Audit Log
Use the audit log to review organization, security, account, billing, and export events.
The PayloadRelay audit log records the supported organization, security, configuration, membership, billing, authentication, and export events. Use it to identify the actor, the action, and the time in the 30-day retention period.
Who can view it?#
Only an organization Owner and an organization Admin can use the audit log. A member with edit access (USER) and a read-only member (VIEWER) receive a 403 error from the audit API. The log contains your organization only. You cannot see the events of a different organization.
What is logged?#
The table that follows gives the action values that PayloadRelay records now. The action filter also contains the older values while the matching events stay in the retained history of your organization.
| Action | Description |
|---|---|
endpoint.created | A user created a new relay endpoint |
endpoint.updated | A user changed the configuration of an endpoint |
endpoint.deleted | A user deleted an endpoint permanently |
endpoint.paused | A user paused an endpoint manually |
endpoint.resumed | A user resumed a paused endpoint manually |
endpoint.auto_paused | The failure-alert system paused an endpoint automatically |
target.created | A user created a relay target, such as a webhook, email, Slack, Discord, Microsoft Teams, PagerDuty, Telegram, or Google Sheets target |
target.updated | A user edited a relay target |
target.deleted | A user deleted a relay target |
target.smtp.verified | An SMTP relay target connection passed the verification |
alert.config.updated | A user changed the failure-alert configuration of an endpoint |
alert.test_sent | A user sent a test alert manually |
member.invited | A user invited a person to the organization |
member.invitation_resent | A user sent a pending organization invitation again |
member.invitation_revoked | A user revoked a pending organization invitation |
member.role_changed | A user changed the role of a member |
member.removed | A user removed a member from the organization |
member.deactivated_seat_limit | PayloadRelay made a member inactive, because the organization went above the member limit of its plan |
org.activated | A user activated an organization and gave it a name |
org.renamed | A user changed the name of the organization |
org.contact_email_updated | A user changed the contact email address of the organization |
org.ownership_transfer_requested | An owner requested an organization ownership transfer |
org.ownership_transfer_confirmed | An owner confirmed an organization ownership transfer |
password.changed | A user changed the password of their account |
password.reset | A user reset the password of their account |
subscription.change_requested | A user requested a billing plan change |
subscription.canceled | A user scheduled the cancellation of a paid subscription |
subscription.resumed | A user reversed a scheduled subscription cancellation |
activity.exported | A user exported the activity log as CSV |
audit.exported | A user exported the audit log as CSV |
auth.login.success | A user signed in successfully |
auth.login.failed | A sign-in attempt failed because of wrong credentials |
auth.logout | A user signed out |
auth.reauth.success | A user authenticated again, with a password or an SSO provider, to authorize a sensitive action |
auth.reauth.failed | PayloadRelay rejected a second authentication attempt |
What is not logged#
- The read-only operations: a list of the endpoints, a read of the Activity logs, and a view of the configuration.
- The relay body content. PayloadRelay does not store a customer relay request body or a customer message body in its databases, activity logs, object storage, or backups. A body stays only in memory and in the delivery, retry, and dead-letter queues. It stays there only while PayloadRelay delivers the event. If the delivery fails permanently, the message stays in a dead-letter queue for a maximum of 7 days for diagnosis or a new delivery. PayloadRelay can keep operational metadata, such as an SMTP envelope sender address, in the 30-day Activity trail.
- The advanced filter queries: a filter on your own Activity data creates no audit event.
- The complete payment details: a billing event contains metadata such as the plan name and the billing interval. It never contains a card number or a bank detail.
Event fields#
Each audit event contains:
| Field | Description |
|---|---|
id | The UUID of the event |
occurredAt | The timestamp (UTC) |
actorEmail | The email address of the user who started the action, as a snapshot |
actorType | USER, SYSTEM, or API_TOKEN |
actorIp | The IP address of the actor, when it is available |
actorUserAgent | The user agent of the browser or the client, cut to 512 characters |
action | The action slug. See the catalog above. |
targetType | The resource type that the action changed, for example, ENDPOINT, MEMBER, or AUTH |
targetId | The UUID of the changed resource, when it applies |
targetName | The readable name of the resource, as a snapshot at the event time |
metadata | The JSON details of the action, with a maximum of 8 KB |
success | true when the action succeeded. false for a failure such as auth.login.failed |
errorMessage | The error detail of a failed event |
The actor email address is a snapshot. If PayloadRelay deletes the user later, the email address stays in the historical audit events.
Querying the audit log#
In the dashboard, use the Organization → Audit Log page. For programmatic access, use the audit API (GET /audit/events).
The filter parameters are optional:
| Parameter | Description |
|---|---|
actorEmailContains | Filter by a part of the actor email address |
action | Filter by the action value, the dot-notation slug. You can give more than one value, separated by commas. To find the recorded values and the values in the retained organization history, use GET /audit/actions. |
targetType | Filter by the target resource type, such as ENDPOINT, OUTPUT, TARGET, or MEMBER |
targetId | Filter by a specific target UUID |
from | The ISO 8601 start timestamp, inclusive |
to | The ISO 8601 end timestamp, inclusive |
success | true or false |
limit | The page size. The default is 50 and the maximum is 200. |
offset | The pagination offset |
The action parameter uses the dot-notation value, such as endpoint.created or target.updated. It does not use the name that the interface shows, such as ENDPOINT_CREATED.
GET /audit/events?action=endpoint.created,target.deleted
GET /audit/events?action=member.invited,member.role_changed&success=trueExporting as CSV#
To download the audit events that match, select Export CSV in the dashboard. PayloadRelay can limit a large export, and it can limit the exports temporarily. If the export is too large, make the filters narrow.
Retention#
An audit event stays for 30 days. PayloadRelay deletes it automatically after that period.
Security reviews and investigations#
The audit log can give supporting records for these tasks:
- A control review: read the supported access, configuration, membership, and billing events.
- Traceability: identify the actor, the time, and the changed resource for a recorded action.
- A security investigation: compare the suspect IP addresses with the actions through
actorIp.
An organization user cannot change or delete an audit event. PayloadRelay deletes the older events after the retention period.
Related guides#
- Endpoint management: the endpoint lifecycle actions that create audit events.
- Relay targets: the target creations, updates, deletions, and SMTP verification events.
- Failure alerts: the alert configuration changes and the auto-pause events.
- Observability: the request-level Activity logs.