> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit

> The record of every consequential action — plus forwarding to your SIEM.

Every action that matters is logged. The audit trail is how you know who did what, when, and why — for team review, compliance, and incident response.

## What's audited

* **Publishes and rollbacks** — Flow and pipeline versions.
* **Approvals** — decisions with actor, reason, and target.
* **Access changes** — invites, role changes, member removals, per-Flow access grants.
* **Token events** — issue, revoke, first use.
* **Secret rotations** — connectors, tool headers, trigger secrets. Values never logged.
* **Provider key events** — set, delete.
* **Policy changes** — workspace policy edits.
* **Improvement deploys** — the improvement flow's ships.
* **Data actions** — bulk supersede, deletes.
* **Billing changes** — plan changes, tax edits, overage cap adjustments.

Trace payloads (prompts, tool responses) are not audit entries — they're their own retention system. Audit covers structural / access / config changes.

## The audit view

**Settings → Security → Audit**. Reverse-chronological list:

* **Actor** — name + email (or "workspace token: X" for automation).
* **Action** — publish / rollback / etc.
* **Target** — Flow, block, secret name, member.
* **Details** — action-specific fields (release note, rollback reason, role delta).
* **Source** — UI / CLI / API / webhook.
* **IP / user agent** — where the action originated.
* **Signature** — every entry is signed; tampering is detectable.

Filter by actor, action type, date range.

## Exporting

**Settings → Security → Audit → Export**:

* **CSV** — flat table.
* **JSON** — full detail per entry.
* **PDF** — printable, one entry per row.

Exports are signed with a workspace-level signature so external auditors can verify authenticity.

Bulk export for a specific period:

```bash theme={null}
# CLI (audit export via API)
curl -H "Authorization: Bearer $NORA_TOKEN" \
     "https://api.platform.nora.my/v1/audit?from=2026-07-01&to=2026-07-31" \
     > audit-jul-2026.jsonl
```

## Retention

* **Free** — 30 days.
* **Team** — 1 year.
* **Enterprise** — configurable (up to 7 years or indefinite).

Older entries are archived (still queryable via export) but hidden from the default view.

Configure retention: **Settings → Security → Audit → Retention**. Only Owners.

## Immutability

Audit entries cannot be deleted, edited, or reordered. If an entry is wrong, add a corrective entry — the original stays. This is what makes the audit trail trustworthy.

Even Owners cannot delete audit entries. Enforced at the storage layer.

## SIEM forwarding

For orgs with a security operations center, forward audit events to your SIEM. **Settings → Security → Audit → Forwarding**:

* **Slack / Discord webhook** — notifications on important events (publish, rollback, secret rotation).
* **PagerDuty** — page on rollback or auto-rollback triggers.
* **Splunk / Datadog / SumoLogic** — JSON stream via HTTPS.
* **Generic webhook** — POST every audit event to your endpoint.

Configure filters per destination — e.g. only forward publish and rollback events to Slack, but forward everything to Splunk.

### Webhook payload shape

```json theme={null}
{
  "id": "audit_abc",
  "timestamp": "2026-07-31T09:12:34Z",
  "workspace_id": "acme",
  "actor": {"kind": "user", "id": "u_alice", "email": "alice@acme.com"},
  "action": "flows.publish",
  "target": {"flow": "support-agent", "version": 42},
  "details": {"summary": "refund tightening"},
  "source": "cli",
  "ip": "10.0.0.42",
  "signature": "sha256:..."
}
```

## Verify signatures

Each entry carries a signature. Verify with your workspace's public audit key (**Settings → Security → Audit → Verification key**):

```python theme={null}
import hmac, hashlib
signature = hmac.new(key, canonical_json(entry).encode(), hashlib.sha256).hexdigest()
assert signature == entry['signature']
```

Ensures a leaked-and-tampered audit log fails verification.

## Compliance modes

Turning on **Compliance mode** (per Flow, Settings → Access) tightens audit:

* Every action requires a reason (not optional).
* Audit retention forced to the compliance-required duration.
* Certain destructive actions require multi-sign approval (audit records both signers).
* Data export requires explicit approval workflow.

Compliance mode is a one-way transition per Flow — turning off requires an Owner + written justification.

## Debugging with audit

Common questions the audit view answers:

* "Who published this Flow last?" — filter action=`flows.publish`, target=`<flow>`.
* "Why did we rollback?" — filter action=`flows.rollback`, click the entry for the reason field.
* "When was this secret rotated?" — filter action=`secrets.rotate`.
* "Did anyone touch access on this Flow in the last week?" — filter target=`<flow>`, action prefix=`access.`.

## Related

* [Audit trail (Reliable)](/reliable/versions/audit) — this same audit surface, viewed from the version/deploy angle.
* [Access & policies](/settings/workspace/access) — compliance mode toggle lives here.
* [`nora approvals`](/cli/approvals) — approval decisions are audited.