AuditLog

An audit log event recording a significant action in your organization.

Every state-changing operation in Massdriver is captured as an audit log event, following the CloudEvents specification. Use audit logs to track who made changes, investigate incidents, and satisfy compliance requirements.

Event types use dot notation to categorize actions (e.g., project.created, deployment.completed, group.member_added).

Subjects use MRI (Massdriver Resource Identifier) format to identify the affected resource (e.g., mri://organization/my-org/project/backend).

type AuditLog {
  id: ID!
  occurredAt: DateTime!
  type: String!
  source: String!
  subject: String
  data: Map
  metadata: Map!
  attributes: Map!
  actor: AuditLogActor!
}

Fields

AuditLog.id ● ID! non-null scalar {#id}

Unique identifier for this audit log event.

AuditLog.occurredAt ● DateTime! non-null scalar {#occurred-at}

When the event occurred (UTC). This is the authoritative timestamp for the action.

AuditLog.type ● String! non-null scalar {#type}

Event type in dot notation (e.g., project.created, deployment.completed).

AuditLog.source ● String! non-null scalar {#source}

The system component or service that generated this event.

AuditLog.subject ● String scalar {#subject}

The affected resource in MRI format (e.g., mri://organization/my-org/project/backend). May be null for organization-wide events.

AuditLog.data ● Map scalar {#data}

Event payload containing context-specific details about the action. The structure varies by event type.

AuditLog.metadata ● Map! non-null scalar {#metadata}

Facts recorded with the event that you can filter on, such as how the actor authenticated (credential) or whether a resource export revealed a secret (contains_secrets). eventTypes lists the metadata each event type records.

AuditLog.attributes ● Map! non-null scalar {#attributes}

The custom and system (md-*) attributes of the event's entity when the event happened, e.g. {"md-project": "api", "md-environment": "prod", "TEAM": "payments"}. Empty for entities that do not carry attributes, such as accounts and access tokens.

AuditLog.actor ● AuditLogActor! non-null object {#actor}

The actor (user, service account, deployment, or system) that performed this action.

Returned By

auditLog query

Member Of

AuditLogsPage object