Audit Explorer (Read-only)
The Audit Explorer is a read-only view of the platform's audit trail for allow-listed auditors. Two properties define it: every view is itself audited, and sensitive values never leave the audit store.
Access is restricted. This surface is available only to
allow-listed auditors (AUDITOR_USER_IDS). If you don't have access, the
page shows "Auditor access not granted" — and if the tool isn't
released yet, it says "The read-only audit explorer is not available right
now." No API calls are made until you're authorized.
What you see
- Events in window — the total event count for the last 30 days, plus a
per-severity breakdown. The window is capped at 5,000 rows, and the page
says so plainly: "The window is capped at 5,000 rows — counts are partial,
not complete." - Categories — event categories with their counts, as badges.
- Filters — narrow the trail by actor (user ID), action (e.g.
kit_created), resource type (e.g.kit), outcome (Any / Success /
Warning / Critical), and a From / To date range. Apply filters shows
"Loading…" and then the result count. - Events — each row shows the event type and action, the resource type
and id, the acting user id, a severity badge (info / debug / warning /
error / critical), and the timestamp. Fields the store protects render as
Metadata redacted — sensitive values never leave the audit store.
Empty and error states are honest: "No data", "The audit trail could not be
loaded.", "No matching events — Try widening the filters."
Read-only by design
The explorer offers no export, no dispatch, and no edits — it is GET-only,
and events are capped at 50 rows per view. If you need to act on something
you find here, that happens through the normal support tooling
(Admin), where every action is audited in turn.