Audit Logs
Qarion maintains an immutable, append-only audit trail that records every significant action across the platform. The audit log is designed to satisfy both internal governance requirements and external audit demands.
What Is Captured
Every mutation event produces an audit log entry with the following fields:
| Field | Description |
|---|---|
| Actor | User ID, email, and display name of the person who performed the action |
| Action | Type of operation — create, update, delete, archive, approve, reject, login, etc. |
| Resource | Type and ID of the affected resource (product, ticket, contract, meeting, dataset, etc.) |
| Resource Name | Human-readable snapshot for quick identification |
| Details | Structured JSON payload with changed fields and old → new values |
| IP Address | Originating IP of the request |
| Timestamp | UTC timestamp (immutable once written) |
| Space | The space context, if applicable (null for org/platform-level events) |
Audit log entries are never updated or deleted. The table enforces an append-only pattern — there are no PUT or DELETE operations on audit log records.
Browsing the Audit Log
In the UI
Navigate to your space and open the Audit Log section. The log supports:
- Filtering by action type, resource type, acting user, and date range
- Pagination for navigating large datasets
- Resource drill-down — click any resource to view its full history
Via API
The audit log is exposed through read-only API endpoints:
| Endpoint | Description |
|---|---|
GET /api/v1/{slug}/audit-log | Paginated, filtered audit log for a space |
GET /api/v1/{slug}/audit-log/export | Export as CSV or JSON |
GET /api/v1/{slug}/audit-log/{resource_type}/{resource_id} | History for a specific resource |
Common query parameters:
| Parameter | Type | Description |
|---|---|---|
action | string | Filter by action type (e.g. create, update, delete) |
resource_type | string | Filter by resource type (e.g. product, ticket) |
user_id | UUID | Filter by acting user |
start_date | datetime | Start of date range |
end_date | datetime | End of date range |
Exporting for External Auditors
Audit logs can be exported in two formats:
CSV Export
Use GET /api/v1/{slug}/audit-log/export?fmt=csv to download a CSV file. The export includes:
| Column | Description |
|---|---|
id | Unique audit entry ID |
created_at | ISO 8601 timestamp |
action | Action performed |
resource_type | Type of resource |
resource_id | ID of affected resource |
resource_name | Human-readable name |
user_email | Actor's email |
user_full_name | Actor's display name |
details | Structured change payload |
ip_address | Source IP |
JSON Export
Use GET /api/v1/{slug}/audit-log/export?fmt=json to receive a JSON array of audit entries.
Exports are capped at 10,000 rows per request. Use date range filters to work through larger datasets in batches.
SIEM Integration
Enterprise customers can forward audit logs to external Security Information and Event Management (SIEM) systems.
Structured JSON Logging
When platform.structured_logging is enabled, Qarion outputs structured JSON logs that can be consumed by log aggregators such as:
- Splunk — via HTTP Event Collector (HEC)
- Elastic / ELK Stack — via Filebeat or Logstash
- Datadog — via log forwarding agent
- AWS CloudWatch — via CloudWatch Logs agent
Webhook-Based Forwarding
Alternatively, configure a webhook connector to push audit events to your SIEM in real time. See Alert Connectors for webhook configuration.
Audit Log Retention
Retention is configurable via the platform.audit_retention_days feature setting:
| Setting | Default | Description |
|---|---|---|
platform.audit_retention_days | Unlimited (null) | Number of days to retain audit entries |
Configure this in Administration → Feature Settings → Platform.
Setting a short retention period may conflict with regulatory requirements (e.g., GDPR requires demonstrating compliance over time). Ensure your retention policy aligns with your organization's legal obligations.
Tier Availability
| Capability | Community | Professional | Enterprise |
|---|---|---|---|
| Immutable audit trail | ✓ | ✓ | ✓ |
| UI browsing & filtering | ✓ | ✓ | ✓ |
| CSV / JSON export | ✓ | ✓ | ✓ |
| Configurable retention | — | ✓ | ✓ |
| Structured JSON logging | — | — | ✓ |
| SIEM forwarding | — | — | ✓ |
| Org-level cross-space audit | — | — | ✓ |
Related Documentation
- Permissions — role-based access control model
- Space Administration — space-level settings and access auditing
- Data Residency — where audit data is stored
- Secrets Management — credential storage and rotation