Dashboard API
Audit Log
Query immutable compliance audit log entries for your tenant.
GET /dashboard/audit
Returns paginated audit log entries for your tenant, ordered newest-first. Requires the admin role or higher.
GET https://api.liyaengine.ai/dashboard/audit?severity=warning&flagged=true&page=1
Authorization: Bearer <jwt>Query parameters:
| Parameter | Type | Description |
|---|---|---|
severity | string | Filter by severity: info, warning, error |
actorType | string | Filter by actor: user, system, api |
flagged | boolean | true to return only flagged entries |
q | string | Free-text search across action, resource type, resource ID, and user ID |
page | integer | Page number (default: 1, page size: 20) |
Response:
{
"success": true,
"data": {
"entries": [
{
"id": "aud_01HZ...",
"actorType": "user",
"actorId": "dashboard_user_id",
"action": "api_key.rotate",
"resource": "api_key",
"resourceId": "key_01HZ...",
"severity": "warning",
"flagged": false,
"metadata": {},
"createdAt": "2026-03-14T10:00:00Z"
},
{
"id": "aud_02HZ...",
"actorType": "user",
"actorId": "dashboard_user_id",
"action": "account.config_update",
"resource": "account_config",
"resourceId": "acme-corp",
"severity": "info",
"flagged": false,
"metadata": {
"fields": ["featureConfig"]
},
"createdAt": "2026-03-13T18:22:05Z"
}
]
},
"pagination": {
"page": 1,
"limit": 20,
"total": 142,
"totalPages": 8
}
}Audit log fields
| Field | Description |
|---|---|
actorType | Who triggered the event: user (dashboard user), api (API key caller), system (automated process) — in practice every entry recorded today is user |
actorId | ID of the dashboard user or "system" |
action | Dot-separated event name (see table below) |
resource | Resource type affected |
resourceId | ID of the affected resource |
severity | info, warning, or error |
flagged | Reserved for automatic anomaly flagging — always false today; no writer sets it yet |
metadata | Structured context specific to the event type |
Common audit actions
| Action | Severity | Description |
|---|---|---|
api_key.rotate | warning | API key was rotated |
account.update | info | Tenant name or billing email changed |
account.config_update | info | Tenant configuration was updated |
account.byok_key_set | info | A BYOK provider key was saved |
account.byok_key_removed | info | A BYOK provider key was removed |
auth.login | info | Dashboard login |
custom_domain.create | info | A custom domain was created |
custom_domain.delete | warning | A custom domain was soft-deleted |
knowledge.upload | info | A document was uploaded to the knowledge base |
knowledge.delete | info | A knowledge source was deleted |
environment.create | info | A new environment was created |
environment.api_key_rotate | warning | An environment's API key was rotated |
org.member_invited | info | A member was invited to the organization |
org.member_removed | info | A member was removed from the organization |
This is a representative subset — dozens of other actions are recorded (guardrail policies, evaluation suites, workflows, collections, etc.) following the same resource.verb naming.
A nightly retention job purges audit log rows older than 30 days, except entries with severity: "error", which are kept indefinitely. There is currently no dashboard setting to change this window, and audit logs cannot be deleted directly via the API.