Aize Platform LogoAize Platform Docs

Audit Logs

Security audit trail of all organization activities

Audit Logs

Audit logs provide a comprehensive security trail of all important actions performed within your organization.

What are Audit Logs?

Audit logs track who did what, when, and where in your organization:

Recorded information:

  • Actor: Who performed the action (name + email)
  • Action: What they did
  • Resource: What was affected (API key, member, wallet)
  • Timestamp: Exact date and time
  • IP Address: Where they were (if available)
  • User Agent: Browser/device information
  • Metadata: Additional details specific to the action

Purpose:

  • Security monitoring
  • Compliance requirements
  • Debugging issues
  • Accountability
  • Forensic investigation

Who Can Access Audit Logs?

RoleAccess
Member❌ No access
Admin✅ Full access
Owner✅ Full access

Admin and Owner access:

  • View all organization audit logs
  • See actions by all members
  • Export logs (coming soon)
  • Search and filter

Logged Actions

Member Actions

Invitations:

  • MEMBER_INVITED - New member invited to organization
  • INVITATION_ACCEPTED - Member accepted invitation
  • INVITATION_REVOKED - Invitation cancelled
  • INVITATION_EXPIRED - Invitation expired (8 days)

Role Changes:

  • MEMBER_ROLE_CHANGED - Member role updated (OWNER/ADMIN/MEMBER)
  • MEMBER_PROMOTED - Member promoted to higher role
  • MEMBER_DEMOTED - Member downgraded to lower role

Removal:

  • MEMBER_REMOVED - Member removed from organization

API Key Actions

Creation:

  • API_KEY_CREATED - New API key generated
    • Records: key label, scope (PERSONAL/TEAM), creator

Management:

  • API_KEY_BLOCKED - Key temporarily disabled
  • API_KEY_UNBLOCKED - Key re-enabled
  • API_KEY_REVOKED - Key permanently deleted
  • API_KEY_LIMIT_UPDATED - Monthly limit changed

Wallet Actions

Deposits:

  • FUNDS_DEPOSITED - Cryptocurrency payment received
    • Records: amount, currency, transaction ID

Status Changes:

  • WALLET_FROZEN - Wallet frozen (balance = $0 or admin action)
  • WALLET_UNFROZEN - Wallet re-enabled
  • LOW_BALANCE_ALERT - Balance dropped below threshold

Manual Adjustments:

  • FUNDS_REFUNDED - Admin issued refund
  • BALANCE_ADJUSTED - Admin manually adjusted balance

Organization Actions

Settings:

  • ORG_SETTINGS_UPDATED - Organization name or settings changed
  • ORG_TIER_CHANGED - Tier upgraded/downgraded
  • ORG_LOW_BALANCE_THRESHOLD_UPDATED - Alert threshold changed

Lifecycle:

  • ORG_CREATED - Organization first created
  • ORG_FROZEN - Organization frozen by admin
  • ORG_UNFROZEN - Organization unfrozen
  • ORG_DELETED - Organization permanently deleted

Authentication Actions

Sign-in:

  • USER_SIGNED_IN - Member logged in
  • USER_SIGNED_OUT - Member logged out
  • FAILED_SIGN_IN_ATTEMPT - Login failed (security)

Security Actions

Suspicious Activity:

  • SUSPICIOUS_ACTIVITY_DETECTED - Unusual pattern detected
  • RATE_LIMIT_EXCEEDED - Too many requests
  • UNAUTHORIZED_ACCESS_ATTEMPT - Access denied

Log Entry Details

Basic Information

Every log entry contains:

Timestamp:

2024-01-15 14:32:47 UTC
  • Exact date and time
  • Timezone: UTC
  • Millisecond precision

Actor:

John Smith ([email protected])
  • Full name
  • Email address
  • User ID (internal reference)

Action:

API_KEY_CREATED
  • Standardized action code
  • Human-readable description
  • Category (MEMBER, API_KEY, WALLET, ORG)

Detailed Information

Resource:

Resource Type: API_KEY
Resource ID: key_abc123
Resource Name: "Production API Key"

Metadata (varies by action):

For API_KEY_CREATED:

