Audit log event types

Every audit log entry has one of the event names below, in the form resource.action (a few have an extra part, such as portal.session.create). Filter on them in the dashboard’s Events menu or in a log drain. The Events menu and the log drain picker also list event types that aren’t recorded. Filtering on these event types matches nothing:

workspace.delete
workspace.opt_in
auditLogBucket.create
ratelimit.read_override
environment.create
deployment.redeploy
secret.update
webhook.create
webhook.update
webhook.delete

Unkey doesn’t send webhooks. Use a log drain to forward entries to your own endpoint.

Workspace

Event	Recorded when
`workspace.create`	A workspace is created.
`workspace.update`	The workspace is renamed, changes plan, or another workspace-level setting changes. A feature flag change records the flag’s `slug` and its `before` and `after` values in the metadata.
`workspace.install_github`	The GitHub app is installed for the workspace.
`logdrain.create`, `logdrain.update`, `logdrain.delete`	A log drain is created, changed, or deleted.
`secret.create`, `secret.decrypt`	A one-time share link is created, or someone reveals it. Revealing a link doesn’t require signing in, so `secret.decrypt` uses the `system` actor with ID `secret-share`.

Keyspaces and keys

Event	Recorded when
`api.create`	A keyspace is created.
`api.update`	A keyspace setting changes, including delete protection.
`api.delete`	A keyspace is deleted.
`key.create`	A key is created, including keys created through a portal session.
`key.update`	A key’s fields, credits, permissions, or roles change.
`key.reroll`	A key is rerolled.
`key.delete`	A key is deleted.
`key.verify`	A root key calls `keys.verifyKey`.

Root keys

Root-key lifecycle actions use separate events from API key actions.

Event	Recorded when
`rootKey.create`	A root key is created.
`rootKey.update`	A root key’s name or permissions change.
`rootKey.reroll`	A root key is rerolled.
`rootKey.delete`	A root key is deleted.

CLI sessions

Event	Recorded when
`cli.session.create`	A CLI login is approved and the CLI receives its session.
`cli.session.refresh`	The CLI refreshes its session token.
`cli.session.revoke`	A CLI session is revoked.

Authentication

Authentication denial events record blocked attempts, not successful access.

Event	Recorded when
`auth.ipDenied`	A request uses a root key from an IP address outside its allowlist.

The event name is shared across authentication types. Root-key authentication emits this event. The actor and target identify the root key used in the attempt. Its meta contains:

Field	Value
`request_id`	The request ID.
`allowed_ips`	The normalized IP addresses and CIDR ranges used for the allowlist check.

The event timestamp records the denial time. The top-level remote_ip and user_agent fields record the client IP used for the allowlist check and the request’s user-agent header. The description also includes the source IP. Unkey sends these events directly to ClickHouse through an in-memory buffer, without the MySQL outbox. Delivery is best-effort: a full buffer, a failed write, or a process crash can lose events. The request remains denied regardless of event delivery. A denial does not by itself prove that a credential was compromised.

Authorization

Event	Recorded when
`permission.create`	A permission is defined.
`permission.update`	A permission changes.
`permission.delete`	A permission is deleted.
`role.create`	A role is defined.
`role.update`	A role changes.
`role.delete`	A role is deleted.
`authorization.connect_role_and_permission`	A permission is added to a role.
`authorization.disconnect_role_and_permissions`	Permissions are removed from a role.
`authorization.connect_role_and_key`	A role is added to a key.
`authorization.disconnect_role_and_key`	A role is removed from a key.
`authorization.connect_permission_and_key`	A permission is attached directly to a key.
`authorization.disconnect_permission_and_key`	A permission is detached from a key.

Identities

Event	Recorded when
`identity.create`	An identity is created.
`identity.update`	An identity’s metadata or rate limits change.
`identity.delete`	An identity is deleted.

Rate limiting

Event	Recorded when
`ratelimitNamespace.create`	A namespace is created.
`ratelimitNamespace.update`	A namespace is renamed or changed.
`ratelimitNamespace.delete`	A namespace is deleted.
`ratelimit.create`	A rate limit is created on a key or identity.
`ratelimit.update`	A rate limit on a key or identity changes.
`ratelimit.delete`	A rate limit is removed.
`ratelimit.limit`	A root key calls `ratelimit.limit` or `ratelimit.multiLimit`. A `ratelimit.multiLimit` call records one entry per limit checked, all with the same correlation ID.
`ratelimit.set_override`	An override is created or changed.
`ratelimit.delete_override`	An override is deleted.

Developer portal

Event	Recorded when
`portal.create`	A portal is created.
`portal.update`	A portal is renamed, re-pointed, enabled, disabled, or rebranded. The metadata records how many sessions were revoked, which is only more than 0 for a re-point or a disable.
`portal.delete`	A portal is deleted, with the number of sessions revoked in the metadata.
`portal.session.create`	`portal.createSession` mints a session.
`portal.session.exchange`	`portal.exchangeCode` turns a code into an access token.
`portal.session.revoke`	`portal.revokeSession` revokes an end user’s live sessions, with their `externalId`, the session ids, and the count in the metadata. Not written when nothing was revoked.
`portal.domain.create`, `portal.domain.delete`, `portal.domain.verify`	A portal custom domain is added, removed, or has verification restarted. Deleting a portal writes one `portal.domain.delete` entry per domain it had.

Compute

Compute actions appear in the same log.

Event	Recorded when
`project.create`, `project.update`, `project.delete`	A is created, changed, or deleted.
`app.create`, `app.update`, `app.delete`	An app is created, changed, or deleted.
`app.connect_repository`, `app.disconnect_repository`	A GitHub repository is connected to or disconnected from an app.
`environment.update`, `environment.delete`	An environment’s settings or variables change, or it is deleted.
`deployment.create`	A deployment is created from git, an image, or another deployment.
`deployment.authorize`	A deployment from an unauthorized contributor is approved to run.
`deployment.rebuild`	A deployment is rebuilt.
`deployment.cancel`	A build still in progress is cancelled, for example when its environment is deleted.
`deployment.stop`, `deployment.wake`	A deployment is stopped or started again.
`deployment.promote`, `deployment.rollback`	The environment’s live deployment changes.
`domain.create`, `domain.delete`, `domain.verify`	A custom domain is added, removed, or has verification restarted.

Get started

Workspace

Audit logs

Billing

Root keys

API

CLI

AI coding

Security

Errors

Audit log event types

Workspace

Keyspaces and keys

Root keys

CLI sessions

Authentication

Authorization

Identities

Rate limiting

Developer portal

Compute