Audit Trail

Overview

The Audit Trail is a tamper-evident, append-only log of every significant action taken within your organization. Every time a member creates a project, invites a colleague, updates a template, or rotates an API token, Ocriva records an entry capturing who performed the action, what was changed, when it happened, and where the request originated.

Audit logs are written automatically — there is nothing to enable or configure. Every organization on Ocriva has a full audit history from the moment the organization is created.

Key benefits:

• Security investigation — trace unauthorized changes back to a specific actor and timestamp
• Compliance evidence — provide auditors with a verifiable record of access and configuration changes
• Team accountability — know exactly who changed what and when, across every project and resource
• Operational debugging — reconstruct the sequence of changes that led to an unexpected state

Tracked Actions

Ocriva tracks 23 actions across 6 entity types. Every action follows the format entity.verb (e.g., project.created, member.removed).

Organization

Member

Project

Template

API Token

Webhook

Audit Log Fields

Each audit log entry contains the following fields:

Viewing Audit Logs

Access the audit trail for your organization through the dashboard:

1. Open the Organization menu from the top navigation bar
2. Select Audit Trail from the sidebar
3. The log table displays entries in reverse-chronological order (newest first)

Each row in the table shows:

• Actor — the email of the member who performed the action
• Action — the event that occurred (e.g., template.updated)
• Entity — the name of the resource that was affected
• IP Address — the origin IP of the request
• Date & Time — when the event was recorded

Click any row to expand it and view the full entry, including the metadata object and the raw userAgent string.

Filtering & Searching

Use the filter controls above the log table to narrow down entries:

Filters can be combined. For example, you can show all template actions performed by a specific actor within the last 30 days.

The default page size is 20 entries per page, up to a maximum of 100 per request.

API Access

Audit logs are available through the REST API for programmatic access, export pipelines, and SIEM integrations.

Endpoints

All endpoints require a valid JWT access token or API token in the Authorization header.

Query Parameters

Example: List Audit Logs

# Retrieve the first page of audit logs for an organization
curl -X GET \
  "https://api.ocriva.com/audit-trail/organizations/ORG_ID?page=1&limit=20" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response:

{
  "logs": [
    {
      "id": "664f1a2b3c4d5e6f7a8b9c0d",
      "organizationId": "663a0b1c2d3e4f5a6b7c8d9e",
      "actorId": "661b2c3d4e5f6a7b8c9d0e1f",
      "actorEmail": "alice@example.com",
      "action": "template.updated",
      "entityType": "template",
      "entityId": "662c3d4e5f6a7b8c9d0e1f2a",
      "entityName": "Invoice Extraction",
      "metadata": {
        "name": "Invoice Extraction",
        "fields": ["invoice_number", "total_amount", "due_date"]
      },
      "ipAddress": "203.0.113.42",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
      "statusCode": 200,
      "createdAt": "2026-04-04T09:15:00.000Z",
      "updatedAt": "2026-04-04T09:15:00.000Z"
    }
  ],
  "total": 142,
  "page": 1,
  "totalPages": 8
}

Example: Filter by Action and Date Range

# Show all API token deletions in March 2026
curl -X GET \
  "https://api.ocriva.com/audit-trail/organizations/ORG_ID?action=api_token.deleted&startDate=2026-03-01T00:00:00Z&endDate=2026-03-31T23:59:59Z" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Example: Fetch a Single Entry

# Retrieve a specific audit log entry by ID
curl -X GET \
  "https://api.ocriva.com/audit-trail/664f1a2b3c4d5e6f7a8b9c0d" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Use Cases

Compliance Auditing

Regulatory frameworks such as PDPA (Thailand), ISO 27001, and SOC 2 require evidence that access to sensitive data and configuration changes is tracked. The Ocriva audit trail provides a ready-made log you can present to auditors:

• Export logs covering the audit period via the API
• Filter by entity type to show all configuration changes (templates, webhooks, API tokens)
• Cross-reference actorEmail with your HR records to confirm changes were made by authorized personnel

Security Investigation

When you suspect unauthorized access or an unexpected change, the audit trail helps you answer the key questions:

• Who made the change — actorEmail and actorId
• What was changed — action, entityName, and metadata
• When it happened — createdAt
• Where the request came from — ipAddress and userAgent

Filter by actorId to see all actions performed by a specific user, or by entityType to see every change to a specific resource category.

Debugging Configuration Issues

If a project stops working after a recent change, search the audit trail for project.updated or template.updated events in the relevant time window. The metadata field stores the sanitized request body, so you can see exactly which fields were changed.

Team Accountability

In organizations with multiple admins, the audit trail provides a neutral record of all administrative actions — member invitations, role changes, project deletions, and API token creation. This removes ambiguity when tracing the origin of a configuration decision.

Best Practices

1. Review API token activity regularly — search for api_token.created and api_token.regenerated events monthly. Tokens created by unknown actors should be treated as compromised and immediately revoked.

2. Set up a SIEM export — use the paginated API to stream audit logs into a security information and event management (SIEM) system such as Datadog, Splunk, or Elastic. Poll on a schedule using startDate and endDate to fetch only new entries.

3. Alert on critical actions — build alerting around high-risk events such as organization.deleted, member.role_updated, and api_token.regenerated. Automated alerts reduce the time between an incident and detection.

4. Cross-reference with IP whitelists — compare ipAddress values in audit logs against your known server IPs. Requests from unexpected IP addresses may indicate a compromised credential.

5. Preserve logs outside the platform — export audit logs to your own storage for long-term retention. Ocriva's built-in log history is designed for operational use; for multi-year compliance archives, maintain your own copy.

6. Verify actor emails — the actorEmail field records the email at the time of the action. If a member changes their email, historical logs still reflect the email used when the action was performed. Always correlate actorId for identity continuity.