Audit log

The audit log records what changed in the account and who changed it: which agents were indexed or failed to index, which agents were renamed or retagged, and which configuration parts and profiles were edited. Administrators read it in the GUI; developers can read it through the API.

What produces an entry

• Agents — a description submitted for indexing; indexing completed; indexing failed, with the reason (contention, or the indexing service being down); a description removed from search; a title changed; a tag changed. Each entry names the agent. A title or tag entry also carries the old value and the new value.
• Configuration — a system configuration part created, updated or deleted: agent servers, encryption, secrets, compile rules, validation, allowlist, search, connection pools. The entry lists the names of the fields that changed, never their values. An allowlist change lists the entries that were added and the entries that were removed.
• Profiles — an LLM, API, database, MCP or prompt profile created, updated or deleted. The entry carries the profile name and the names of the fields that changed.
• Security — a password reset requested for an email address that has no account. The requester learns nothing either way. The entry is how an administrator sees the attempt.

Every entry carries the time of the change and the user who made the change, shown by name and email. Changes to the authentication settings produce no entry.

Reading it

The Audit log page opens from its icon in the GUI's header. The icon is shown to administrators and the owner. The page shows a time window, the last three months by default. The list can be narrowed to one kind of entry, or to the changes made by one user, identified by email. Entries are kept for 90 days.

Through the REST API, getNotifications returns the same entries to developers and above.

Why the values are not shown

A configuration part may hold secrets or encryption settings, and every developer can read the audit log through the API. Reporting the field names says what changed without exposing the new value. The current value is on the configuration page itself, where access depends on the role.