Audit record
Included from Basic tier
An audit record is one row of the composed audit-history view: a stored
event joined, server-side and in one set-based pass, with the resolved
context of its polymorphic source (the change, step, workflow run or node
the event is about). It is a read-only projection over the event stream —
nothing is written through this surface. Served by the v2 AuditService
(ListAuditEntries, newest first); it is PostgreSQL-backed and answers
unimplemented under the embedded store.
AuditEntry
AuditEntry is one audit-history row: the event plus its source resolved server-side — everything the v1 screens recovered from the include chain and 99 client-side lookups.
| Field | Type | Meaning |
|---|---|---|
event | Event | The stored event itself (see the event resource page for its fields). |
source | AuditSource | The resolved source context; absent when the event has no source or the source row no longer exists. |
AuditSource
AuditSource is the resolved context of an event's polymorphic source: the display identity plus the links the audit screens render.
| Field | Type | Meaning |
|---|---|---|
action | string | The action, for change/step sources. |
change_id | string | The owning change, for step sources. |
id | string | The record's identity. |
kind | string | The source kind as stored: "Change", "BaseStep", "BaseWorkflowStep", "WorkflowRun", "Node", … |
name | string | The human display name: a change/step's step name or action, a run's workflow code, a node's name. |
node_path | string | The source's own node path (a change/step's target node, a node source's path); empty when the kind carries none. |
project_code | string | The owning project's code; empty when the source sits outside a project. |
project_name | string | The owning project's display name; empty when the source sits outside a project. |
workflow_code | string | The workflow's code, for workflow-run and workflow-step sources. |
workflow_run_id | string | The owning workflow run, for workflow-step sources (and the run's own id for WorkflowRun sources). |
AuditFilter
AuditFilter is the typed audit-history vocabulary — the filters the GUI audit screens send. All fields combine with AND; empty fields do not restrict.
| Field | Type | Meaning |
|---|---|---|
created_after | timestamp | Keep events created at or after this instant. |
created_before | timestamp | Keep events created at or before this instant. |
for_change_id | string | Keep only the named change's audit trail: the change's own events plus its steps' events — the v1 change Events tab's for_change scope. Must be a UUID. |
node_path | string | Keep only events in this node path's subtree: the node itself plus every descendant (an environment's view includes its assets' events). |
system | boolean | Keep only system (true) or user (false) events. |
type_prefixes | array of string | Event type prefixes to keep — any-of with types. |
type_search | array of string | Keep events whose type contains every term, case-insensitively — the audit screens' free-text search: agent matches warn:agent:halted and info:agent:request alike. Each entry is split on whitespace into terms; a term may carry : (agent:halt). Combines with AND against types/type_prefixes. The server resolves the terms against the catalogue of event types (the registered types plus those stored) and filters on the exact matches through the type index, so the read never scans the history; terms no type contains match nothing. |
types | array of string | Event types to keep (exact) — any-of. |
username | string | The acting username (exact). |
Related pages
opschain docs resources/event— the stored event row this view joins.opschain docs events— the event type registry and grammar.opschain docs resources/change— the commonest source kind.