Audit log
ExoHuman keeps an append-only audit log of administrative and security-relevant actions across the instance — for compliance, incident investigation and security monitoring. Events are always recorded; the viewer is the audit module.
What is recorded
Section titled “What is recorded”| Event type | Actions |
|---|---|
agent_lifecycle | create, start, stop, delete, rename, recover |
authentication | sign-in success and failure, sign-out |
authorization | permission granted, permission denied |
configuration | settings changed, quota updated |
credentials | injected, exported, imported |
mcp_operation | every MCP tool call, including refused calls |
git_operation | sync, pull, push |
system | startup, shutdown, migration |
Each entry records the actor (user, agent, MCP client or system), the target (agent, user, schedule…), the source (web, API, MCP, scheduler) and, for MCP calls, which API key acted — its name and scope — beside the accountable owner. Refused MCP calls are marked denied, so you can tell a blocked attempt from a broken one.
Webhook calls, portal-client logouts and blocks, feature-access and team changes are also audited.
The viewer
Section titled “The viewer”Administrators open the Audit page:
- Stats — events, event types and actors in the selected window.
- Time presets — last hour, 24 hours, 7 days, 30 days or all time.
- Filters — event type, actor, target and source; click any cell to filter by it.
- Heatmaps — weekly pattern (day × hour) and a calendar view.
- Verify — checks the SHA-256 hash chain over the visible window.
- Export — CSV or JSON for the current filter.
Tamper evidence
Section titled “Tamper evidence”When the hash chain is enabled, each entry includes a SHA-256 hash over the previous one. Verification proves no entry was altered or removed between two checkpoints.
Retention
Section titled “Retention”Audit entries are kept for 365 days by default; this is also the minimum. Longer retention can be arranged — contact support. Export regularly if you need a permanent archive outside the instance.
Streaming to your SIEM
Section titled “Streaming to your SIEM”With the siem module, administrators configure Settings → Instance → Security event export to forward audit events to:
- an HTTPS webhook (HMAC or bearer authentication);
- Splunk HTTP Event Collector;
- syslog over TCP or TLS.
Add a destination, use Test, then enable it. The forwarder keeps a cursor and retries, so nothing is skipped across restarts.
All endpoints are admin-only.
| Endpoint | Purpose |
|---|---|
GET /api/audit-log | List entries (filters: event_type, actor_type, actor_id, target_type, target_id, source, start_time, end_time, limit, offset) |
GET /api/audit-log/{event_id} | One entry |
GET /api/audit-log/stats | Counts by event and actor type |
GET /api/audit-log/export | CSV or JSON export |
POST /api/audit-log/verify | Verify the hash chain over a range |