Audit log
Append-only record of every admin action. Cannot be mutated by admins (D-025). Filter by action, target account, or admin email.
| Timestamp | Admin | Action | Target | Result |
|---|---|---|---|---|
| 2026-05-04 11:30:00 UTC | staff@driftstack.dev | account.tier_changed | acc_00000000-0000-4000-8000-000000000001 | success |
| 2026-05-04 11:15:00 UTC | staff@driftstack.dev | session.destroyed_by_admin | acc_00000000-0000-4000-8000-000000000002 ses_00000000-0000-4000-8000-0000000000c1 | success |
| 2026-05-04 10:45:00 UTC | staff@driftstack.dev | webhook_delivery.requeued | acc_00000000-0000-4000-8000-000000000002 wdl_00000000-0000-4000-8000-0000000000d1 | success |
Retention 90 days hot in Postgres + R2 archive thereafter (ADR-006). The
read endpoint paginates by timestamp DESC; bulk export is not yet
exposed from /v1/admin/audit-log — pull
pages via cursor for now.