Audit Log

The audit log exposes selected recorded events from mapped Keva workflows. Coverage is not universal, so use it as supporting evidence for security monitoring and incident investigation rather than as a complete record of workspace activity.

Overview

Keva records selected:

authenticated lifecycle and mutation events on mapped routes
authentication and API events where an emitter exists
system and security events where an emitter exists

The event tables below describe the public event vocabulary. They do not prove that every workflow currently emits every listed event.

Accessing the Audit Log

Open Audit Log from the top-level navigation or go directly to /audit-log. Viewing it requires audit.view permission.

Event Structure

Each audit event includes:

Field	Description
Timestamp	When the event occurred (UTC)
Actor	User or system that performed the action
Action	What was done (e.g., `ticket.created`)
Resource	Type and ID of affected resource
Severity	Event severity (low, medium, high, critical)
IP Address	Source IP of the request
User Agent	Browser/client information
Metadata	Additional context

Event Categories

Ticket Events

Event	Description
`ticket.created`	New ticket created
`ticket.updated`	Ticket properties changed
`ticket.deleted`	Ticket deleted
`ticket.assigned`	Ticket assigned to agent
`ticket.status_changed`	Status updated

Authentication Events

Event	Description
`auth.login_success`	Successful login
`auth.login_failure`	Failed login attempt
`auth.logout`	User logged out
`auth.session_expired`	Session timed out
`auth.mfa_enabled`	MFA activated
`auth.mfa_disabled`	MFA deactivated

Team Events

Event	Description
`team.assignment_mode_changed`	Ticket assignment mode changed
`team.role_changed`	Historical Clerk role-change rows only; mutation is currently suspended

Connector Events

Event	Description
`connector.created`	New connector added
`connector.credentials_accessed`	Credentials retrieved
`connector.credentials_updated`	Credentials changed
`connector.deleted`	Connector removed

Security Events

Event	Description
`security.suspicious_activity`	Anomalous behavior detected
`security.rate_limit_exceeded`	Rate limit triggered
`security.ssrf_blocked`	SSRF attempt blocked
`security.authorization_failed`	Permission denied

API Events

Event	Description
`api_key.created`	New API key generated
`api_key.deleted`	API key revoked
`api_key.used`	API request (sampled)

Filtering the Log

By Date Range

Select a date range to view events:

Last 24 hours
Last 7 days
Last 30 days
Custom range

By Actor

Filter by user:

Specific user email
System actions
API key identifier

By Event Type

Filter by action prefix:

ticket.* - Ticket events
auth.* - Authentication
security.* - Security events

By Severity

Filter by severity level:

Low - Normal operations
Medium - Notable actions
High - Sensitive operations
Critical - Security alerts

Event Severity

Automatic Classification

Events are automatically classified:

Severity	Examples
Low	Ticket viewed, search performed
Medium	Ticket created, settings changed
High	Credentials accessed, bulk operations
Critical	Security events, data exports

High-Risk Events

These events trigger alerts:

connector.credentials_accessed
api_key.created
api_key.deleted
team.member_removed
security.*
Bulk data exports

Exporting Audit Data

Export for Analysis

Apply filters to narrow results
Click Export CSV
Download the CSV file

Exports are logged as audit_logs.exported.

Export for Compliance

Local super-admin source includes Control Deck > SOC 2 Evidence, which can preview a bounded inventory and request a fresh digest-bound export. The configured platform ledger is absent, so report generation and download remain unproven outside local source tests.

Retention Policy

Default Retention

Standard plans: 90 days
Enterprise plans: Customizable

Archival

Archive cursor, signing, and saved-setting resolution have local source proof only. Configured S3 writes, scheduled execution, restoration, retention enforcement, and SOC 2 operating effectiveness remain unproven.

Real-Time Alerting

Slack Integration

High-severity rows are observed events, not proof that an alert was delivered. The current evidence inventory reports only persisted dispatched receipts and explicitly marks incomplete delivery coverage.

Alert Contents

[SECURITY ALERT] connector.credentials_accessed
Tenant: your-workspace
Actor: user@example.com
Resource: platform_connector/abc123
IP: 203.0.113.45
Time: 2026-03-24T10:15:00Z

Permission Requirements

Action	Required Permission
View audit logs	`audit.view`
Export audit data	`audit.export`