Skip to navigation
Logs

Audit trail

The audit trail records changes to your Flows, Agents, Records, credentials, and integrations. It identifies who made each change, when it happened, and its source. Use it to answer questions such as “Who edited this Flow yesterday?” or “Which API key deleted these Records?”

Runtype records changes on every plan. You can view the audit trail on Enterprise plans.

Runtype saves an entry for an organization connection credential change or an organization API key change together with the change itself. This includes keys that are issued or revoked through CLI sign-in, OAuth, and onboarding. Runtype records other changes separately, so in rare cases their entry can be missing.

What gets audited

Runtype writes audit entries for the following resources and operations:

  • Flows: create, edit (including draft saves), delete, publish, and change the active version.
  • Agents: create, edit, delete, publish, change the active version, add or delete capabilities, activate, roll back, and archive release aliases, and change an alias’s secret bindings. A binding entry records the alias, its new revision, and the binding names, never a binding value.
  • Records: create, edit, delete, and bulk operations, including bulk edits, bulk deletes, and CSV imports.
  • Secrets: create, edit, and delete. Entries include the secret name and metadata, but not its value.
  • API keys: create, edit, and revoke. Rotation is recorded as an edit, and deletion is recorded as revocation.
  • API key requests: create, approve, decline, claim, cancel, and expire.
  • Provider keys: create, edit, rotate, and delete. Entries include identifying metadata, but not key material.
  • Client tokens: create, edit, regenerate, and delete. Entries include identifying metadata, but not token material.
  • Integrations: connect, update, and disconnect.
  • Organization connections: create, migrate, rotate credentials, update settings, change the default, activate, revoke, and delete. Entries include identifying metadata, but not credential values. When a change sets which credential a provider uses, Runtype also records the provider’s credential policy change.
  • Model configurations: create, migrate, enable, disable, update settings, change the default or connection, and delete.
  • Sandbox deployments, such as previews from the deploy_sandbox MCP tool: create, update, rename, renew, suspend, resume, destroy, and expire.
  • Question sets: create, update, publish, and calibrate.

Runtype also audits resource changes made through imports, templates, and quick start. Viewing an entity in the dashboard does not create an entry. When Runtype support staff read your account data, such as a run’s trace, Runtype records an entry with the admin actor source.

Find audit entries

Use the following dashboard locations to view audit entries:

  • In the Record details sheet, click the Activity tab to view the Record’s change history.
  • In the Flow editor or Agent editor, open the actions menu and click Activity.
  • On the Logs page, select Audit from the Type filter to view audit entries with execution logs.

The dashboard Activity views show the last 30 days of changes, from newest to oldest. For a busy resource, an Activity view scans only the most recent events and says so. When it does, use the Logs page with the Audit filter to see the full trail.

What each entry shows

Each audit entry includes the following information:

  • Action: what happened, such as flow.published or record.updated.
  • Actor: the source of the change. It can be a dashboard user, the dashboard assistant, an API key, the CLI, the SDK, an MCP client, Code Mode MCP, Terraform, another API caller, or Runtype support staff. The UI shows an API key’s name when available. A change that the dashboard assistant makes shows as the Assistant on behalf of the person who asked, and the entry’s actor.source is dashboard-assistant. This attribution is for display only and doesn’t change permissions.
  • Timestamp: when the change happened.
  • Before and after snapshots: expandable views of the entity before and after the change. Runtype redacts secrets and omits a snapshot larger than 20 KB.
  • Details: extra information about the change, such as counts and affected Record IDs for bulk edits, bulk deletes, and CSV imports.

When you publish a Flow or Agent, Runtype creates two entries. One entry contains the published configuration snapshot. The other records the active version change with the previous and new version IDs.

Query the audit trail with the API

Set category to audit to query audit entries through the Logs API. The following requests list the audit entries for one Flow since a start time:

curl "https://api.runtype.com/v1/logs?category=audit&flowId=YOUR_FLOW_ID&from=START_TIME" \
  -H "Authorization: Bearer YOUR_API_KEY"

Replace the placeholders in the requests with these values:

  • YOUR_API_KEY: your Runtype API key. The key needs the FLOWS:READ, AGENTS:READ, or ANALYTICS:READ permission.
  • YOUR_FLOW_ID: the ID of the Flow to query.
  • START_TIME: the start of the time range, as an ISO 8601 timestamp such as 2026-09-01T00:00:00Z. Without from, the query covers only the last 24 hours. Use to to set the end of the range.

To query other resources, change the filter:

  • For an Agent, replace flowId with agentId. In the CLI, replace --flow with --agent.
  • For a Record, a secret, a key, or any other resource, pass its ID as search (--search in the CLI). Each audit entry’s message is the action followed by the entity ID, so search also matches an action name, such as secret.deleted or api_key.revoked.

From an MCP client connected to the Runtype MCP server, call the list_logs tool with type set to audit.

If your plan doesn’t include the audit trail, a request with category=audit returns HTTP 402 with the error Feature Not Available.

Read an audit entry

Each audit entry has type set to audit. Its metadata object holds the fields that the dashboard shows. The following example shows a trimmed entry:

{
  "id": "req_abc123-2026-09-26T14:02:11.000Z-1",
  "timestamp": "2026-09-26T14:02:11.000Z",
  "type": "audit",
  "title": "flow.updated flow_01jabc",
  "metadata": {
    "action": "flow.updated",
    "entityType": "flow",
    "entityId": "flow_01jabc",
    "actor": {
      "source": "cli",
      "authMethod": "api_key",
      "apiKey": { "id": "key_01jxyz", "name": "CI deploy key", "prefix": "rt_live_" }
    },
    "before": { "name": "Lead scoring" },
    "after": { "name": "Lead scoring v2" },
    "diff": [
      { "path": "/name", "op": "replace", "before": "Lead scoring", "after": "Lead scoring v2" }
    ]
  }
}

The metadata object contains these fields:

  • action, entityType, and entityId: what changed.
  • actor: who made the change, including source and, for API key callers, the key’s ID, name, and prefix. A change from the dashboard assistant has source set to dashboard-assistant.
  • before and after: the snapshots.
  • diff: the changed paths, each with an op of add, remove, or replace.
  • meta: the Details information, such as bulk counts and affected Record IDs.
  • previousVersionId and newVersionId: the version IDs for an active version change.
  • droppedForBudget: the fields that Runtype removed because the entry was too large.

Page through results

A response returns up to 500 entries by default. Set limit to return up to 1,000 entries per page, and set order to asc or desc. The response puts the entries in data.entries. When data.pagination.hasMore is true, pass data.pagination.cursor as cursor to get the next page.

Check these response fields when you need a complete trail:

  • data.pagination.cursorReset: when true, Runtype couldn’t use your cursor and restarted at the first page. Stop paging and start the query again.
  • data.degraded: when true, Runtype couldn’t read some entries, so entries are missing from the response. Retry the request.

Find bulk operations for a Record

The API has no Record ID filter, so search for the Record ID. A bulk operation’s message contains only the first Record’s ID, so a search can miss a bulk operation that changed your Record.

The Record’s Activity tab also checks each bulk operation’s list of affected Record IDs. For a very large bulk operation, Runtype stores only part of the list. The Activity tab says when it can’t check an operation against the Record.

Next steps

Continue with these guides: