Audit Logs

The Audit Logs section provides a complete record of all gateway activity for security monitoring and compliance.

Viewing Logs

Navigate to Audit Logs (or My Activity) in the sidebar to see the activity log. Cards at the top show the total, the success rate and the failed or denied count for the current filters.

Column	Description
Actor	The user, or the API token and its owner
Type	The action type (`convox`, `gateway`, `auth`, …)
Action	What was done, e.g. `release.promote`
Resource Type	The kind of thing affected
Resource	What was affected
Status	The outcome (see below)
IP Address	Origin of the request
Timestamp	When the event occurred
View	Opens the full entry

Filtering Logs

Use the filter panel to narrow results:

Search

Filter by user, resource, or action text.

Action Type

The scope of the permission the action needs. A request’s attempt and result entries have the same type.

Convox API (convox): requests to the rack
Gateway (gateway): users, API tokens, deploy approvals, settings and the gateway’s other features
Authentication (auth): login, logout and MFA
Security (security): secrets, rate limits and audit log verification

Status

Success
Failed
Denied
Attempted (no outcome): requests recorded before they acted, with no recorded result
Blocked

Every request is recorded as attempted before it acts, and its row shows the result once it’s in (see Attempt and Result Entries). A count such as ×4 next to an action means the row stands for that many events, e.g. repeated denials within a minute.

Resource Type

App
Rack
Env
Secret
Process
System
API Token
User
Auth
Admin

Date Range

Last 15 minutes, hour, 24 hours, 7 days (the default) or 30 days
All time
Custom: a start and end date and time

Per Page sets how many rows each page shows.

Log Details

Click View on an entry to see everything recorded for it: timestamp, actor (for an API token, its name, ID and owner), type, action, event count, resource and resource type, status, RBAC decision, HTTP status, response time, IP address, user agent, the command (when one was recorded) and the details JSON.

Exporting Logs

Apply desired filters
Click Export CSV
Download the CSV file

The CSV has a row per entry as the table shows it (repeated events grouped): first_seen, last_seen, user_email, user_name, action_type, action, command, resource, status, event_count, min_response_ms, max_response_ms, avg_response_ms, ip_address and user_agent. It leaves out the details JSON and the hash chain fields; query the database for those (see Audit Trail).

The export holds every entry that matches the filters, not just the page on screen. A text cell that a spreadsheet would run as a formula (one starting with =, +, - or @) gets a leading ', so it opens as text. The page size of the table, and of GET /api/v1/audit-logs, is at most 200 entries.

Compliance Features

Tamper Detection

Each event is HMAC-chained to the one before it, and the chain is anchored hourly in S3 Object Lock storage when anchoring is configured. The gateway verifies the chain and its anchors every hour; the top of the Audit Logs page shows the latest run: when it ran, whether it passed, how long it has been failing, and its full report. Failures are also sent to Sentry and Slack. See Hourly verification in the gateway.

Retention

The gateway never deletes audit events: the table is append-only, and the database refuses updates and deletes. Keep the database’s backups as long as your compliance program needs.

WORM Anchors

If configured, hourly anchors are written to S3 Object Lock storage and locked for the bucket’s default retention (400 days in the example Terraform).

Watching Recent Activity

Choose Last 15 Minutes and click Refresh to load new entries. The page doesn’t refresh by itself; for alerts as things happen, use the Slack integration.

Compliance Documentation - Compliance features
Monitoring - Operational monitoring