{
  "keyLabel": "Production API Key",
  "scope": "TEAM",
  "scopes": ["gpt-4", "claude-3"],
  "monthlyLimit": 100.00,
  "createdBy": "[email protected]"
}

For MEMBER_ROLE_CHANGED:

{
  "memberEmail": "[email protected]",
  "oldRole": "MEMBER",
  "newRole": "ADMIN",
  "changedBy": "[email protected]",
  "reason": "Promoted to team lead"
}

For FUNDS_DEPOSITED:

{
  "amount": 100.00,
  "currency": "USD",
  "paymentMethod": "USDT_TRC20",
  "transactionId": "0x123abc...",
  "providerReference": "nowpayments_12345"
}

IP Address:

203.0.113.1
  • Source IP of action
  • Useful for security analysis
  • Detect unusual locations

User Agent:

Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 Chrome/120.0.0.0
  • Browser and device info
  • Detect suspicious clients
  • Understand access patterns

Using Audit Logs

Viewing Logs

  1. Navigate to Audit Logs page
  2. See most recent logs first
  3. Scroll through chronological list
  4. Click entry to expand details

Pagination

  • 50 logs per page (default)
  • Click "Next Page" to load older logs
  • Click "Previous Page" to go back
  • Page numbers shown at bottom

Reading Log Entries

Expanded view shows:

  1. Full timestamp with timezone
  2. Actor name and email
  3. Action performed
  4. Resource affected
  5. Complete metadata
  6. IP address
  7. User agent
  8. Internal IDs for reference

Common Use Cases

Security Investigation

Scenario: Suspicious API key usage detected

Investigation steps:

  1. Go to Audit Logs
  2. Search for API_KEY_CREATED entries
  3. Check who created the suspicious key
  4. View creation timestamp
  5. Check IP address (from different location?)
  6. Review related actions by same actor
  7. Check if key was revoked
  8. Identify pattern

Example findings:

2024-01-15 03:00:00 - API_KEY_CREATED
Actor: [email protected]
IP: 103.45.67.89 (Vietnam)
Usual IP: 203.0.113.1 (USA)
Action: Created key with no monthly limit

Action: Key likely created by compromised account → Reset password, revoke key, investigate further

Compliance Auditing

Scenario: Quarterly security review

Steps:

  1. Export audit logs for period (coming soon)
  2. Filter by action types:
    • MEMBER_INVITED, MEMBER_REMOVED
    • API_KEY_CREATED, API_KEY_REVOKED
    • MEMBER_ROLE_CHANGED
  3. Verify all actions authorized
  4. Check for unusual patterns
  5. Document findings

Compliance requirements met:

  • ✅ Track all access changes
  • ✅ Monitor privileged actions
  • ✅ Immutable audit trail
  • ✅ Timestamp all events
  • ✅ Identify responsible parties

Troubleshooting

Scenario: Member says they didn't remove API key

Investigation:

  1. Search logs for API_KEY_REVOKED
  2. Find the key revocation entry
  3. Check actor (who did it)
  4. Check timestamp (when)
  5. Check IP/user agent
  6. Verify if really that member

Possible findings:

Actor: [email protected] (Admin)
Time: 2024-01-14 18:00:00
Action: API_KEY_REVOKED
Reason: "Monthly limit exceeded, key disabled"

Resolution: Admin revoked key, not the member. Explained the reason.

Cost Attribution

Scenario: Unexpected high spending

Investigation:

  1. Check Request Logs for high usage
  2. Identify API key responsible
  3. Go to Audit Logs
  4. Find API_KEY_CREATED for that key
  5. See who created it
  6. Check MEMBER_INVITED if recent member
  7. Attribute cost to responsible party

Example:

Key: "Test Key 123"
Created by: [email protected]
Created: 2024-01-10
Usage: $500 in 3 days
Issue: No monthly limit set

Action: Set monthly limit, talk to contractor about usage

Security Best Practices

Regular Monitoring

Daily:

  • Check for unexpected member additions
  • Review API key creations
  • Look for role changes

Weekly:

  • Full audit log review
  • Check for suspicious IPs
  • Verify all actions authorized

Monthly:

  • Compliance report
  • Export logs for records
  • Review access patterns

Red Flags to Watch For

Member Actions:

