The audit log is where you find out who did what in your Burrow. Every action is recorded together with who took it, when, and where it came from. When you need to know who changed a secret, which machine read one, or where a sign-in happened from, a single page has the answer.
Opening it#
Select Audit log in the navigation. Anyone whose role can view it sees every event, newest first, ten to a page.
What gets recorded#
The log covers everything that happens in the Burrow, including the reads. Looking at a secret or listing an environment is recorded alongside creating, editing, and deleting one. Actions that were refused or that failed are kept too, each tagged so they stand out from the ones that went through.
Every entry names whoever acted:
Actor | What it is |
|---|---|
People | Members working in the dashboard: signing in, managing projects and secrets, and changing settings. |
Machines | Servers and applications that read secrets at runtime. |
AI identities | AI agents given their own identity to act in the Burrow through the SDK. |
System | The Burrow itself, for things that happen on their own, such as scheduled backups and machines reaching the end of their lifetime. |
The name shown is the one the actor had at the time. Renaming or removing a member or machine later leaves what the log already recorded untouched, and entries are never changed once written.
Reading an entry#
Each row has three parts.
Column | Shows |
|---|---|
Event | A plain sentence of what happened, led by who did it, with a coloured dot for its severity. A refused action carries a Denied tag, and one that errored a Failed tag. A secret read by a machine also shows how it was read: cli, sdk, or http. |
Source | The address the request came from. With IP data turned on, the city, country, and network show underneath. |
When | The time it happened, in the format chosen for the Burrow. |
Severity#
Every event carries one of five levels, shown as the coloured dot beside it. The level comes from the kind of action. Whether it succeeded, was denied, or failed is shown separately, as a tag on the event.
Level | Typical events |
|---|---|
Info | Routine reads, listings, and checks. |
Notice | Everyday changes, such as creating or renaming, and signing in and out. |
Warning | Deletions, refused requests, and sensitive configuration. |
High | Changes to who can get in and to protected material: members, roles, access, downloads, and keys. |
Critical | Reserved for the most serious events. |
The severity filter shows a single level at a time.
Finding an event#
Filters sit above the list and combine, and the count and page numbers follow whatever you set.
Filter | What it does |
|---|---|
Search | Matches text anywhere in the event, including the action and what it acted on. |
Actor | Narrows to a class of actor (Humans, Machines, AI Identities, or System), or to one person or machine. |
Severity | Shows a single severity level. |
Event type | Selects one or more kinds of event. Each option lists how many times it has occurred. |
IP address | Matches the source address. |
The list holds ten events per page, with Previous and Next beneath it.
The trail for one machine or secret#
You can open the log already narrowed to a single machine or secret, without setting the filters yourself. Both open for the same roles that can view the audit log.
For a machine, open the Machines page, use its row menu, and select Audit logs. The log opens filtered to that machine: every secret it read and every change made to it.
For a secret, open its environment in Projects, use the secret's row menu, and select Audit History. The log opens filtered to that secret: when it was created, every read, and each value change, revert, rename, and deletion.
A secret's row menu also has Version History, which lists the secret's saved values and can restore an earlier one. That is separate from Audit History, which records who did what and never shows a value.