> ## Documentation Index
> Fetch the complete documentation index at: https://cerebrium.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Cerebrium's documentation MCP server is available at https://cerebrium.ai/docs/mcp for searching and querying these docs directly. Install the Cerebrium agent skill with `npx skills add https://cerebrium.ai/docs`. Append .md to any docs page URL to fetch that page as plain Markdown. API keys and authentication tokens are created in the Cerebrium dashboard at https://dashboard.cerebrium.ai.

# Audit Log

> Review who changed what in a Cerebrium project — app, secret, credential, member, and volume actions, with retention and API access by plan.

The audit log records actions taken against a project: who took the action, what it acted on, when, and whether it succeeded. Use it to answer who deleted an app, who read a secret, and who invited a member.

Inference requests are not audited. They appear in [app logs](/docs/other-topics/request-response-logging) instead.

## Availability

The audit log is included on the Standard and Enterprise plans. Retention sets how far back the log is readable:

| Plan | Retention |
| - | - |
| Hobby | Not included |
| Standard | 7 days |
| Enterprise | 30 days |

## Viewing the Log

Open a project in the [dashboard](https://dashboard.cerebrium.ai/login) and select **Audit Log**. Select a row to expand the full detail of the entry.

Filter by date range, action, or outcome. Only project owners can read the audit log.

## Recorded Actions

| Action | Records |
| - | - |
| `app.create` | An app was created |
| `app.update` | An app's configuration was changed |
| `app.delete` | An app was deleted |
| `build.download` | An app's source was downloaded from a build |
| `build.cancel` | A build was cancelled |
| `container.stop` | A running container was stopped |
| `run.cancel` | An async run was cancelled |
| `secrets.read` | Secret values were retrieved, at project or app level |
| `secrets.update` | Secrets were changed, at project or app level |
| `apikey.create` | An API key was created |
| `apikey.read` | API keys were listed |
| `apikey.delete` | An API key was deleted |
| `serviceaccount.create` | A service account was created |
| `serviceaccount.update` | A service account was changed |
| `serviceaccount.delete` | A service account was deleted |
| `serviceaccount.keys_list` | A service account's tokens were listed |
| `project.member_invite` | A user was invited to the project |
| `project.member_remove` | A user was removed from the project |
| `volume.file_download` | A file was downloaded from a volume |
| `volume.file_delete` | A file was deleted from a volume |
| `volume.resize` | A volume was resized |
| `project.delete` | The project was deleted |

## Entry Contents

Each entry records:

* **Time** — when the action was taken
* **Action** — the action name from the table above
* **Actor** — the user or service account that took the action, with the email address, IP address, and user agent of the request
* **Target** — what was acted on, as a type and ID, such as `app:my-app`
* **Outcome** — `success` or `failure`, with the HTTP status code
* **Details** — action-specific fields, such as the invited email address and role on `project.member_invite`, or the file path and region on `volume.file_delete`

Failed attempts are recorded alongside successful ones.

## Reading the Log Through the API

The log is also available over the REST API, authenticated as a project owner:

```bash theme={null}
curl -X GET "https://rest.cerebrium.ai/v2/projects/{project_id}/audit-log?limit=50" \
  -H "Authorization: Bearer <JWT>"
```

Supported query parameters:

| Parameter | Description |
| - | - |
| `from` | Start of the window, RFC3339. Clamped to the plan's retention window |
| `to` | End of the window, RFC3339. Defaults to now |
| `action` | Return only this action, for example `secrets.read` |
| `actor` | Return only actions taken by this actor ID |
| `outcome` | Return only `success` or `failure` |
| `limit` | Page size, 1–200. Defaults to 50 |
| `nextToken` | Page token from the previous response |

Entries are returned newest first. When `hasMore` is true, pass the response's `nextPageToken` as `nextToken` to fetch the next page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.