Logs

Audit trail

The audit trail records changes to your Flows, Agents, and Records. It identifies who made each change, when it happened, and its source. Use it to answer questions such as “Who edited this Flow yesterday?” or “Which API key deleted these Records?”

The audit trail is available on Enterprise plans. Your plan controls whether you can view the trail, not whether Runtype attempts to record changes. Runtype stores organization connection credential changes and organization management API-key changes in the same transaction as the resource change, then retries delivery. This includes keys issued or revoked through CLI sign-in, OAuth, onboarding, agent authentication, internal tooling, security remediation, and membership offboarding. Personal management keys and other change families use best-effort delivery. A logging or delivery failure can leave an event absent.

What gets audited

Runtype writes audit entries for the following resources and operations:

  • Flows: create, edit, including draft saves, delete, publish, and change the active version.
  • Agents: create, edit, delete, publish, change the active version, add or delete capabilities, and roll back or archive a release alias.
  • Records: create, edit, delete, and bulk operations, including bulk edits, bulk deletes, and CSV imports.
  • Secrets: create, edit, and delete. Entries include the secret name and metadata, but not its value.
  • API keys: create, edit, rotate, revoke, and delete. Rotation is recorded as an edit.
  • Provider keys: create, edit, rotate, and delete. Entries include identifying metadata, but not key material.
  • Client tokens: create, edit, regenerate, and delete. Entries include identifying metadata, but not token material.
  • Integrations: connect, update, and disconnect.

Runtype also audits resource changes made through imports, templates, and quick start. Viewing an entity in the dashboard does not create an entry.

Find audit entries

Use the following dashboard locations to view audit entries:

  • In the Record details sheet, click the Activity tab to view the Record’s change history.
  • In the Flow editor or Agent editor, open the actions menu and click Activity.
  • On the Logs page, select Audit from the Type filter to view audit entries with execution logs.

The dashboard Activity views show the last 30 days of changes. They list changes from newest to oldest.

What each entry shows

Each audit entry includes the following information:

  • Action: what happened, such as flow.published or record.updated.
  • Actor: the source of the change. It can be a dashboard user, an API key, the CLI, the SDK, an MCP client, Code Mode MCP, Terraform, or another API caller. The UI shows an API key’s name when available.
  • Timestamp: when the change happened.
  • Before and after snapshots: expandable views of the entity before and after the change. Runtype redacts secrets and omits very large snapshots.
  • Bulk operation summary: counts and affected Record IDs for bulk edits, bulk deletes, and CSV imports.

When you publish a Flow or Agent, Runtype creates two entries. One entry contains the published configuration snapshot. The other records the active version change with the previous and new version IDs.

Query the audit trail with the API

Use the audit category to query audit entries through the Logs API. The following cURL requests filter entries by Flow, Agent, or Record:

cURL
$curl "https://api.runtype.com/v1/logs?category=audit&flowId=YOUR_FLOW_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"
$
$curl "https://api.runtype.com/v1/logs?category=audit&agentId=YOUR_AGENT_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"
$
$curl "https://api.runtype.com/v1/logs?category=audit&search=YOUR_RECORD_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"

Replace the placeholders in the requests with these values:

  • YOUR_API_KEY: your Runtype API key.
  • YOUR_FLOW_ID: the ID of the Flow to query.
  • YOUR_AGENT_ID: the ID of the Agent to query.
  • YOUR_RECORD_ID: the ID of the Record to query.

Use search for Record queries because audit entries include the Record ID in their log message. A bulk operation uses the first Record’s ID in its log message. A search for another Record in the same batch might not find it. The Record’s Activity tab also checks the affected-ID list and can show matching bulk operations. For a large bulk operation, Runtype records only a sample of affected IDs. The Activity tab can report that it cannot confirm the operation for a Record.

Next steps

Continue with these guides: