Audit log

Settings, Audit log lists what happened in the workspace, newest first: changes to topics and competitors, plays planned, started, dismissed or handed off, experiments started and ended, decisions on audit findings, runs started or resumed and by whom, issues exported, AI search reports uploaded, reports emailed, sites added and verified (and by which method), a Search Console verification withdrawn, schedules changed, settings changed (which keys, never the values of secrets), members invited and roles changed, API keys created and revoked, knowledge-base decisions, and what Vercatus did on its own: runs the schedule started and fixes the next run verified. Plays regenerated, guides written, checks run and hand-offs made on request are recorded too.

Each event carries the actor (a member’s email, the API key’s prefix and name, or schedule and vercatus for the system), the time, the client address the request came from, and the request id, which matches the API’s x-request-id header and the server logs.

The log is append-only. No route edits or deletes it, and it is kept for the life of the workspace. Admins and owners can read it in the workspace or over the API: GET /api/org/audit with optional action= (a verb prefix such as finding or apikey), actor=, before= (a timestamp, for paging) and limit= up to 500.

Rows are isolated per workspace by the database itself (row-level security), as all tenant data is.