Security

Trace workspace operations through audit and API access logs. Payload content is never stored or displayed in these views.

Audit

Every workspace action is recorded with time, event type, session id (when applicable), user, application, and actor. Tap a row for full event details, or a session id for live session metadata.

When a plan cap blocks a session operation, the audit log records a throttled entry (at most once per limit type per hour per workspace):

BILLING_SESSION_LIMIT_EXCEEDED — session create rejected because the workspace is at its concurrent active session cap.
BILLING_PAYLOAD_LIMIT_EXCEEDED — payload write rejected because decrypted size exceeds the plan cap.
BILLING_CANCEL_REQUESTED / BILLING_RESUME_REQUESTED — self-service stop renewal or undo cancel (staging payment).
BILLING_GRACE_LOCK_ENTERED — paid period ended without Free downgrade; workspace entered grace_lock (end-user session I/O blocked with HTTP 403 BILLING_GRACE_LOCK).
BILLING_GRACE_WIPE — grace ended without Free downgrade; all active session payloads wiped and plan set to Free.

Billing plan and subscription changes are also audited:

BILLING_PLAN_CHANGED — catalog plan changed (including Downgrade to Free).
BILLING_OVERRIDE_UPDATED — SUPPORT-only limit overrides set or cleared.
BILLING_CANCEL_REQUESTED — customer stopped auto-renewal (POST /workspaces/billing/cancel); plan stays paid until they Downgrade to Free.
BILLING_RESUME_REQUESTED — customer undid a pending cancel (POST /workspaces/billing/resume / Keep my subscription); status returns to active.

Event metadata includes code, planLimit, observedValue, and appId when known — never session payload. Integrators still receive HTTP 429 with BILLING_SESSION_LIMIT or BILLING_PAYLOAD_LIMIT; audit rows help operators correlate rejections with capacity and plan changes.

API access log

Review HTTP API calls against the workspace — useful when debugging integration issues or confirming which client performed an operation. Like the audit trail, entries contain metadata only (method, path, status, duration, user / session identifiers when known) — never payload content.

Typical entries you should see after normal use:

Hosted login — GET /auth/callback (and logout variants), attributed to the workspace named in the callback query.
Session runtime — create / get-or-create / payload get / set / delete / renew / revoke.
Console / Management — workspaces, applications, invites, users, billing (GET/PATCH /workspaces/billing, POST …/checkout, …/cancel, …/resume), and reading this log itself (GET /audit/api-access).

Rows without a resolved workspace id are stored but not listed here — that used to hide some Firebase and hosted-login calls; those are now attributed when workspace_name or a session id is known.

Refresh and export

Use Refresh to load the latest events. Export options depend on your environment; detailed export walkthroughs will be added in a later guide section.