#Audit log
The audit log answers: who did what, to which resource, when, from where, and did it work.
User actionCentral backend handles itAudit entry written (same transaction / after success or failure)Audit Log pageFilter / search / export
#What exists
| Source | Shape |
|---|---|
| V7 V7 only | activities: organization_id, user_id, server_id, ip, on (area, e.g. Organization, Server, Application, Subscription, Firewall), action (Create, Update, Delete, Invite, Verify…), content (free text sentence), timestamps. Endpoints: GET /activities (mine), GET /organizations/{org}/activities, GET /organizations/{org}/servers/{server}/activities |
| OSS OSS API | Per-server activity log with typed verbs and a scope (account/server). Every action Central takes is logged as the "central" machine account, not the person |
| V8 doc | Phase 3.12 "Activity log: account activity only" (login, password, 2FA, settings). Server/app activity comes from OSS. Organization activity is now specified: Phase 4 (4.8) covers organization, member, role, share and transfer actions, Phase 5 (5.16) adds every integration action, and Phase 7 (7.16) adds every plan change, renew, cancel and resume — connect, edit, add to other servers, update everywhere, remove, disconnect — with who, which account, which servers and when, and never a token or key (2026-10-03) V8 requirement |
#Proposed V8 entry
| Field | Example | Why |
|---|---|---|
id, occurred_at | Order, display | |
organization_id | Scope | |
actor | user id + name/email snapshot | Stays readable after the user is deleted (the OSS bug "deleted users turn into System" must not be repeated) |
actor_type | user · system · api_token | Show "System" only for real automatic jobs |
action | member.invited, server.connected, plan.upgraded, subscription.changed, blueprint.deployed, role.updated | Translatable key, filterable |
resource_type / resource_id / resource_label | server / 42 / "web-01" | Link to the resource, readable after deletion |
status | success · failed | Failed attempts matter (e.g. failed server connect) |
details | JSON: before/after, error code, OSS reference | Expandable row |
ip, user_agent | Security |
#Examples
| Action | Who | Resource | Details |
|---|---|---|---|
member.invited | Owner | invitation (email) | roles |
member.role_changed | Admin | member | before → after |
server.connected | Admin | server | OSS version |
server.disconnected | Owner | server | — |
server.action | Developer | server/app | OSS path + status (e.g. "restarted nginx") |
plan.upgraded / subscription.changed | Owner | subscription | plan/cycle before → after, amount |
payment.succeeded / payment.failed | Owner | transaction | gateway, amount |
blueprint.deployed | Admin | blueprint → site | run id, completed |
role.created / role.updated / role.deleted | Admin | role | permission diff |
#Audit Log page (/[locale]/audit-log)
- Table: time (relative + exact on hover), actor, action (translated), resource (link if it still exists), status badge, IP. Expandable details.
- Filters: actor, action group (members, servers, billing, roles, account…), resource type, status, date range. Search: resource label / actor email.
- Pagination (server-side). Export CSV for owners Assumption.
- Dashboard "Recent activity" shows the last N entries and links here with the same filters.
- Server Details → Activity tab can show the OSS activity log for that server, labelled "Server log (actions by Central appear as 'central')".
Permission: view audit = Owner, Admin. See Roles & permissions.