  • 🚩 Member invited outside business hours
  • 🚩 Multiple role changes in short time
  • 🚩 Member removed then re-added
  • 🚩 Invitation from unusual IP

API Key Actions:

  • 🚩 Keys created with no monthly limit
  • 🚩 Many keys created rapidly
  • 🚩 Keys created outside business hours
  • 🚩 Key revoked immediately after creation

Wallet Actions:

  • 🚩 Large deposits from unknown IP
  • 🚩 Wallet unfrozen by non-owner
  • 🚩 Multiple deposit attempts

Organization Actions:

  • 🚩 Settings changed unexpectedly
  • 🚩 Low balance threshold set to $0
  • 🚩 Organization name changed

Responding to Suspicious Activity

Immediate actions:

  1. Block the suspicious API keys
  2. Change compromised member passwords
  3. Remove unauthorized members
  4. Freeze wallet if needed (prevent financial loss)
  5. Document everything

Investigation:

  1. Review full audit trail
  2. Check related actions
  3. Identify entry point
  4. Assess damage
  5. Determine root cause

Remediation:

  1. Fix security gap
  2. Reset affected credentials
  3. Implement additional controls
  4. Update team on findings
  5. Monitor for recurrence

Data Retention

Storage period:

  • Audit logs retained indefinitely
  • Never deleted automatically
  • Supports compliance requirements
  • Available for entire organization lifetime

Immutability:

  • Logs cannot be modified
  • Logs cannot be deleted (by anyone)
  • Permanent record
  • Tamper-proof

Access:

  • Admins and Owners only
  • No member access
  • Export coming soon
  • API access planned

Limitations

Current limitations:

  • ❌ Cannot search by keyword yet
  • ❌ Cannot filter by action type
  • ❌ Cannot export to CSV/JSON
  • ❌ No alerting on specific actions
  • ❌ No real-time notifications

Coming soon:

  • ✅ Advanced search
  • ✅ Filtering options
  • ✅ CSV/JSON export
  • ✅ Webhook notifications
  • ✅ Custom alert rules
  • ✅ Integration with SIEM systems

Request Logs:

  • See actual API usage
  • Different from audit logs
  • Shows technical activity
  • View Request Logs

Analytics:

Wallet Transactions:

  • Financial audit trail
  • Deposits and deductions
  • Balance history
  • View Wallet

FAQs

Can audit logs be deleted?

No. Audit logs are permanent and immutable.

Why?

  • Security requirement
  • Compliance necessity
  • Forensic evidence
  • Accountability

Can anyone modify audit logs?

No. Not even platform admins can modify logs.

Integrity guaranteed by:

  • Append-only database
  • Cryptographic hashing (coming soon)
  • Immutable storage
  • Audit of audits (admin actions logged separately)

How far back do logs go?

Forever. All logs retained since organization creation.

Retention policy:

  • No automatic deletion
  • Available for life of organization
  • Even after member leaves
  • Even after key revoked

Can I get alerts for specific actions?

Not yet, but coming soon.

Planned features:

  • Email alerts for critical actions
  • Webhook notifications
  • Slack/Discord integrations
  • Custom alert rules

Can I export audit logs?

Coming soon. Export features in development.

Planned formats:

  • CSV for spreadsheets
  • JSON for programmatic access
  • PDF for compliance reports
  • API access for automation

Next Steps

Playground

Test AI models interactively before integrating into your app

Available Models

List of supported AI models and pricing

On this page

Audit LogsWhat are Audit Logs?Who Can Access Audit Logs?Logged ActionsMember ActionsAPI Key ActionsWallet ActionsOrganization ActionsAuthentication ActionsSecurity ActionsLog Entry DetailsBasic InformationDetailed InformationUsing Audit LogsViewing LogsPaginationReading Log EntriesCommon Use CasesSecurity InvestigationCompliance AuditingTroubleshootingCost AttributionSecurity Best PracticesRegular MonitoringRed Flags to Watch ForResponding to Suspicious ActivityData RetentionLimitationsRelated FeaturesFAQsCan audit logs be deleted?Can anyone modify audit logs?How far back do logs go?Can I get alerts for specific actions?Can I export audit logs?Next Steps