Audit Logs

For: Security teams and compliance officers reviewing a record of all configuration changes made in the console.

Security Overview | Credential Modes | Credential Encryption | mTLS | Bundle Signing | Audit Logs


The Audit Log is an immutable, chronological record of every configuration change made to your organization through the Axemere console. It captures who made each change, what they changed, and when.

Navigation: console.axemere.ai/logs Required package: Compliance

Table of Contents


Log Entries

Each entry in the audit log shows:

ColumnDescription
TimeLocal timestamp when the action was performed
ActorThe user (email address) or support session that performed the action
ActionThe operation performed (e.g., create_credential, update_budget, assign_credential_node)
ResourceThe resource affected. Shown as type when no specific identifier applies (e.g., budget), or type / id when a named resource is involved (e.g., credential / cred-openai-motgrccp)

Entries are ordered most-recent-first.


Support Sessions

Axemere support staff can access your console in a support session (with your explicit permission) to help diagnose issues. Support session actions are shown in the audit log with the actor displayed as support:<session-id> and highlighted in amber to distinguish them from regular member actions.

This ensures all support-initiated changes are visible and attributable.


Pagination

Use the Page Size selector to control how many entries are shown per page (10, 25, 50, or 100). Use Previous / Next to navigate between pages. Your page size preference is saved.


Exporting Audit Logs

The Compliance package includes SIEM-compatible audit log export. Configure an Export Destination to forward audit events to your log aggregation platform (e.g., Splunk, Datadog, Elastic) in real time.

Exported events include the same fields shown in the console table, formatted as JSON.


What Is and Is Not Logged

Logged (configuration mutations):

  • Creating, updating, or deleting credentials
  • Creating or revoking API keys
  • Enabling or disabling providers
  • Creating, updating, or deleting workloads, projects, policies
  • Creating or revoking gateway bootstrap tokens
  • Inviting or removing team members
  • Activating, cancelling, or modifying subscriptions
  • Org name changes

Not logged (read operations and runtime events):

  • Viewing pages or fetching data (reads are not mutations)
  • Individual AI request executions; those appear in Records
  • Gateway heartbeats and node registration events

Related: Export Destinations | Records | Team & Billing | Services