Docs

Audit logs & Event Stream

The project Logs page tracks every read, write, decrypt, and integration operation across the web dashboard, CLI, MCP agents, and service tokens with a real-time event stream and cryptographic chain-of-custody audit trail.

Real-Time Event Stream

The Logs page (/[username]/[projectSlug]/logs) tracks all activity within your workspace project, providing live monitoring and a verifiable trail for security and SOC2 / SIEM compliance.

  • Real-Time Event Stream: Monitor activity live with incremental ?since polling that streams new events seamlessly without re-rendering or jumping existing rows.
  • Terminal Access: Prefer working in your terminal? The CLI supports streaming and querying logs with apivault logs tail and apivault logs list — see the CLI Logs reference.

Indexed Event Types

Every significant state transition or secret access is logged with an indexed event category:

  • Key operations: KEY_REVEALED (secret view across Web, CLI, or MCP), KEY_ROTATED (secret value replacement), KEY_DELETED (with pre-deletion snapshots preserved in audit metadata), KEY_CREATED.
  • AI & Developer Tooling: MCP_TOOL_INVOKED (capturing agent tool, arguments, and outcome), CLI_CONNECTED (device pairing approval).
  • Integrations: INTEGRATION_CONNECTED, INTEGRATION_DISCONNECTED, INTEGRATION_LINKED, INTEGRATION_UPDATED, INTEGRATION_UNLINKED, INTEGRATION_SYNC_PREVIEWED, INTEGRATION_SYNCED, and INTEGRATION_SYNC_FAILED. Work ApiVault finishes on its own, such as an automatic sync or a cleanup that completes later, is attributed to Vercel integration, Supabase integration, Cloudflare integration, or GitHub integration instead of a person and filed under the integration source. details.provider identifies the target platform.

Successes and Failures

Denied and failed requests are recorded alongside successful ones — a wrong vault key, a throttled reveal, a write refused by a read-only role, or a key that does not exist.

Each failed entry retains its HTTP status code and the response's error code and message under details.errorCode / details.errorMessage. Entries are filed under the event type that was attempted, so a denied reveal appears as a KEY_REVEALED entry with an HTTP 4xx status.

Requests rejected before their project can be resolved (an unauthenticated caller, or one with no accessible project) are not logged in project logs, because logs are stored strictly per project.

Facet Filtering & Search

Filter and slice project audit records using multi-faceted criteria:

  • Timeline: Quick presets for 1h, 2h, 5h, 24h, Today, 7d, 30d, or custom start and end date ranges.
  • Event Types: Filter to specific actions (e.g. only KEY_REVEALED or KEY_ROTATED).
  • Integrations: Filter by platform (Vercel, Supabase, Cloudflare, GitHub), whatever the event, including older Vercel entries that don't name their provider. The logs API takes the same filter as ?integration=vercel.
  • Status level: Success for 2xx/3xx, Error for 4xx/5xx refusals and errors.
  • HTTP Method: GET, POST, PUT, PATCH, DELETE.
  • Source surface: Web, CLI, MCP, Service (for pipeline tokens), Integration (for autonomous background workers).
  • Actor & Token: Filter by specific user, service token name, or endpoint path. Requests made with a service token are attributed to the token by name, and refused token requests can be isolated with the Service Token Denials filter.

Inspection Drawer

Clicking any log entry opens a slide-over inspection drawer that displays detailed cryptographic and network context:

  • AI Agent identification: Reported client identity (Cursor, Claude Code, Windsurf, Devin, etc.).
  • MCP invocation: Specific tool called (e.g. reveal_key, list_keys) and parameter values.
  • Authorization metadata: Granted OAuth scopes or service token permissions.
  • Network footprint: Client operating system, user agent, and source IP network classification.
  • Raw JSON payload: Complete structured JSON record with formatted syntax highlighting and one-click copy.

SIEM & Compliance Exports

Download audit records as files you can archive or load into a SIEM:

  • Formats: Export as standard JSON, CSV, or newline-delimited Elastic Common Schema (ECS / NDJSON).
  • Volume: Configurable time horizons with export limits up to 50,000 log records per batch.
  • Cryptographic Integrity: Each export includes an on-demand calculated SHA-256 integrity checksum for non-repudiation and verifiable audit trails.