> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

export const CenteredImage = ({src, alt, width, caption, className}) => {
  const [basePath, setBasePath] = useState("");
  useEffect(() => {
    const path = window.location.pathname;
    setBasePath(path === "/docs" || path.startsWith("/docs/") ? "/docs" : "");
  }, []);
  return <Frame caption={caption} className={className} style={{
    maxWidth: width,
    marginInline: "auto"
  }}>
			<OptimizedImage src={`${basePath}${src}`} alt={alt} />
		</Frame>;
};

Changes made to your workspace, instances, and volumes produce audit logging entries which can be used for security and debugging purposes.

Audit entries are available in Namespace's UI and can be filtered for certain actions or actors.

<CenteredImage width={800} alt="Audit Events Table" src="/docs/images/workspaces/audit-events-ui.png" caption="Audit Events in the Namespace Dashboard" />

## Audit Log Forwarding (SIEM)

Namespace also supports pushing audit events to a customer provided SIEM (Security Information & Event Management) solution.
This allows for centralized analysis, streamlined compliance, and real-time threat detection within your existing security tooling.

Audit Log Forwarding is available to **Enterprise** customers.

To set up Audit Log Forwarding with SIEM for your workspace, reach out via your dedicated support channel or email us at
[support@namespace.so](mailto:support@namespace.so).

# Audit Log Types

Namespace audit logs include many different actions, including contextual data to understand exactly what happened.
The most important actions and what data they contain are detailed below:

## artifact.expire

An artifact's expiration time was updated.

```json theme={null}
{
    "action": "artifact.expire",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "namespace": "builds",
        "new_expired_at": "2024-12-31T00:00:00Z",
        "path": "my-artifact"
    },
    "tenant_id": "tenant_..."
}
```

## artifact.finalize

An artifact was finalized (upload completed).

```json theme={null}
{
    "action": "artifact.finalize",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "namespace": "builds",
        "path": "my-artifact"
    },
    "tenant_id": "tenant_..."
}
```

## artifact.resolve

An artifact was resolved (downloaded or accessed).

```json theme={null}
{
    "action": "artifact.resolve",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "namespace": "builds",
        "path": "my-artifact"
    },
    "tenant_id": "tenant_..."
}
```

## billing.contact.update

The billing contact information was updated.

```json theme={null}
{
    "action": "billing.contact.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "tenant_id": "tenant_..."
}
```

## devbox.create

A devbox was created.

```json theme={null}
{
    "action": "devbox.create",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "site": "sjc1"
    },
    "targets": [
        {
            "devbox_id": "...",
            "type": "devbox"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## devbox.defaults.update

The workspace devbox defaults were updated.

```json theme={null}
{
    "action": "devbox.defaults.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "tenant_id": "tenant_..."
}
```

## devbox.expire

A devbox was expired (terminated).

```json theme={null}
{
    "action": "devbox.expire",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "devbox_id": "...",
            "type": "devbox"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## devbox.update

A devbox configuration was updated.

```json theme={null}
{
    "action": "devbox.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "devbox_id": "...",
            "type": "devbox"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## federation.github.associate

Namespace's [GitHub federation](/docs/federation/github-actions) application has been associated with the workspace.

```json theme={null}
{
    "action": "federation.github.associate",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_installation_id": "1234...",
            "type": "github_installation"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## federation.github.deassociate

Namespace's [GitHub federation](/docs/federation/github-actions) application has been deassociated from the workspace.

```json theme={null}
{
    "action": "federation.github.deassociate",
    "actor": {
        "claims": {
            "login": "octocat"
        },
        "source": "github",
        "type": "external"
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_installation_id": "1234...",
            "type": "github_installation"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.installation.associate

Namespace's [GitHub runner](/docs/solutions/github-actions) application has been associated with the workspace.

