Skip to Content
FeaturesAudit Log

Audit Log

The Audit Log provides a comprehensive, tamper-evident record of every significant action in your TinyOps organization. From policy changes to approval decisions, every event is captured with full context. This gives you the compliance trail you need for security reviews, incident investigations, and regulatory requirements.

How It Works

TinyOps uses a decorator-based capture system (@Audit()) that automatically records events as they happen. Every auditable action passes through this layer, ensuring consistent capture without requiring manual logging from each feature. The system is designed to be resilient. Audit failures never block user requests.

Tracked Events

CategoryEvents
Policycreated, updated, deleted, promoted
Rulecreated, updated, deleted, toggled, secret_rotated
Approvalrequested, approved, denied
Org settingsAll settings changes
Team membersInvited, removed, role changed

Event Data Structure

Each audit event captures the following fields:

FieldTypeDescription
orgIdstringOrganization where the event occurred
actorIdstringUser who performed the action
actionstringThe specific action taken (e.g., rule.created)
resourceTypestringType of resource affected (e.g., rule, policy)
resourceIdstringUnique identifier of the affected resource
resourceNamestringHuman-readable name of the resource
metadataobjectAdditional context specific to the event type
createdAttimestampWhen the event was recorded

Example Event

audit-event-example.yaml
orgId: org_abc123
actorId: user_xyz789
action: rule.secret_rotated
resourceType: rule
resourceId: rule_def456
resourceName: deploy-notification
metadata:
  previousSecretPrefix: whsec_old...
  rotatedBy: user_xyz789
  reason: scheduled_rotation
createdAt: "2026-04-30T14:22:00Z"

Resilient Writes

The audit system prioritizes reliability and uses multiple fallback strategies:

StrategyDescription
Retries2 retries with exponential backoff on write failure
Dead-letter tableFailed writes are stored in a fallback table for later processing
Non-blockingAudit failures never block the user’s original request

If an audit write fails after all retries, the event is written to the dead-letter table. A background process periodically retries dead-letter events. No audit events are silently dropped.

Decorator-Based Capture

TinyOps uses the @Audit() decorator pattern to capture events consistently across the codebase:

audit-decorator-usage.yaml
# Conceptual example of how audit capture works
service: RuleService
method: rotateSecret
decorator: "@Audit()"
captures:
  action: rule.secret_rotated
  resourceType: rule
  resourceId: from method parameter
  metadata: automatically captured from method context

This approach ensures:

  • Every auditable action is captured consistently
  • New features inherit audit logging by adding the decorator
  • Capture logic is decoupled from business logic

Querying the Audit Log

Filter audit events using these parameters:

FilterDescription
Date rangeStart and end timestamps
ActorFilter by specific user
ActionFilter by event type (e.g., rule.created)
Resource typeFilter by category (rule, policy, approval)
Resource IDFind all events for a specific resource

Audit log retention varies by plan. Free plans retain 30 days, Pro plans retain 90 days, and Team/Business plans retain 1 year. Export logs before the retention window closes if you need them for compliance.

ApprovalsYAML Syntax