Audit Log

Every change to values, secrets, schema definitions, and releases is recorded in an immutable audit log. The log answers: who changed what, when, and from where.

---

What is logged

Event	Logged fields
Value set / updated	key, old value*, new value*, scope, scope_ref, user_id, timestamp
Secret sealed	key, scope, scope_ref, public_key prefix, user_id, timestamp
Schema synced	plugin, created/updated/unchanged counts, user_id, timestamp
Release created	version, etag, environment, config snapshot hash, user_id, timestamp
App key created	key name, prefix, environment, user_id, timestamp
App key revoked	key id, revoked_by, timestamp
Token created	prefix, user_id, org_id, timestamp
Token revoked	token_id, timestamp

*Secret values are never logged in plaintext.

---

Querying the audit log

# All events for the current project
npx orbseal audit list

# Filter by event type
npx orbseal audit list --type value_set

# Filter by user
npx orbseal audit list --user admin@acme.com

# Filter by key
npx orbseal audit list --key taskflow:max_seats

# Time range
npx orbseal audit list --from 2026-01-01 --to 2026-06-01

# JSON output for piping
npx orbseal audit list --json | jq '.events[] | select(.type == "release_created")'

---

REST API

GET /v1/workspaces/:ws/projects/:proj/audit

Query parameters:

Param	Description
type	Filter by event type (see table above)
user_id	Filter by actor user ID
key	Filter by plugin:key
from	ISO date lower bound
to	ISO date upper bound
limit	Max results (default 50, max 500)
cursor	Pagination cursor from previous response

Response:

{
  "events": [
    {
      "id":         "01943b7a-...",
      "type":       "value_set",
      "actor_id":   "019e99f6-...",
      "actor_email":"admin@acme.com",
      "key":        "taskflow:max_seats",
      "scope":      "workspace",
      "scope_ref":  "platform",
      "old_version": 2,
      "new_version": 3,
      "timestamp":  "2026-06-06 22:44:11"
    }
  ],
  "cursor": "eyJpZCI6Ij..."
}

---

Release diff

You can compare two releases to see exactly what changed between deployments:

npx orbseal releases diff platform taskflow production 1 2

  taskflow:max_seats         5  →  10
  taskflow:features          {"ai_assist":false}  →  {"ai_assist":true}
  taskflow:time_tracking     —  →  false

---

Retention

Audit events are retained for 90 days on the free plan and 2 years on paid plans. Events are append-only — they cannot be deleted or modified.

---

Webhooks

You can subscribe to audit events via webhooks to push them into your own logging or alerting system (e.g. Datadog, Splunk, Slack):

npx orbseal webhooks create \
  --url https://hooks.yourapp.com/orbseal \
  --events value_set,release_created,key_revoked

Webhook payloads are signed with HMAC-SHA256 using a shared secret.

---

Compliance use cases

• SOC 2 — evidence that only authorised users changed config
• GDPR — track when personal-data-adjacent config (e.g. retention periods) was changed
• Incident response — pinpoint the exact change that preceded a production incident
• Change management — gate releases behind audit approval workflows

---

Related

• Architecture
• Releases guide