Audit log
See who changed what in the gateway's configuration, and when, from the dashboard or the Management API.
3 min readUpdated for v2.4.0Edit on GitHub
Find a change
Open Audit. Each change reads as a sentence that names what changed and links to its page, newest first and grouped by day. A run of the same change by the same person within a minute folds into one line, such as "changed 3 models". Deleted things keep their names, taken from the log's own records.
- Search by a name, an id, or what changed.
- Filter by time (24 hours, 7 days, 30 days or all), by who (Anyone or one person), and by kind (Anything or one kind of thing). The filters are kept in the address, so a filtered view can be shared.
- Open a line's details to see which fields changed from what to what, with the raw JSON behind Raw JSON.
- Load older pages back through the whole log.
- Export downloads the current view as CSV.
A model's Audit log link opens the log filtered to that model.
Who is recorded
| Actor | Meaning |
|---|---|
| An email address | The signed-in dashboard or portal user who made the change |
system | The Slurm provisioner, for changes it makes itself |
admin | A Management API call that named no actor. The dashboard shows it as "admin token" |
Callers name the actor with the x-obleth-audit-actor header. The dashboard sends the signed-in user's email on every write, including those made from live pages such as Fairshare. A script calling the Management API can set the header to attribute its changes, or leave it out to record admin.
Read it through the API
curl "http://localhost:9180/api/v1/audit?entity_type=tenant&since=2026-09-01T00:00:00Z&limit=200" \
-H "Authorization: Bearer $OBLETH_ADMIN_TOKEN"
Rows come back newest first. Each has id, ts, actor, action, entity_type, entity_id and detail, a JSON object with the specifics of the change.
| Parameter | Meaning |
|---|---|
limit | Rows to return. Default 100, at most 1,000 |
actor | An exact actor, such as an email or admin |
entity_type, entity_id | The kind of thing and its id |
action | One action, or several separated by commas |
since, until | RFC 3339 times; since is inclusive, until exclusive |
q | Free text over actor, action, entity id and detail |
before_id | Page back from this row id |
The rows are stored in the Postgres audit_log table. See Postgres schema.
What is not recorded
Secrets stay out of the log: a model's upstream key is not recorded when the model is created, and configuration backups record only entity counts (and, for a restore, the source's export time, gateway version and warnings), never the backup itself, which carries secrets and key hashes. See Backup and restore.
Data-plane traffic is not audited here. Requests are in Request logs.
Recorded actions
| Entity type | Actions |
|---|---|
tenant | create_tenant, update_tenant, delete_tenant, update_quota, update_weight, update_tenant_group, set_tenant_status, set_tenant_budget, set_tenant_schedule, set_tenant_allowlist, set_tenant_guardrails, set_tenant_compression, set_tenant_synthetic, enable_tenant_tracing, disable_tenant_tracing |
fairshare_group | create_fairshare_group, update_fairshare_group_weight |
api_key | create_key, update_key, delete_key, move_key, enable_key, disable_key, enable_key_tracing, disable_key_tracing |
model | create_model, update_model, delete_model, activate_model, set_model_status, set_model_capacity, set_model_capacity_mode, set_model_weight, set_model_cache, set_model_reliability, set_model_knowledge_collections, update_model_health_config, autotune_model, apply_autotune_capacity, clear_lost_replicas |
model_endpoint | create_model_endpoint, update_model_endpoint, delete_model_endpoint |
managed_model | put_managed_model, delete_managed_model, clear_provision_error |
model_replica | create_replica, patch_replica, restart_replica, delete_replica |
mcp_server | create_mcp_server, update_mcp_server, delete_mcp_server |
recipe | create_recipe, update_recipe, delete_recipe |
knowledge_collection | create_knowledge_collection, update_knowledge_collection, delete_knowledge_collection, reindex_knowledge_collection |
knowledge_document | upload_knowledge_document, delete_knowledge_document, reindex_knowledge_document |
settings | set_alert_settings, set_auto_router_settings, set_boon_settings, set_charo_settings, set_energy_settings, set_knowledge_settings, set_slurm_settings, set_usage_retention |
usage | compact_usage |
gateway | set_capacity, export_backup, restore_backup, export_models, import_models, resync_resolver_cache |