Audit events

Security audit is a detailed analysis of your infrastructure aimed at identifying potential vulnerabilities and unsafe practices.
Code simplifies the auditing process with audit events, which allow you to track a wide range of activities happening in the system.

Purpose and scope

The security event logging mechanism (audit events) is used to:

• Record user and administrator actions related to system configuration changes.
• Register information security incidents.
• Provide the ability to investigate incidents and reconstruct a complete picture of actions in the system.

The scope of application is all levels of the Code platform — from individual projects and groups to instance configuration.
Events are recorded regardless of user role (if they have the right to perform the action) and stored centrally.

Technical capabilities for event logging

The audit system features the following capabilities:

• Centralized event logging: All events are stored in a single audit log.
• Real-time collection: Events are logged instantly at the time of business operation execution. This includes, for example, user login, email change, or enabling force push in a protected branch.
• Integrity protection: The audit log is read-only for administrators. Logged events can’t be deleted or modified.
• Access via UI or API: Events can be viewed and filtered both in the administrator interface and through the dedicated API.

Use cases

Audit events let you track:

• Who and when changed a user’s access level in a Code project.
• Cases of user creation and deletion.
• Traces of suspicious activity — for example, cases of a bulk employee email change or a repository deletion.
• Changes made to CI/CD environment variables.
• Changes to project and group visibility levels.

Audit events help you:

• Assess risks and strengthen security measures.
• Respond promptly to incidents.

Accessing audit events

Accessing via UI

To access audit events, switch to the admin mode and select “Audit events” in the sidebar. This opens the audit event table.

Description of the table columns:

• Author: User who triggered the event.
• Event: System message with event details.
• Object: Related scope of the event (instance, user, group, or project name).
• Target: Entity that was changed (project, user, protected branch, token, or CI variable name, etc.).
• Event time: Date and time when the event occurred.

Accessing via API

Deckhouse Code provides the following API method to retrieve the list of audit events:

POST /api/v4/admin/audit_events/search

The method supports filtering by dates, full-text search, and entity types.

Request parameters

Example request:

curl --request POST "https://example.com/api/v4/admin/audit_events/search" \
     --header "PRIVATE-TOKEN: <ACCESS_TOKEN>" \
     --header "Content-Type: application/json" \
     --data '{
       "created_after": "2025-08-01",
       "created_before": "2025-08-31",
       "q": "repository",
       "sort": "created_desc",
       "entity_types": ["Project"]
     }'

Audit event contents

Each audit event contains a date, time, IP address and user account details, as well as all required information about the scope of changes, object, and what exactly has been changed.

List of audit events

The table below shows example system messages.
Audit events in a production environment contain full information either directly in the message or in an additional JSON field with data.