Audit log
Who did what, when, from where.
Settings → Platform → Audit Log records actions taken in AccelerUp.
What is recorded
| Who | User, or the API token's owner |
| What | The action |
| On what | The object |
| When | |
| From where | Client address |
| Outcome | Success or failure |
Recorded by middleware on the API, so it covers the interface and direct API calls identically.
The address is only meaningful if TRUSTED_PROXY_CIDRS is set. Without it,
every entry records your proxy — which makes the audit log useless for exactly
the question it exists to answer.
The actions worth watching
| Action | Why |
|---|---|
| Role changes | Privilege escalation |
| Grant issued or used | Who had production access, and when |
| Freeze override | A deploy during a freeze |
| Channel or routing change | Somebody changed where pages go |
| Silence or maintenance created | Somebody muted something |
| Datasource credential change | |
| API key created or deleted |
Failed actions too
A denied action is recorded. A series of 403s from one account is a signal —
either somebody's permissions are wrong, or something is wrong.
Related audit trails
| Trail | Covers |
|---|---|
| Query audit | Warehouse queries |
| Change feed | Configuration changes, in incident-response terms |
| Deploy ledger | Deployments, tamper-evident |
| Agent audit | Commands and terminal sessions |
| Delivery log | Every notification attempt |
Retention
Audit records follow the organisation's retention policy. Where a compliance regime sets a period, set it explicitly rather than inheriting a default.
Where this behaviour lives: backend/internal/handler/audit_handler.go, frontend/src/app/audit/. If the code and this page disagree, the code is right — please fix the page.
Part of Security — Vulnerabilities, compliance, hardening and enterprise identity.