Skip to main content
Strait records security-sensitive and control-plane operations in the audit_events table (migration 000057).

​
Schema

The audit_events table stores immutable audit records: Indexed by (project_id, created_at DESC) and (resource_type, resource_id, created_at DESC) for efficient querying.

​
Endpoint

  • GET /v1/audit-events

​
Filters

  • project_id (required, unless present in request context)
  • actor_id
  • resource_type
  • resource_id
  • from (RFC3339)
  • to (RFC3339)
  • order (asc or desc, default desc)
  • limit
  • cursor
Results support cursor pagination and optional time-window filtering.

​
Event Coverage

​
Current Coverage

  • Role create/update/delete
  • Member assign/remove/bulk assign
  • Resource policy and tag policy create/delete
  • API key revoke/rotate
  • Job destructive operations

​
Planned Extensions

  • before_state / after_state JSONB columns for change tracking (sensitive fields redacted)
  • ip_address and user_agent columns for forensic context
  • Extended coverage: job CRUD, run trigger/cancel/replay, workflow CRUD, webhook subscription changes

​
Why It Matters

Audit events give you:
  • Actor attribution (actor_type, actor_id)
  • Target attribution (resource_type, resource_id)
  • Action classification (action)
  • Timestamped forensic history for incident response
For role and policy behavior, see RBAC & Policy Authorization.