Skip to main content

Audit Logs

Audit logs record every change made to the Zerq platform configuration — who created, modified, or deleted a collection, proxy, client, policy, or credential, and when. Unlike request logs (which record API traffic), audit logs record administrative actions.

Audit log guides​

Who can see audit logs?​

Audit logs are visible only to users with the Auditor role. This allows compliance teams to review platform changes without having admin privileges to modify the platform.

To access audit logs:

  1. Sign in to the management UI with an account that has the Auditor role
  2. Click Audit Logs in the sidebar

What's recorded​

Every audit log entry includes:

FieldDescription
TimestampWhen the action occurred
Actor IDWho performed the action (user ID from OIDC token)
Actor typeuser, service, or system
ActionCREATE, UPDATE, DELETE, or READ
Resource typeWhat was affected (collection, proxy, client, policy, credential, etc.)
Resource IDThe ID of the specific resource
HTTP MethodThe HTTP method of the management API call
URLThe management API URL called
IP addressSource IP of the request
User agentBrowser or tool that made the request
Request IDFor correlating with other systems
Request bodyThe data that was submitted (create/update payloads)
Response statusHTTP status of the management API response
Response bodyThe response returned

Searching and filtering​

Use the search bar and filters to find specific events:

FilterExample
SearchFull-text search across all fields
Actor IDFind all actions by a specific user
Actor typeFilter to user or service actions
Action typeShow only CREATE, UPDATE, or DELETE events
Resource typeShow only changes to collection, proxy, client, etc.
IP addressFind actions from a specific IP
Request IDTrace a specific management request
URL patternFilter by management API endpoint
HTTP statusFind failed management operations
Date rangeFilter to a specific time period

Audit log detail view​

Click any audit log entry to see the full detail:

  • Complete request body (what was submitted)
  • Complete response body (what was returned)
  • Full URL with query parameters
  • User agent string (browser version, API client, etc.)

Use cases​

Compliance review​

"Who changed the rate limit policy between Jan 1 and Jan 31?"

  1. Filter by Resource type = policy
  2. Filter by Action = UPDATE
  3. Set date range to January
  4. Export or screenshot for the compliance report

Security investigation​

"Did anyone create unauthorized credentials recently?"

  1. Filter by Resource type = credential
  2. Filter by Action = CREATE
  3. Review actor IDs and IP addresses

Change rollback​

"What was the collection configuration before it was changed?"

  1. Find the UPDATE event for the collection
  2. Open the detail view
  3. The Request body shows what it was changed to
  4. The previous state can be inferred from the event before this one

Access separation​

In regulated environments, the Auditor role allows compliance teams to view all changes without the ability to modify the platform. This enforces separation of duties — the people who review changes cannot make changes.

Audit log retention​

Set the audit log retention period to meet your regulatory requirements. Many financial and healthcare regulations require 5-7 years of audit log retention.

Integration with SIEM​

Export audit logs to a Security Information and Event Management (SIEM) system by querying the audit log API endpoint programmatically. Structured JSON format makes it compatible with Splunk, Elastic SIEM, Microsoft Sentinel, and others.