Audit Log
Temps records sign-ins, permission changes and configuration changes as structured audit events. Each event says who acted, what they did, when, and from which IP address, and you can filter the log by event type, user and date in the console or the CLI.
Security monitoring
Temps surfaces the following security signals in the dashboard and via the API:
| Signal | Where to find it |
|---|---|
| Failed login attempts | Audit log, event type LOGIN_FAILURE |
| Failed MFA or step-up checks | Audit log, MFA_VERIFICATION_FAILED and STEP_UP_VERIFICATION_FAILED |
| Requests denied by a permission check | Audit log, PERMISSION_DENIED (repeated denials are grouped into one event with an attempt count) |
| TLS certificate expiry | Dashboard notification + email alert (if email provider is configured) |
| WAL health warnings | Service detail page for managed PostgreSQL services |
| OOM-killed containers | Service runtime panel (oom_killed flag) |
For application-level error tracking (crashes, exceptions, performance regressions), see Error Tracking and Monitoring.
Audit log
Each audit event records:
- Who — the user ID and email, or the API key identifier
- What — the event type (for example
PROJECT_DELETED) and the resource affected (project ID, deployment ID, etc.) - When — ISO 8601 timestamp in UTC
- From where — the client IP address (XFF-aware, with spoofing protection — only trusted when the direct TCP peer is loopback)
Events are stored in the Temps database. In the console, open All platform tools → Audit logs (the /audit-logs page). Reading the log requires the instance Admin role.
Not every write is audited. Creating, editing or deleting an environment variable does not produce an event today; revealing a variable's value and promoting it to a secret do.
The audit log in the free edition is searchable, and there is no API to edit or delete entries. A tamper-evident, hash-chained audit log and streaming audit events to an external SIEM are part of Temps Premium.
Retention
Audit events are kept indefinitely, except PERMISSION_DENIED events, which are pruned after 90 days. If storage is a concern, delete old rows on a schedule or use your database's partitioning features.
Audit events reference
Event types are upper-case strings. Use them exactly as written with --operation-type or the console's type filter. These are the most useful ones, grouped by area.
Sign-in and account events
| Event | Trigger |
|---|---|
LOGIN_SUCCESS | Successful sign-in |
LOGIN_FAILURE | Failed sign-in attempt |
USER_LOGOUT | User signed out |
MFA_ENABLED | MFA enabled on an account |
MFA_DISABLED | MFA disabled |
MFA_VERIFIED / MFA_VERIFICATION_FAILED | TOTP code accepted or rejected |
STEP_UP_VERIFICATION_SUCCEEDED / STEP_UP_VERIFICATION_FAILED | Step-up check before a sensitive action |
PASSWORD_CHANGED | In-app password change |
PASSWORD_RESET | Password reset |
CONCURRENT_SESSION_DETECTED | Sign-in while another session for the account is still active (recorded, not blocked) |
PERMISSION_DENIED | Request blocked by a permission check |
Users, roles and API keys
| Event | Trigger |
|---|---|
USER_CREATED / USER_UPDATED / USER_DELETED / USER_RESTORED | Account changes |
ROLE_ASSIGNED / ROLE_REMOVED | Instance role changed |
API_KEY_CREATED | API key created |
API_KEY_ROTATED | API key rotated |
OIDC / SSO events
| Event | Trigger |
|---|---|
OIDC_PROVIDER_CREATED | New SSO provider configured |
OIDC_PROVIDER_UPDATED | Provider settings changed (includes fields_changed list) |
OIDC_PROVIDER_DELETED | Provider removed |
OIDC_ROLE_MAPPING_CREATED | Role mapping added |
OIDC_ROLE_MAPPING_DELETED | Role mapping removed |
Teams and project access
| Event | Trigger |
|---|---|
TEAM_CREATED / TEAM_UPDATED / TEAM_DELETED | Team changes |
TEAM_MEMBER_ADDED | User added to a team |
TEAM_MEMBER_ROLE_UPDATED | Member's team role changed |
TEAM_MEMBER_REMOVED | User removed from a team |
PROJECT_ACCESS_GRANTED / PROJECT_ACCESS_REVOKED | Team granted or removed from a project |
Projects, deployments and environments
| Event | Trigger |
|---|---|
PROJECT_CREATED / PROJECT_DELETED | Project created or deleted |
PROJECT_UPDATED / PROJECT_SETTINGS_UPDATED | Project or project settings changed |
PIPELINE_TRIGGERED | A user started a deployment pipeline for an environment |
DEPLOYMENT_CANCELLED | Deployment cancelled |
DEPLOYMENT_PROMOTED | Deployment promoted to another environment |
DEPLOYMENT_ROLLBACK | Rollback to a previous deployment |
ENVIRONMENT_SETTINGS_UPDATED | Environment settings changed |
ENVIRONMENT_DELETED | Environment deleted |
ENVIRONMENT_VARIABLE_VALUE_REVEALED | A variable's value was revealed |
ENVIRONMENT_VARIABLE_PROMOTED_TO_SECRET | A variable was made a write-only secret |
Platform settings and services
| Event | Trigger |
|---|---|
SETTINGS_UPDATED | Platform settings changed |
EMAIL_PROVIDER_CREATED / EMAIL_PROVIDER_DELETED | Email provider added or removed |
EMAIL_PROVIDER_UPDATED | Email provider edited (logs field names changed, never values) |
BACKUP_SCHEDULE_UPDATED / BACKUP_SCHEDULE_STATUS_CHANGED | Backup schedule edited or its status changed |
BACKUP_RUN / BACKUP_DELETED | Backup run or deleted |
EXTERNAL_SERVICE_CREATED / EXTERNAL_SERVICE_UPDATED / EXTERNAL_SERVICE_DELETED | Managed service changes |
SECRET_UPSERTED / SECRET_DELETED | Agent sandbox secret changed |
Querying the audit log
Dashboard
Open All platform tools → Audit logs. Filter by event type, user, or date range.
Query the audit log
- 1
Open **All platform tools → Audit logs**
- 2
Use the type filter to select the event you want
- 3
Optionally filter by user or date range
CLI
# List recent audit events (filter by operation type) npx @temps-sdk/cli audit list --limit 50 --operation-type LOGIN_FAILURE # Filter by user npx @temps-sdk/cli audit list --user-id 42 --from 2026-01-01T00:00:00Z # Filter by date range npx @temps-sdk/cli audit list --from 2026-01-01T00:00:00Z --to 2026-01-31T23:59:59Z # Show details for a specific event npx @temps-sdk/cli audit show --id <event-id>
Events are returned in reverse chronological order (newest first) with standard pagination. For who can read the log and how roles work, see Authorization. Guide: How to add audit logging to a deployment platform covers the event schema, tamper resistance and retention behind a log like this.