,1507,1508],{},"Line in the bar",[48,1510,1511],{},"Full text (Markdown)",", an optional ",[48,1514,1515],{},"Link to your\norganisation's policy",", and ",[48,1518,1519],{},"show the notice to everyone",". The starting text\ndescribes what the installation really records, for full accounts and for read-only\nguests, and where data goes (the assistant sends questions and the rows it reads to the\nconfigured model provider). Rewrite it if your processing differs. The placeholder\n",[68,1522,1523],{},"{audit_retention}"," becomes the configured audit retention, so the notice cannot drift\nfrom the configuration. Every change is recorded (",[68,1526,893],{},[18,1528,1530],{"id":1529},"limits-and-good-to-know","Limits and good to know",[276,1532,1533,1539,1555,1561],{},[279,1534,1535,1538],{},[48,1536,1537],{},"Not recorded",": reading. Opening a flow, a preview, the Viewer, a datasource's\npage are not in the log; exports, SQL script runs and the assistant's queries are.",[279,1540,1541,1544,1545,1547,1548,1551,1552,1554],{},[48,1542,1543],{},"Older entries."," Up to 1.2.2 an account showed only when it was created\nadministrator or observer, a deactivation only as the closing of its sessions\n(",[68,1546,291],{}," with the reason ",[68,1549,1550],{},"deactivated","), and the memberships of\nordinary groups, a deleted group and what single sign-on changed not at all (except\ninside the detail of each ",[68,1553,365],{},", which still carries it).",[279,1556,1557,1560],{},[48,1558,1559],{},"No export button."," Use the API above, or forward the log to a SIEM.",[279,1562,1563,1566],{},[48,1564,1565],{},"Large logs."," Entries are indexed by time, action, actor and target kind; on a busy\ninstallation set a retention window and keep the long history in the SIEM.",[18,1568,1570],{"id":1569},"related","Related",[276,1572,1573,1578,1584,1591],{},[279,1574,1575,1577],{},[113,1576,116],{"href":115},": forwarding, delivery guarantees, searches.",[279,1579,1580,1583],{},[113,1581,1358],{"href":1582},"\u002Fdocs\u002Fgovernance\u002Fpermissions",": administrators, observers, what each action needs.",[279,1585,1586,1590],{},[113,1587,1589],{"href":1588},"\u002Fdocs\u002Fgovernance","Security and governance",": the map.",[279,1592,1593,976],{},[113,1594,1596],{"href":1595},"\u002Fdocs\u002Fconfiguration#webhooks-and-audit-log","Configuration: webhooks and audit log",[1598,1599,1600],"style",{},"html pre.shiki code .ssh_m, html code.shiki .ssh_m{--shiki-default:#ADBAC7;--shiki-light:#24292E}html pre.shiki code .sJK54, html code.shiki .sJK54{--shiki-default:#8DDB8C;--shiki-light:#005CC5}html pre.shiki code .swcJU, html code.shiki .swcJU{--shiki-default:#6CB6FF;--shiki-light:#005CC5}html pre.shiki code .sXfbr, html code.shiki .sXfbr{--shiki-default:#96D0FF;--shiki-light:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .sqRhv, html code.shiki .sqRhv{--shiki-default:#F69D50;--shiki-light:#6F42C1}html pre.shiki code .sxsTv, html code.shiki .sxsTv{--shiki-default:#F47067;--shiki-light:#005CC5}html pre.shiki code .s6PUj, html code.shiki .s6PUj{--shiki-default:#F47067;--shiki-light:#D73A49}",{"title":1040,"searchDepth":1054,"depth":1071,"links":1602},[1603,1604,1605,1606,1607,1608,1609,1610,1611,1612],{"id":20,"depth":1054,"text":21},{"id":119,"depth":1054,"text":120},{"id":268,"depth":1054,"text":269},{"id":334,"depth":1054,"text":335},{"id":1017,"depth":1054,"text":1018},{"id":1357,"depth":1054,"text":1358},{"id":1409,"depth":1054,"text":92},{"id":1498,"depth":1054,"text":1499},{"id":1529,"depth":1054,"text":1530},{"id":1569,"depth":1054,"text":1570},"md",{"source":1615},"docs\u002Fgovernance\u002Faudit-log.md",true,"\u002Fdocs\u002Fgovernance\u002Faudit-log",{"title":5,"description":16},"docs\u002Fgovernance\u002Faudit-log","JkDZlvpp2Wlin871o02ep2UXYV8Bas4mW-RXj6E7ZgU",[1622,1641,1695,1727,1758,1785,1806,1832],{"title":1623,"icon":1624,"intro":1625,"items":1626},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[1627,1629,1632,1635,1638],{"path":1628,"title":1623},"\u002Fdocs\u002Fgetting-started",{"path":1630,"title":1631},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":1633,"title":1634},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":1636,"title":1637},"\u002Fdocs\u002Fconcepts","Concepts",{"path":1639,"title":1640},"\u002Fdocs\u002Foverview","Overview (README)",{"title":1642,"icon":1643,"intro":1644,"items":1645},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[1646,1649,1652,1655,1658,1661,1664,1666,1669,1671,1674,1677,1680,1683,1686,1689,1692],{"path":1647,"title":1648},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":1650,"title":1651},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":1653,"title":1654},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":1656,"title":1657},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":1659,"title":1660},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":1662,"title":1663},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":1665,"title":681},"\u002Fdocs\u002Fcapabilities\u002Fdashboards",{"path":1667,"title":1668},"\u002Fdocs\u002Fscripting","Python