Audit log
The record of actions in your org — who did what, and when.
The audit log records account and sandbox management actions in your org. Each event stores the actor, the action, the target, and the time. Read it in the dashboard Audit tab or over REST.
Query the log
Only org owners and admins can read the log. Other members get 403.
The SDKs have no typed wrapper for audit. Use the generic request method.
const events = await client.request(
"GET",
"/v1/audit?action=sandbox.&status=denied&limit=100",
);events = client.request(
"GET",
"/v1/audit?action=sandbox.&status=denied&limit=100",
)pt api /v1/audit --query "action=sandbox." --query "status=denied" --query "limit=100"curl -s "$PT_API_URL/v1/audit?action=sandbox.&status=denied&limit=100" \
-H "Authorization: Bearer $PT_TOKEN"Filters
| Param | Meaning |
|---|---|
q | Substring match on action or resource id |
action | Action prefix match (sandbox., org.member) |
actor | Exact actorUserId |
status | ok | denied | error |
since / until | Timestamp bounds (ISO-8601) |
limit / offset | Pagination — limit 1–200, default 50 |
Event fields
| Field | Meaning |
|---|---|
action | Dot-namespaced event name (prefix-filterable) |
resourceType / resourceId | The target (sandbox, org, apikey, …) |
actorUserId / actorEmail / actorName | The actor (null for non-user actors) |
actorType | user | api_key | admin_token | system |
status | ok | denied | error |
source | web | sdk | cli (null when unknown) |
apiKeyId | The API key that authenticated the request, if any |
ip | Client IP |
metadata | Action-specific detail (JSON) |
createdAt | Event time |
Some system rows have null actorType / status / source. The status=ok filter still matches them.
Recorded events
The log covers account and sandbox management. It records code execution as an event. It does not record file operations or network traffic inside a sandbox.
| Prefix | Events |
|---|---|
auth.* | sign_up, sign_in, sign_in_failed, sign_out, password_changed, session_revoked, admin_token_used |
org.* | create, delete, member_invited, invite_accepted, invite_revoked, member_removed, member_role_updated, gpu_enabled_set, internal_set |
apikey.* | created, revoked |
sandbox.* | create, exec, run_code, rename, stop, start, pause, resume, snapshot, restore, clone, fork, archive, backup, restore_from_backup, resize, expose, unexpose, revoke_token, egress_policy, delete |
snapshot.* | delete |
volume.* | create, attach, detach, delete |
app.* | create, update, delete, deploy, rollback, stop, start, restart |
git_connection.* | create, delete |
user.* | account_deleted |
billing.* | credits_exhausted_stop — the platform stopped a sandbox on exhausted credits |
admin.* | Platform-staff actions on your org. Actions by an admin who impersonates a member land here, tagged metadata.impersonated_by. |
unaudited_mutation | Any other mutating call (for example, template or webhook changes), with its method, path, and status |
Retention
Each org keeps its most recent 10,000 rows for up to 90 days. The platform removes older or excess rows automatically.
Logs inside a sandbox
The audit log does not stream process output. Capture stdout / stderr with exec. Watch file changes with the filesystem watch API. Receive lifecycle events with webhooks. Or attach an interactive terminal.