```json theme={null}
{
    "action": "github.installation.associate",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_installation_id": "1234...",
            "type": "github_installation"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.installation.deassociate

Namespace's [GitHub runner](/docs/solutions/github-actions) application has been deassociated from the workspace.

```json theme={null}
{
    "action": "github.installation.deassociate",
    "actor": {
        "claims": {
            "login": "octocat"
        },
        "source": "github",
        "type": "external"
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_installation_id": "1234...",
            "type": "github_installation"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.profile.build.finished

A custom image build finished for a GitHub runner profile.

```json theme={null}
{
    "action": "github.profile.build.finished",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "build_ref": "build_...",
        "image_ref": "nscr.io/example/githubrunner/default:v2",
        "status": "READY"
    },
    "targets": [
        {
            "github_profile_id": "...",
            "type": "github_profile"
        }
    ],
    "tenant_id": "tenant_..."
}
```

<h2 id="githubprofilebuild_custom_image">
  github.profile.build\_custom\_image
</h2>

A custom image build was triggered for a GitHub runner profile.

```json theme={null}
{
    "action": "github.profile.build_custom_image",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_profile_id": "...",
            "type": "github_profile"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.profile.create

A GitHub runner profile has been created.

```json theme={null}
{
    "action": "github.profile.create",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_profile_id": "...",
            "type": "github_profile"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.profile.delete

A GitHub runner profile has been deleted.

```json theme={null}
{
    "action": "github.profile.delete",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_profile_id": "...",
            "type": "github_profile"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## github.profile.update

A GitHub runner profile has been updated.

```json theme={null}
{
    "action": "github.profile.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "github_profile_id": "...",
            "type": "github_profile"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## instance.destroy

An instance was destroyed.

```json theme={null}
{
    "action": "instance.destroy",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "instance_id": "...",
            "type": "instance"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## instance.ssh

An SSH session was initiated with a workspace instance.

```json theme={null}
{
    "action": "instance.ssh",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "instance_id": "...",
            "type": "instance"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## registry.manifest.create

A container manifest was pushed to the registry.

```json theme={null}
{
    "action": "registry.manifest.create",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "image_digest": "sha256:..."
    },
    "targets": [
        {
            "image_ref": "nscr.io/abc123/my-app@sha256:...",
            "type": "registry_image"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## registry.manifest.delete

A container manifest was deleted from the registry.

```json theme={null}
{
    "action": "registry.manifest.delete",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "image_digest": "sha256:..."
    },
    "targets": [
        {
            "image_ref": "nscr.io/abc123/my-app@sha256:...",
            "type": "registry_image"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## registry.repository.delete

A container repository was deleted from the registry.

```json theme={null}
{
    "action": "registry.repository.delete",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "image_ref": "nscr.io/abc123/my-app@sha256:...",
            "type": "registry_image"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## registry.tag.create

A tag was created in the container registry.

```json theme={null}
{
    "action": "registry.tag.create",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "image_digest": "sha256:...",
        "image_tag": "latest"
    },
    "targets": [
        {
            "image_ref": "nscr.io/abc123/my-app@sha256:...",
            "type": "registry_image"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## registry.tag.delete

A tag was deleted from the container registry.

```json theme={null}
{
    "action": "registry.tag.delete",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "image_tag": "latest"
    },
    "targets": [
        {
            "image_ref": "nscr.io/abc123/my-app@sha256:...",
            "type": "registry_image"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## token.revokable.create

An API token was created for the workspace.

```json theme={null}
{
    "action": "token.revokable.create",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "expires_at": "2025-01-01T00:00:00Z",
        "name": "CI Token",
        "token_id": "tok_..."
    },
    "tenant_id": "tenant_..."
}
```

## token.revokable.refresh

An API token expiry was refreshed.

```json theme={null}
{
    "action": "token.revokable.refresh",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "expires_at": "2025-02-01T00:00:00Z",
        "minimum_duration": "720h0m0s",
        "previous_expires_at": "2025-01-01T00:00:00Z"
    },
    "tenant_id": "tenant_..."
}
```

