64 docs indexed

Audit Log

An append-only, attributed record of every configuration change — who changed what, when, and the before/after detail — readable from the dashboard or the Management API.

obleth records every configuration mutation in an append-only audit log: who made the change, what they changed, when, and a structured detail payload. It covers changes to tenants, API keys, models, endpoints, replicas, MCP servers, and settings — everything that flows through the Management API.

Attribution

Every event is attributed to an actor:

ActorMeaning
an email addressThe signed-in dashboard or self-service-portal user who made the change.
systemA change made automatically by the provisioner (e.g. recording or cancelling a replica).
adminFallback when no actor was supplied (e.g. a raw Management API call with no actor header).

The actor is carried on each Management API write via the x-obleth-audit-actor header. The control plane sets it to the signed-in user's email so dashboard actions are attributed to a real person rather than a generic admin; the provisioner sets it to system. A direct Management API call may set the header itself to attribute the change, or omit it to record admin.

What a record contains

Each audit row has:

FieldDescription
tsWhen the change occurred.
actorWho made it (see above).
actionThe operation, e.g. create_tenant, delete_key, update_model.
entity_typeThe kind of object touched, e.g. tenant, api_key, model.
entity_idThe id of the affected object.
detailA structured JSON payload with the specifics of the change.

The records are stored in the Postgres audit_log table (append-only, indexed by time, actor, and entity). See Postgres Schema.

Reading the log

Dashboard

The dashboard Audit view lets you:

  • Filter by actor, action, or target entity.
  • Read an inline summary for each event that expands to the full detail.
  • See tenant ids resolved to tenant names instead of raw UUIDs.
  • Page through history with a page-size control.
  • Read summary cards showing event, actor, and target counts plus the latest event.

The view adapts to a mobile layout for reviewing the trail on a phone.

Management API

Read the same trail programmatically:

curl "${OBLETH_ADMIN_BASE_URL}/api/v1/audit?limit=100" \
  -H "Authorization: Bearer $OBLETH_ADMIN_TOKEN"

Each element is one audit row in the shape above. See Management API — Audit.