> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.runtype.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.runtype.com/_mcp/server. # Audit trail > See who changed your Flows, Agents, Records, and credentials, and when. The audit trail records changes to your Flows, Agents, Records, credentials, and integrations. It identifies who made each change, when it happened, and its source. Use it to answer questions such as "Who edited this Flow yesterday?" or "Which API key deleted these Records?" Runtype records changes on every plan. You can view the audit trail on Enterprise plans. Runtype saves an entry for an organization connection credential change or an organization API key change together with the change itself. This includes keys that are issued or revoked through CLI sign-in, OAuth, and onboarding. Runtype records other changes separately, so in rare cases their entry can be missing. ## What gets audited Runtype writes audit entries for the following resources and operations: * **Flows**: create, edit (including draft saves), delete, publish, and change the active version. * **Agents**: create, edit, delete, publish, change the active version, add or delete capabilities, activate, roll back, and archive release aliases, and change an alias's secret bindings. A binding entry records the alias, its new revision, and the binding names, never a binding value. * **Records**: create, edit, delete, and bulk operations, including bulk edits, bulk deletes, and CSV imports. * **Secrets**: create, edit, and delete. Entries include the secret name and metadata, but not its value. * **API keys**: create, edit, and revoke. Rotation is recorded as an edit, and deletion is recorded as revocation. * **API key requests**: create, approve, decline, claim, cancel, and expire. * **Provider keys**: create, edit, rotate, and delete. Entries include identifying metadata, but not key material. * **Client tokens**: create, edit, regenerate, and delete. Entries include identifying metadata, but not token material. * **Integrations**: connect, update, and disconnect. * **Organization connections**: create, migrate, rotate credentials, update settings, change the default, activate, revoke, and delete. Entries include identifying metadata, but not credential values. When a change sets which credential a provider uses, Runtype also records the provider's credential policy change. * **Model configurations**: create, migrate, enable, disable, update settings, change the default or connection, and delete. * **Sandbox deployments**, such as previews from the `deploy_sandbox` MCP tool: create, update, rename, renew, suspend, resume, destroy, and expire. * **Question sets**: create, update, publish, and calibrate. Runtype also audits resource changes made through imports, templates, and quick start. Viewing an entity in the dashboard does not create an entry. When Runtype support staff read your account data, such as a run's trace, Runtype records an entry with the `admin` actor source. ## Find audit entries Use the following dashboard locations to view audit entries: * In the **Record details sheet**, click the **Activity** tab to view the Record's change history. * In the **Flow editor** or **Agent editor**, open the actions menu and click **Activity**. * On the **Logs** page, select **Audit** from the **Type** filter to view audit entries with execution logs. The dashboard **Activity** views show the last 30 days of changes, from newest to oldest. For a busy resource, an **Activity** view scans only the most recent events and says so. When it does, use the **Logs** page with the **Audit** filter to see the full trail. ## What each entry shows Each audit entry includes the following information: * **Action**: what happened, such as `flow.published` or `record.updated`. * **Actor**: the source of the change. It can be a dashboard user, the dashboard assistant, an API key, the CLI, the SDK, an MCP client, Code Mode MCP, Terraform, another API caller, or Runtype support staff. The UI shows an API key's name when available. A change that the dashboard assistant makes shows as the Assistant on behalf of the person who asked, and the entry's `actor.source` is `dashboard-assistant`. This attribution is for display only and doesn't change permissions. * **Timestamp**: when the change happened. * **Before and after snapshots**: expandable views of the entity before and after the change. Runtype redacts secrets and omits a snapshot larger than 20 KB. * **Details**: extra information about the change, such as counts and affected Record IDs for bulk edits, bulk deletes, and CSV imports. When you publish a Flow or Agent, Runtype creates two entries. One entry contains the published configuration snapshot. The other records the active version change with the previous and new version IDs. ## Query the audit trail with the API Set `category` to `audit` to query audit entries through the Logs API. The following