Audit Log

The Audit Log is an append-only record of every security-sensitive action taken inside a SyAuth workspace: logins (successful and failed), password changes, OAuth client lifecycle, API token creation/revocation, workspace membership changes, and more.

It gives you three things out of the box:

• Traceability — who did what, from which IP, at what time.
• Incident response — filter by actor, target, IP, or event type to reconstruct a timeline.
• Compliance — a documented activity trail for SOC 2, ISO 27001, and GDPR assessments.

Events are immutable: there is no update or delete endpoint, and no admin can rewrite history.

---

View the audit log in the Dashboard

Open the SyAuth Dashboard and click Audit Log in the sidebar.

Filters available at the top of the page:

Filter	Matches
Event type	Exact event, e.g. login_success, oauth_client_secret_reset
Severity	info, warn, error
Actor ID	The UUID of the developer or end user who performed the action
IP address	The source IP captured from the request
From / To	A time window on created_at

Each row expands to show the full JSON payload: metadata, user_agent, request_id, linked oauth_client_id, and any event-specific details.

---

API reference

GET /developer/audit/

Lists events for a workspace. The authenticated developer must be a member of the workspace; cross-workspace listing is not supported.

Query parameters

Parameter	Type	Required	Description
workspace_id	UUID	yes	Workspace to list events for
event_type	string	no	Exact event-type match (see table below)
severity	info | warn | error	no	—
actor_id	string	no	UUID or developer id of the actor
actor_type	developer | end_user | api_token | oauth_client | system | anonymous	no	—
target_id	string	no	Target entity id
ip_address	string	no	Source IP
from	ISO-8601	no	Lower bound on created_at
to	ISO-8601	no	Upper bound on created_at
limit	integer	no	1–100, default 50
cursor	ISO-8601	no	Pagination cursor — pass next_cursor from the previous response

Response

{
  "results": [
    {
      "id": "a8c7e2f0-0000-4000-8000-000000000000",
      "workspace_id": "b1...",
      "event_type": "oauth_client_secret_reset",
      "severity": "warn",
      "actor_type": "developer",
      "actor_id": "dev_01HZ...",
      "actor_email": "[email protected]",
      "target_type": "OAuthClient",
      "target_id": "c2...",
      "oauth_client_id": "c2...",
      "ip_address": "203.0.113.42",
      "user_agent": "Mozilla/5.0 ...",
      "request_id": "req_7f1a",
      "message": "OAuth client 'Web App' secret rotated",
      "metadata": {},
      "created_at": "2026-04-17T10:12:34Z"
    }
  ],
  "next_cursor": "2026-04-17T10:09:01Z",
  "limit": 50
}

Paginate by passing next_cursor back as cursor on the next request. next_cursor is null when you have reached the end.

cURL example

curl -G "https://api.syauth.com/developer/audit/" \
  --data-urlencode "workspace_id=b1..." \
  --data-urlencode "event_type=login_failure" \
  --data-urlencode "from=2026-04-17T00:00:00Z" \
  -H "Cookie: sessionid=..."

---

Event catalog

Full list of event types currently emitted:

Authentication

Event	Severity	When emitted
login_success	info	End user logged in
login_failure	warn	Wrong password or user not found
logout	info	End user logged out
register	info	New end user account created
email_verify_send	info	Verification email sent
email_verify_confirm	info	Email verification completed
password_reset_request	info	Password reset email sent
password_reset_confirm	warn	Password reset completed
password_update	warn	Authenticated user changed own password

OAuth / clients

Event	Severity	When emitted
oauth_client_create	info	New OAuth client created
oauth_client_update	info	OAuth client configuration changed
oauth_client_delete	warn	OAuth client deleted
oauth_client_secret_reset	warn	Client secret rotated
oauth_token_issue	info	Access/refresh token issued (planned)
oauth_token_revoke	warn	Token revoked (planned)
oauth_consent_grant	info	End user granted consent to a client (planned)

Workspace

Event	Severity	When emitted
workspace_create	info	New workspace created
workspace_update	info	Workspace settings changed (planned)
workspace_delete	warn	Workspace deleted
workspace_member_add	warn	Developer added as member
workspace_member_remove	warn	Member removed
workspace_invite_send	info	Invitation sent (planned)
workspace_invite_accept	info	Invitation accepted (planned)

Credentials

Event	Severity	When emitted
api_token_create	warn	API token created
api_token_revoke	warn	API token revoked
dev_token_create	warn	Developer access token created (planned)
dev_token_revoke	warn	Developer access token revoked (planned)

End-user management

Event	Severity	When emitted
user_create	info	Developer created an end user (planned)
user_update	info	End user profile changed (planned)
user_delete	warn	End user deleted (planned)
user_group_assign	info	User added to group (planned)
user_group_unassign	info	User removed from group (planned)

External providers and custom databases

Event	Severity	When emitted
external_provider_create	info	Social/OIDC provider configured (planned)
external_provider_update	info	Provider reconfigured (planned)
external_provider_delete	warn	Provider removed (planned)
custom_db_connect	info	Custom database connection created (planned)
custom_db_disconnect	warn	Custom database disconnected (planned)
custom_db_sync_fail	error	Custom database sync failed (planned)

Events marked (planned) have their event-type constants reserved and may be empty today; they will be populated as the emit points are wired in subsequent releases. The constant list is append-only — new events are added, never renamed.

---

Event fields

Field	Notes
id	UUID, stable identifier for the event
workspace_id	UUID of the owning workspace, or null for pre-workspace/system events
event_type	One of the catalog above
severity	info | warn | error
actor_type	Who initiated the action
actor_id	UUID / developer id — may be null for anonymous events like a login attempt against a non-existent email
actor_email	Best-effort email of the actor for display purposes
target_type	Entity class name, e.g. OAuthClient, ExtsUser, ExtsApiToken
target_id	Target entity id
oauth_client_id	Linked OAuth client for end-user events
ip_address	Extracted from X-Forwarded-For or REMOTE_ADDR
user_agent	Truncated to 1000 chars
request_id	From X-Request-Id header — pair this with your own logs for a full trace
message	Short human-readable summary (≤ 255 chars)
metadata	Arbitrary JSON with event-specific fields
created_at	ISO-8601 UTC

---

Operational characteristics

• Append-only — no update or delete endpoints.
• Resilient — if the audit write fails for any reason (cache unavailable, transient DB error), the surrounding request still succeeds. Audit must never break the flow it observes.
• Workspace-scoped — every read is gated by explicit WorkspaceMember or owner check. There is no cross-tenant listing.
• Indexed on (workspace, -created_at), (workspace, event_type, -created_at), actor_id, target_id, and ip_address for fast filtered queries.
• Retention — events are retained indefinitely on current plans. Tiered retention (e.g. 90 days for Free, unlimited for Business) will be documented when introduced.

---

Using the audit log well

• Wire an alert on login_failure spikes per IP. Credential stuffing usually shows up as bursts of login_failure with a common ip_address.
• Track credential rotations. oauth_client_secret_reset, api_token_create, and api_token_revoke together tell you whether your rotation policy is being followed.
• Reconcile with request logs via request_id. The same id is available in your application logs if you forward X-Request-Id; this turns the audit log into the canonical anchor for cross-system incident timelines.
• Protect the dashboard. Only workspace owners and members can read the log — make sure your workspace membership hygiene matches the sensitivity of the data.

---

Related

• Security Overview
• Security Best Practices
• Token Security