Audit log

39Audit log

Every account-shaping mutation writes an audit event: who did it, what it was, and to what. Recorded actions: key.create, key.update, key.delete, budget.update, byok.add, byok.remove, org.invite.create, org.member.add and org.member.remove. Inference requests are not audit events; they are the usage log.

# Your own trail, newest first, last 100 events:
curl https://rapidrouter.ai/api/v1/audit \
  -H "Authorization: Bearer <session JWT>"

# -> { "ok": true, "data": [
#      { "id": "aud_...", "actor_email": "you@example.com",
#        "action": "key.create", "subject": "key_...",
#        "detail": { "name": "customer-42" }, "created_at": "..." },
#      ...
#    ] }

# The organisation's trail:
curl https://rapidrouter.ai/api/v1/orgs/<org_id>/audit \
  -H "Authorization: Bearer <session JWT>"

GET /v1/audit returns your own events. GET /v1/orgs/:id/audit is gated like the other organisation reads: you must be a member, the owner and admins see everyone's events, and a plain member sees only the events they caused themselves. Writes are best effort by design: a failed audit insert never fails or slows the mutation it describes.