Audit Log
The audit log records who did what in a team. Team admins and owners open it from Audit log in the sidebar.
What is recorded
| Area | Actions |
|---|---|
| Servers | Added (with the host, SSH user and host key fingerprint), removed |
| Projects | Created, configuration changed, deployed (from the console, the API or a GitHub push), rolled back, stopped, restarted, cloned, moved, deleted |
| Services | Deployed, restarted, suspended, resumed, a command run in the container |
| Backups | Created, restored, downloaded |
| Team | Created, renamed, deleted, ownership transferred, invitations sent, revoked and accepted, roles changed, members removed |
Your own account's events (sign-ins and failed sign-ins, API keys created and deleted, CLI sign-ins approved, two-factor and passkey changes, email and password changes) are in Account settings → Security.
Each entry has the time, the person, how they acted (a browser session or the API key's name), the IP address, what it acted on and a few details such as names and roles.
What is never recorded
Variable values, passwords, keys, tokens, codes and the commands run in containers (they may contain secrets). A configuration change is recorded as having happened, not what changed.
Retention
Entries cannot be edited or deleted, not even by Zenavo: the database refuses changes to the table. They stay when the user, project, server or team they mention is deleted.
API
GET /api/teams/{tid}/audit returns the newest 100 entries (admins and owners). Use limit (up to 500) and before=<id> to page back. GET /api/account/audit returns your own.
{ "id": 812, "at": 1792368973.2, "action": "server.add", "actor_email": "ana@example.com", "token_name": "",
"target": "srv_…", "ip": "203.0.113.7", "detail": { "name": "web-1", "host": "198.51.100.4" } }