Logs

Audit trail

The audit trail records every change to your Flows, Agents, and Records: who made the change, when, and from where. Use it to answer questions like “who edited this Flow yesterday?” or “which API key deleted these Records?”

Viewing the audit trail is available on Enterprise plans. Changes are always recorded regardless of plan, so if you upgrade later your full history is already there.

What gets audited

Runtype writes an audit entry whenever a Flow, Agent, Record, or credential changes:

  • Flows: create, edit (including draft saves), delete, publish, and active version changes.
  • Agents: create, edit, delete, publish, active version changes, and capability additions and deletions.
  • Records: create, edit, delete, and bulk operations (bulk edit, bulk delete, and CSV import).
  • Secrets: create, edit, and delete. Entries record the secret’s name and metadata, never its value.
  • API keys, provider keys, and client tokens: create, edit, rotate or regenerate, and revoke or delete. Entries record names, prefixes, and permissions, never key material.
  • Integrations: connect, update, and disconnect.

Changes made through product imports, templates, and quick start are audited too. Only changes are audited. Viewing an entity does not create an entry.

Where to find it

  • Record details sheet: click the Activity tab to see the Record’s change history.
  • Flow editor and Agent editor: open the Save/Publish dropdown and choose Activity.
  • Logs page: select the Audit category in the type filter to see audit entries alongside execution logs.

The Activity views in the dashboard show the last 30 days of changes, newest first.

What each entry shows

  • Action: what happened, for example flow.published or record.updated.
  • Actor: who made the change and how. This can be a dashboard user, an API key (with its name), the CLI, the SDK, an MCP client, or Terraform.
  • Timestamp: when the change happened.
  • Before and after snapshots: expandable views of the entity before and after the change, with secrets redacted. Very large snapshots are omitted.
  • Bulk operation summary: for bulk edits, bulk deletes, and CSV imports, how many Records were affected.

Publishing a Flow or Agent produces two entries: one with the published configuration snapshot, and one for the active version change showing the previous and new version IDs.

Querying the audit trail via the API

Audit entries are regular log events with the audit category, so you can query them through the logs API.

cURL
$# Everything that happened to a Flow
$curl "https://api.runtype.com/v1/logs?category=audit&flowId=YOUR_FLOW_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"
$
$# Everything that happened to an Agent
$curl "https://api.runtype.com/v1/logs?category=audit&agentId=YOUR_AGENT_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"
$
$# Changes to a Record
$curl "https://api.runtype.com/v1/logs?category=audit&search=YOUR_RECORD_ID" \
>  -H "Authorization: Bearer YOUR_API_KEY"

Record queries use search because audit entries index the Record ID in the log message. When searching by Record ID, a bulk operation appears under the first Record in the batch, so a search for another Record in the same batch may not surface it. The Record’s Activity tab in the dashboard matches bulk operations against the full affected list, making it the most complete view for a single Record.

Next steps