and R",{"path":1670,"title":624},"\u002Fdocs\u002Fsql-scripts",{"path":1672,"title":1673},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":1675,"title":1676},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":1678,"title":1679},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":1681,"title":1682},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",{"path":1684,"title":1685},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":1687,"title":1688},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":1690,"title":1691},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":1693,"title":1694},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":1696,"icon":1697,"intro":1698,"items":1699},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[1700,1703,1706,1709,1712,1715,1718,1721,1724],{"path":1701,"title":1702},"\u002Fdocs\u002Fsources","All sources",{"path":1704,"title":1705},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":1707,"title":1708},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":1710,"title":1711},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":1713,"title":1714},"\u002Fdocs\u002Fsftp","SFTP folders",{"path":1716,"title":1717},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",{"path":1719,"title":1720},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":1722,"title":1723},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":1725,"title":1726},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":571,"icon":1728,"intro":1729,"items":1730},"connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[1731,1734,1737,1740,1743,1745,1746,1748,1749,1752,1755],{"path":1732,"title":1733},"\u002Fdocs\u002Fconnections","All connections",{"path":1735,"title":1736},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":1738,"title":1739},"\u002Fdocs\u002Fsqlserver","Microsoft SQL Server driver",{"path":1741,"title":1742},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":1713,"title":1744},"SFTP servers",{"path":1716,"title":1717},{"path":1719,"title":1747},"SharePoint",{"path":1722,"title":1723},{"path":1750,"title":1751},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":1753,"title":1754},"\u002Fdocs\u002Fcontainer-registries","Container registries",{"path":1756,"title":1757},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":1759,"icon":1760,"intro":1761,"items":1762},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[1763,1766,1769,1772,1775,1778,1781,1782],{"path":1764,"title":1765},"\u002Fdocs\u002Fintegrations","All integrations",{"path":1767,"title":1768},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":1770,"title":1771},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":1773,"title":1774},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":1776,"title":1777},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":1779,"title":1780},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",{"path":115,"title":116},{"path":1783,"title":1784},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring",{"title":1786,"icon":1787,"intro":1788,"items":1789},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[1790,1792,1793,1794,1797,1800,1803],{"path":1588,"title":1791},"Overview",{"path":1582,"title":1358},{"path":1617,"title":5},{"path":1795,"title":1796},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":1798,"title":1799},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","SSO and group mapping",{"path":1801,"title":1802},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":1804,"title":1805},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":1807,"icon":1808,"intro":1809,"items":1810},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[1811,1814,1817,1820,1823,1826,1829],{"path":1812,"title":1813},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":1815,"title":1816},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":1818,"title":1819},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":1821,"title":1822},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":1824,"title":1825},"\u002Fdocs\u002Fconfiguration","Configuration reference",{"path":1827,"title":1828},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":1830,"title":1831},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":1833,"icon":1834,"intro":1835,"items":1836},"Reference","reference","Release process and the remaining reference pages.",[1837],{"path":1838,"title":1839},"\u002Fdocs\u002Frelease-process","Release process",1793656372185]