The audit
The hub writes an audit line for every request it receives and for every change it makes on its own. Lines cannot be changed or deleted early; they are kept 400 days, then deleted.
What a line says
Section titled “What a line says”- Who: the principal (
person,agent,ci, orsystemfor the hub’s own work), the device or key, and for an agent its integration and session. - What: the operation, the method and path, the result and its code.
- An approved operation names the approver as the actor, the approval, and the requester.
- Correlation: the object a line acts on, as
<kind>:<id>:twin:…,cluster:…,release:…,grant:…,approval:…, and more.run:is reserved for agent runs.
What the hub records about its own work
Section titled “What the hub records about its own work”One line per state change, never per tick: rollouts and upgrades, twins becoming ready, expiring or failing, access expiring or being revoked, certificates ordered and renewed, licence notices, images made and swept, failed server creation and its undo, releases the channel brought.
Reading it
Section titled “Reading it”$ vai api GET '/audit?principal=agent'$ vai api GET '/audit?correlation=twin:<id>'The second lists one object’s whole history in order: a person’s request and the hub’s work together. The portal’s audit page links each correlation to that list.
What you can turn off
Section titled “What you can turn off”You may stop recording read calls and source addresses. Changing calls, logins and security events are always recorded, and so is every line the hub writes about its own work.