Platform Reference

Audit Log Reference

Every platform action recorded in FlowOS — event types by module, field schema, query API, retention policy, and SIEM export.

The audit log is an immutable, append-only record of every significant action taken in your FlowOS workspace. Records are written synchronously within the same database transaction as the action they describe, so partial writes are impossible.

Audit records cannot be edited or deleted via the API. The only way records disappear is automated retention expiry. Workspace owners can configure retention in Settings → Workspace → Security.

Event Schema

Every audit event shares the same top-level schema regardless of type. Module-specific data lives in the before, after, changes, and metadata fields.

Field	Type	Description
id	varchar(26)	ULID primary key, prefixed aud_.
action	varchar(100)	Dotted action string, e.g. incident.resolved.
entity_type	varchar(100)	Resource type: incident \| change \| user \| workflow \| ...
entity_id	varchar(26)	ID of the affected record.
entity_number	varchar(20)	Human number (INC-1042) at event time.
entity_title	text	Title/name at event time.
actor_id	varchar(26)	User, token, workflow, or system that triggered the action.
actor_type	enum	user \| api_token \| workflow \| system
actor_name	text	Display name of the actor.
actor_ip	inet	Request IP. Null for system/workflow actors.
before	jsonb	Field snapshot before change (null on create).
after	jsonb	Field snapshot after change (null on delete).
changes	jsonb	Array of { field, from, to } diffs (updates only).
metadata	jsonb	{ requestId, userAgent, sessionId, ... }
workspace_id	varchar(26)	Owning workspace.
environment	enum	development \| staging \| production
created_at	timestamptz	Event timestamp. Indexed for range queries.

Event Catalog

Complete list of action strings, grouped by module. The action field is always a lowercase dotted string.

Module	Action	Description
ITSM	incident.created	A new incident record was created.
ITSM	incident.updated	One or more incident fields changed.
ITSM	incident.resolved	Status transitioned to resolved.
ITSM	incident.closed	Status transitioned to closed.
ITSM	incident.reopened	A resolved/closed incident was reopened.
ITSM	incident.assigned	Assigned team or user changed.
ITSM	incident.escalated	Severity increased or on-call was paged.
ITSM	incident.deleted	Incident record permanently deleted.
ITSM	change.created	Change request created.
ITSM	change.submitted	Change moved to review status.
ITSM	change.approved	A CAB reviewer approved.
ITSM	change.rejected	A CAB reviewer rejected.
ITSM	change.implemented	Change marked as completed.
ITSM	change.rolled_back	Change rolled back.
ITSM	problem.created	Problem record created.
ITSM	problem.known_error	Problem promoted to known error.
ITSM	problem.resolved	Problem resolved.
ITSM	catalog.item.created	New service catalog item defined.
ITSM	catalog.item.published	Catalog item made visible to users.
ITSM	catalog.request.submitted	User submitted a service request.
ITSM	catalog.request.approved	Request approved.
ITSM	catalog.request.fulfilled	Request marked fulfilled.
ITSM	kb.article.published	Knowledge article published.
ITSM	kb.article.archived	Knowledge article archived.
ITSM	sla.breach	An SLA response or resolution target was breached.
ITSM	sla.warning	SLA is within warning threshold.
ITSM	cmdb.ci.created	New CI registered.
ITSM	cmdb.ci.updated	CI attributes changed.
ITSM	cmdb.relationship.created	Relationship edge added between CIs.
Workflow	workflow.created	Workflow definition created.
Workflow	workflow.published	Draft version activated.
Workflow	workflow.deactivated	Workflow set to inactive.
Workflow	workflow.deleted	Workflow deleted.
Workflow	run.started	Workflow run began executing.
Workflow	run.completed	Run finished successfully.
Workflow	run.failed	Run failed with an error.
Workflow	run.cancelled	Run cancelled by user or API.
Workflow	run.approval.requested	Run paused waiting for approval.
Workflow	run.approval.approved	Approval given, run resuming.
Workflow	run.approval.rejected	Approval rejected, run failed.
Auth	user.login	Successful login.
Auth	user.login.failed	Failed login attempt.
Auth	user.logout	User logged out.
Auth	user.mfa.enrolled	MFA method added.
Auth	user.mfa.removed	MFA method removed.
Auth	user.password.changed	Password changed.
Auth	user.password.reset	Password reset via link.
Auth	user.session.revoked	Session invalidated by admin.
Auth	user.invited	Invitation email sent.
Auth	user.invitation.accepted	Invited user completed sign-up.
Auth	user.deactivated	User account deactivated.
Auth	user.reactivated	Account restored.
Auth	api_token.created	API token generated.
Auth	api_token.revoked	API token revoked.
Settings	role.created	Custom role defined.
Settings	role.updated	Role permissions changed.
Settings	role.deleted	Role removed.
Settings	role.assigned	Role assigned to a user.
Settings	role.unassigned	Role removed from a user.
Settings	sso.configured	SSO provider saved.
Settings	sso.enabled	SSO enforced for the workspace.
Settings	sso.disabled	SSO enforcement removed.
Settings	workspace.updated	Workspace settings changed.
Settings	secret.created	Secret stored in vault.
Settings	secret.deleted	Secret removed from vault.
Settings	webhook.created	Outbound webhook configured.
Settings	webhook.deleted	Webhook removed.
Integration	connector.created	Integration connector added.
Integration	connector.updated	Connector config changed.
Integration	connector.deleted	Connector removed.
Integration	connector.tested	Test connection run.

Query API

All audit events are queryable via the standard Records API. The table slug is audit_events.

GET

/api/v1/tables/audit_events/records

List audit events with filters, pagination, and sorting.

GET

/api/v1/tables/audit_events/records/:id

Fetch a single audit event by ID.

Query Examples

bash

# All P1 incident resolutions in the past 30 days
GET /api/v1/tables/audit_events/records
  ?filter[action]=incident.resolved
  &filter[created_at][gte]=2026-05-01

# All actions by a specific user
GET /api/v1/tables/audit_events/records
  ?filter[actor_id]=usr_01HX...
  &sort=-created_at
  &pageSize=100

# All login failures
GET /api/v1/tables/audit_events/records
  ?filter[action]=user.login.failed

# All settings changes
GET /api/v1/tables/audit_events/records
  ?filter[entity_type]=workspace
  &sort=-created_at

Retention Policy

•Default: 365 days. Events older than this are automatically purged nightly.
•Extended: Upgrade to a Compliance plan for up to 7-year retention with WORM (Write Once Read Many) guarantees.
•Minimum: 90 days (cannot be set lower).
•Policy is workspace-scoped. Each workspace sets its own retention in Settings → Workspace → Security → Audit Retention.

SIEM Export

Forward audit events to your SIEM in real time using one of three methods:

Webhook Forwarding

Create a webhook subscribed to the audit.* event group in Integrations → Webhooks. Every audit event is POSTed as JSON within 2 seconds of occurrence. Supports HMAC signature verification.

Syslog (UDP/TCP)

Configure a Syslog target in Settings → Workspace → Security → Syslog Export. Events are formatted as RFC-5424 structured syslog messages. Supported facilities: LOCAL0–LOCAL7.

Bulk Export API

bash

# Export all events for a date range as newline-delimited JSON
GET /api/v1/audit/export
  ?from=2026-05-01
  &to=2026-06-01
  &format=ndjson
Authorization: Bearer <token>

Exports are streamed. For large date ranges, use cursor pagination via the after parameter (an event ID).

If you use Datadog, Splunk, or Elastic, the pre-built connector in Integration Studio handles auth, batching, and field mapping automatically — no custom webhook needed.