requests list the audit entries for one Flow since a start time: #### cURL ```bash curl "https://api.runtype.com/v1/logs?category=audit&flowId=YOUR_FLOW_ID&from=START_TIME" \ -H "Authorization: Bearer YOUR_API_KEY" ``` #### CLI ```bash runtype logs list --category audit --flow YOUR_FLOW_ID --from START_TIME ``` #### TypeScript ```typescript import { RuntypeClient } from '@runtypelabs/sdk' const client = new RuntypeClient({ apiKey: process.env.RUNTYPE_API_KEY }) const response = await client.logs.list({ category: 'audit', flowId: 'YOUR_FLOW_ID', from: 'START_TIME', }) ``` Replace the placeholders in the requests with these values: * `YOUR_API_KEY`: your Runtype API key. The key needs the `FLOWS:READ`, `AGENTS:READ`, or `ANALYTICS:READ` permission. * `YOUR_FLOW_ID`: the ID of the Flow to query. * `START_TIME`: the start of the time range, as an ISO 8601 timestamp such as `2026-09-01T00:00:00Z`. Without `from`, the query covers only the last 24 hours. Use `to` to set the end of the range. To query other resources, change the filter: * For an Agent, replace `flowId` with `agentId`. In the CLI, replace `--flow` with `--agent`. * For a Record, a secret, a key, or any other resource, pass its ID as `search` (`--search` in the CLI). Each audit entry's message is the action followed by the entity ID, so `search` also matches an action name, such as `secret.deleted` or `api_key.revoked`. From an MCP client connected to the [Runtype MCP server](/developer-guides/integrations/runtype-mcp-server), call the `list_logs` tool with `type` set to `audit`. If your plan doesn't include the audit trail, a request with `category=audit` returns HTTP `402` with the error `Feature Not Available`. ### Read an audit entry Each audit entry has `type` set to `audit`. Its `metadata` object holds the fields that the dashboard shows. The following example shows a trimmed entry: ```json { "id": "req_abc123-2026-09-26T14:02:11.000Z-1", "timestamp": "2026-09-26T14:02:11.000Z", "type": "audit", "title": "flow.updated flow_01jabc", "metadata": { "action": "flow.updated", "entityType": "flow", "entityId": "flow_01jabc", "actor": { "source": "cli", "authMethod": "api_key", "apiKey": { "id": "key_01jxyz", "name": "CI deploy key", "prefix": "rt_live_" } }, "before": { "name": "Lead scoring" }, "after": { "name": "Lead scoring v2" }, "diff": [ { "path": "/name", "op": "replace", "before": "Lead scoring", "after": "Lead scoring v2" } ] } } ``` The `metadata` object contains these fields: * `action`, `entityType`, and `entityId`: what changed. * `actor`: who made the change, including `source` and, for API key callers, the key's ID, name, and prefix. A change from the dashboard assistant has `source` set to `dashboard-assistant`. * `before` and `after`: the snapshots. * `diff`: the changed paths, each with an `op` of `add`, `remove`, or `replace`. * `meta`: the **Details** information, such as bulk counts and affected Record IDs. * `previousVersionId` and `newVersionId`: the version IDs for an active version change. * `droppedForBudget`: the fields that Runtype removed because the entry was too large. ### Page through results A response returns up to 500 entries by default. Set `limit` to return up to 1,000 entries per page, and set `order` to `asc` or `desc`. The response puts the entries in `data.entries`. When `data.pagination.hasMore` is `true`, pass `data.pagination.cursor` as `cursor` to get the next page. Check these response fields when you need a complete trail: * `data.pagination.cursorReset`: when `true`, Runtype couldn't use your cursor and restarted at the first page. Stop paging and start the query again. * `data.degraded`: when `true`, Runtype couldn't read some entries, so entries are missing from the response. Retry the request. ### Find bulk operations for a Record The API has no Record ID filter, so search for the Record ID. A bulk operation's message contains only the first Record's ID, so a search can miss a bulk operation that changed your Record. The Record's **Activity** tab also checks each bulk operation's list of affected Record IDs. For a very large bulk operation, Runtype stores only part of the list. The **Activity** tab says when it can't check an operation against the Record. ## Next steps Continue with these guides: * [What are Logs?](/user-guide/logs/what-are-logs): understand execution logging. * [Working with logs](/user-guide/logs/working-with-logs): search, filter, and export log data. * [Agent versioning and publishing](/user-guide/agents/agent-versioning-and-publishing): understand release aliases, rollbacks, and secret bindings. * [Creating and editing flows](/user-guide/flows/creating-and-editing-flows): find Flow activity in the editor. * [Creating and managing records](/user-guide/records/creating-and-managing-records): find Record activity in the details sheet. * [Query customer logs](/api-reference/runtype-api/logs/query-customer-logs): review every Logs API query parameter.