## token.revokable.revoke

An API token was revoked.

```json theme={null}
{
    "action": "token.revokable.revoke",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "token_id": "tok_..."
    },
    "tenant_id": "tenant_..."
}
```

## token.revokable.used

An API token was used to authenticate.

```json theme={null}
{
    "action": "token.revokable.used",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "tenant_id": "tenant_..."
}
```

## vault.list

Vault secrets were listed for the workspace.

```json theme={null}
{
    "action": "vault.list",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "tenant_id": "tenant_..."
}
```

## vault.resolve

A vault secret was resolved (accessed).

```json theme={null}
{
    "action": "vault.resolve",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "secret_id": "sec_...",
            "type": "vault_secret"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## vault.set

A vault secret was created or updated.

```json theme={null}
{
    "action": "vault.set",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "secret_id": "sec_...",
            "type": "vault_secret"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## volume.release

Emitted when a volume is released by an actor, e.g. by pressing `[Release]` in the Web application.

```json theme={null}
{
    "action": "volume.release",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "tag": "my-volume"
    },
    "tenant_id": "tenant_..."
}
```

## vpc.attach

A VPC network segment was attached to an instance.

```json theme={null}
{
    "action": "vpc.attach",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "targets": [
        {
            "network_segment_tag": "egress-...",
            "type": "network_segment"
        }
    ],
    "tenant_id": "tenant_..."
}
```

## workspace.membership.add

A user has been added to the workspace.

```json theme={null}
{
    "action": "workspace.membership.add",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "role": "READER"
    },
    "targets": [
        {
            "email": "quux@example.com",
            "type": "user",
            "user_id": "user_..."
        }
    ],
    "tenant_id": "tenant_..."
}
```

## workspace.membership.remove

A user has been removed from the workspace.

```json theme={null}
{
    "action": "workspace.membership.remove",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "role": "READER"
    },
    "targets": [
        {
            "email": "quux@example.com",
            "type": "user",
            "user_id": "user_..."
        }
    ],
    "tenant_id": "tenant_..."
}
```

<h2 id="workspacemembershipsso_join">
  workspace.membership.sso\_join
</h2>

A user joined the workspace via SSO.

```json theme={null}
{
    "action": "workspace.membership.sso_join",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "role": "READER"
    },
    "targets": [
        {
            "email": "quux@example.com",
            "type": "user",
            "user_id": "user_..."
        }
    ],
    "tenant_id": "tenant_..."
}
```

## workspace.membership.update

The role of a workspace member was changed.

```json theme={null}
{
    "action": "workspace.membership.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "role": "ADMIN"
    },
    "targets": [
        {
            "email": "quux@example.com",
            "type": "user",
            "user_id": "user_..."
        }
    ],
    "tenant_id": "tenant_..."
}
```

## workspace.ownership.transfer

Ownership of a Workspace has been transferred to a different user

```json theme={null}
{
    "action": "workspace.ownership.transfer",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "previous_owner": {
            "email": "old-owner@example.com",
            "type": "user",
            "user_id": "user..."
        }
    },
    "targets": [
        {
            "email": "quux@example.com",
            "type": "user",
            "user_id": "user_..."
        }
    ],
    "tenant_id": "tenant_..."
}
```

## workspace.token.emit

An authorization token has been emitted for the workspace, e.g. a user signed in.

```json theme={null}
{
    "action": "workspace.token.emit",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "duration": "600s"
    },
    "tenant_id": "tenant_..."
}
```

## workspace.trust.update

The workspace trust relationships were updated.

```json theme={null}
{
    "action": "workspace.trust.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "metadata": {}
    },
    "tenant_id": "tenant_..."
}
```

## workspace.update

The Workspace configuration was updated.

```json theme={null}
{
    "action": "workspace.update",
    "actor": {
        "email": "foobar@example.com",
        "type": "user",
        "user_id": "user_..."
    },
    "at": "2025-03-14T21:08:41+00:00",
    "attributes": {
        "name": "New Workspace Name"
    },
    "tenant_id": "tenant_..."
}
```