Audit logging

Record and understand changes to your workspace and instances.

Changes made to your workspace, instances and volumes produce audit logging entries which can be used for security and debugging purposes.

Audit entries are not available in Namespace's UI but can be pushed to a customer provided SIEM solution.

Audit logging is available to Business+ customers and above.

Onboarding to Audit Logging

Reach out to the Namespace team via your dedicated support channel, or email support@namespace.so.

Supported Event types

workspace.ownership.transfer

{
    "tenant_id": "tenant_...",
    "action": "workspace.ownership.transfer",
    "target": {
        "type": "user",
        "user_id": "user_...",
        "email": "quux@example.com"
    },
    "attributes": {
        "previous_owner": {
            "user_id": "user...",
            "email": ...
        }
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

workspace.membership.new

A user has been added to the workspace.

{
    "tenant_id": "tenant_...",
    "action": "workspace.membership.add",
    "target": {
        "type": "user",
        "user_id": "user_...",
        "email": "quux@example.com"
    },
    "attributes": {
        "role": "READER"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

workspace.membership.update

The role of a workspace member was changed.

{
    "tenant_id": "tenant_...",
    "action": "workspace.membership.update",
    "target": {
        "type": "user",
        "user_id": "user_...",
        "email": "quux@example.com"
    },
    "attributes": {
        "role": "ADMIN"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

workspace.membership.remove

A user has been added to the workspace.

{
    "tenant_id": "tenant_...",
    "action": "workspace.membership.remove",
    "target": {
        "type": "user",
        "user_id": "user_...",
        "email": "quux@example.com"
    },
    "attributes": {
        "role": "READER"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

workspace.update

The Workspace configuration was updated.

{
    "tenant_id": "tenant_...",
    "action": "workspace.update",
    "attributes": {
        "name": "New Workspace Name"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

workspace.token.emit

An authorization token has been emitted for the workspace, e.g. a user signed in.

{
    "tenant_id": "tenant_...",
    "action": "workspace.token.emit",
    "attributes": {
        "duration": "600s"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

instance.ssh

An SSH session was initiated with a workspace instance.

{
    "tenant_id": "tenant_...",
    "action": "instance.ssh",
    "target": {
        "type": "instance",
        "instance_id": ...
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

volume.release

Emitted when a volume is released by an actor, e.g. by pressing [Release] in the Web application.

{
    "tenant_id": "tenant_...",
    "action": "volume.release",
    "attributes": {
        "tag": "my-volume"
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

federation.github.associate

Namespace's GitHub application has been associated with the workspace.

{
    "tenant_id": "tenant_...",
    "action": "federation.github.associate",
    "target": {
        "type": "github_installation",
        "github_installation_id": 1234...
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "user",
        "user_id": "user_...",
        "email": "foobar@example.com"
    }
}

federation.github.deassociate

Namespace's GitHub application has been deassociated from the workspace.

{
    "tenant_id": "tenant_...",
    "action": "federation.github.deassociate",
    "target": {
        "type": "github_installation",
        "github_installation_id": 1234...
    },
    "at": "2024-03-11T21:08:41+00:00",
    "actor": {
        "type": "service",
        "service_id": "github"
    }
}