The audit log records changes to projects, workspaces, variables, credentials, policies, and the registry, plus run decisions, state changes, and sensitive downloads.
View the audit log
Owners and admins can open Audit log in the sidebar. Events are listed newest first, 50 per page, with the time, actor, action, target, and request ID. Current members show as name and email; other actors show as an ID.
Common actions
| Area | Actions |
|---|---|
| Runs | run.created, run.approved, run.rejected, run.canceled, run.force_canceled, run.expired, run.recovered |
| State | state.published, state.downloaded, state.force_unlocked, state.recovered, state_output.read_sensitive |
| Downloads | artifact.downloaded (raw plans and emergency state, with the reason given) |
| Policies | policy_set.created, policy_version.requested, policy_attachment.created, policy_attachment.detached, policy_override.created |
| Workspaces | project.created, workspace.created, workspace.deleted, workspace.settings.updated, workspace.source.updated, workspace.schedule.updated, workspace.schedule.deleted |
| Variables | variable.created, variable.updated, variable.deleted |
| Credentials | credential_profile.created, credential_profile.archived, credential_profile_version.created, credential_profile_version.verified, credential_profile_version.revoked |
| Access | access_assignment.created, access_assignment.deleted, service_account.created, service_account.token_created, service_account.token_revoked |
| GitHub | github.installation_completed, github.installation.revoked, github.installation.suspended |
| Registry | registry.module.created, registry.module.version_published, registry.module.version_downloaded, registry.module.deleted, and others listed in Publishing modules |
Audit events never include secret values, variable values, state, plan contents, repository contents, IP addresses, or user agents.
Read the audit log with the API
curl "https://api.stackship.run/v1/audit-events?limit=100" \
-H "Authorization: Bearer $STACKSHIP_TOKEN"The token needs owner or admin access. Each item contains:
| Field | Meaning |
|---|---|
object |
Always audit_event |
actor_id |
ID of the user or service account |
action |
Action name, such as run.approved |
target_type |
Kind of object affected |
target_id |
ID of the object affected, or null |
request_id |
ID of the request that caused the event |
created_at |
Event time (RFC 3339) |
limit is 1–100 (default 50). To get the next page, pass
meta.page.next_cursor from the response as cursor. When next_cursor is
null, you’ve reached the oldest event.
Limitations
There’s no audit log export, SIEM streaming, webhooks, or configurable retention. Use the API to copy events into your own system.