14.5Audit log
The audit log is a list of who changed what in your team. Only team owners can read it. Entries are kept for one year. After that, they are removed.
Open the audit log#
- Select billing, then audit log. You can also go to
/app?view=audit. - Pick a filter to narrow the list. The default is everything.
- To see older entries, select load older at the bottom. Each load adds 50 entries.
The page says: "Who changed what in this team, kept for a year. Secrets, webhook URLs and monitor settings that can hold credentials are shown only as changed."
The filters, in order: everything · monitors · channels · incidents · paging defaults · maintenance · status page · secrets · api keys · billing · members · plan limits · team. You can use one filter at a time.
Read an entry#
Entries are listed newest first. Each entry shows when it happened, who did it, what they did, and the item's name. For example:
-
"<who> created monitor <name>"
-
"<who> changed channel <name>"
-
"<who> acknowledged the incident on <monitor>"
-
"<who> removed member <email>"
-
The time shows as "5m ago". Hover over it to see the full date and time.
-
An entry keeps the item's name from that moment. It still reads correctly after a rename or delete.
| Shown as "who" | Meaning |
|---|---|
| A name or email | A member of the team |
| API key "<key name>" | A script using that API key |
| API key (deleted) | An API key whose name is no longer known |
| obsrvly staff | A change made by obsrvly staff |
| A system name, in italics | An automatic change, such as a payment update or a membership change |
| someone | The actor is not known |
See what changed#
- An entry with details shows "▸ N change(s)". Select it to open a table of changes.
- Each row shows the field, the old value struck through, and "→" the new value.
- "—" means empty. Lists are comma-separated, or "none". true and false show as "on" and "off".
- When something is created, only the new value shows.
- Secret values, webhook URLs and monitor settings that can hold credentials are never shown. The entry only says they changed.
Messages on the page#
| You see | What it means |
|---|---|
| Only a team owner can read the audit log | You are a member. Ask an owner. |
| Nothing recorded yet | No changes have been made in this team yet. |
| couldn't load the audit log | Loading failed. The error text follows. Try again. |
Read the audit log with the API#
Send a POST to this address. $API stands for the base address https://www.obsrvly.com/api/gw, as in 13.3:
POST $API/monitor/obsrvly.v1.MonitorConfigService/ListAuditEvents| Request field | What it does |
|---|---|
limit | Entries per page. Default 50, maximum 200. 0 or less means 50. |
cursor | The nextCursor from the last answer. A bad cursor gives invalid_argument. |
targetType | Only one kind of item, such as monitor. |
targetId | Only one item. |
actorId | Only one actor: a user ID or an API key ID. |
{"limit": 50, "targetType": "monitor"}{"limit": 50, "targetType": "monitor", "cursor": "<nextCursor>"}The answer has events and nextCursor. nextCursor is empty on the last page. Each event has these fields:
| Field | What it holds |
|---|---|
id, occurredAt | The entry's ID and time |
actorKind | user, api_key, staff or system |
actorId, actorDisplay | Who made the change, and the name shown for them |
action | What was done, such as monitor.updated |
targetType, targetId, targetName | The item that changed |
changes | A list of {field, from, to}. from and to are JSON text. from is missing on a create. to is missing on a delete. |