Audit Logs

oCore records audit logs for every significant action performed in your organization. Audit logs provide a tamper-resistant record of who did what and when, supporting compliance requirements, security investigations, and operational troubleshooting.

What Events Are Logged

oCore audit logs capture events across all resource types:

Authentication Events

Organization Events

Infrastructure Events

Deployment Events

Data Management Events

Access Control Events

Viewing Audit Logs

Dashboard View

The audit log page in the dashboard provides a filterable, searchable view of all events. Each log entry shows:

• Timestamp -- When the event occurred (UTC)
• Actor -- Who performed the action (user email or "system" for automated events)
• Action -- The event type (e.g., instance.created)
• Resource -- The affected resource type and ID
• Details -- Additional context (IP address, user agent, changed fields)

API Access

curl "https://ocore.example.com/api/audit-logs?limit=50&offset=0" \
  -H "Authorization: Bearer $TOKEN"

ocore audit list --limit 50

Filtering

Filter audit logs by multiple criteria:

curl "https://ocore.example.com/api/audit-logs?\
action=instance.created&\
userId=USER_UUID&\
from=2026-02-01T00:00:00Z&\
to=2026-02-28T23:59:59Z&\
limit=50" \
  -H "Authorization: Bearer $TOKEN"

Available filters:

Login Event Tracking

Login events receive special attention in the audit log because they are the most security-sensitive:

What Login Logs Capture

Suspicious Login Detection

Review login events for security anomalies:

• Multiple failed attempts from the same IP (possible brute force)
• Logins from unusual geographic locations
• Logins at unusual times
• New user agents appearing

# View recent failed login attempts
curl "https://ocore.example.com/api/audit-logs?action=auth.login_failed&limit=20" \
  -H "Authorization: Bearer $TOKEN"

Data Retention

Audit log retention depends on your deployment configuration:

Integration with External Systems

Exporting Audit Logs

For long-term archival or SIEM integration, export audit logs periodically:

# Export logs for a date range
curl "https://ocore.example.com/api/audit-logs/export?\
from=2026-02-01T00:00:00Z&\
to=2026-02-28T23:59:59Z" \
  -H "Authorization: Bearer $TOKEN" \
  -o audit-export.json

Webhook Notifications

Configure webhook endpoints to receive real-time audit event notifications. See Webhooks for setup instructions.

Required Permissions

All system roles except Viewer have audit log view access by default.

Troubleshooting

Audit logs missing events

• Events are logged asynchronously -- there may be a brief delay (typically under 1 second)
• Check your date range filter -- events use UTC timestamps
• Automated system events (e.g., scheduled backups) show "system" as the actor

Cannot access audit logs

• Verify your role has the view:audit_logs permission
• Audit logs are scoped to your current organization
• Some events may only be visible to organization Owners

Audit log query is slow

• Use specific filters (action, date range, userId) rather than fetching all logs
• Reduce the limit parameter for faster responses
• Use pagination (offset) to browse large result sets

Events from API keys not showing user

• API key events show the key name and ID rather than a user email
• Cross-reference with the API key list to identify the creator