Audit logs
Audit logs record key write operations in the console and Admin API, for security review, dispute investigation, and change traceability. Included in every plan.
Typical record types
Section titled “Typical record types”| Category | Examples |
|---|---|
| Nodes | Add / delete nodes, initiate SSH installation |
| Forwarding | Create/update/delete forwarding rules and tunnel chains |
| Users | Operator account creation, disabling, permission changes |
| Tokens | API Token issuance and revocation |
| Settings | License updates, Telegram, notification config |
Read-only queries (listing nodes, viewing rules) are generally not audited.
Viewing the audit log
Section titled “Viewing the audit log”- Console → Audit logs
- Filter by time, operator, resource type
- Open a single entry to see the before/after diff
The API path is GET /api/audit-logs (requires the audit:read scope); see Admin API.
Retention and export
Section titled “Retention and export”- Retention duration is configurable in settings
- For long-term compliance archiving, periodically export via the Admin API to a SIEM / object storage
- Use least-privilege accounts day to day; use the super admin only when necessary
- Changes triggered by an API Token are recorded under the corresponding token principal, making it easy to trace which script/integration did it