anoman
Observability

Audit log

An append-only record of every security-relevant change on your account — for SOC 2 evidence, incident review, and SIEM export.

Append-only

A tamper-evident event trail

Anoman keeps an append-only audit log (the audit_events store) of security-relevant mutations. Events are only ever added — never edited or deleted — so the log stands up as SOC 2 evidence.

Each event carries the actor, the action, the target it affected, structured metadata, the source IP, and a timestamp.

What's recorded

Security-relevant mutations

The log captures the changes an auditor cares about, including:

  • API key create and revoke;
  • policy and guardrail-config changes;
  • billing credits and adjustments;
  • member and role changes;
  • pricing updates and MCP tool-policy changes.

Read-only actions and completion traffic are not in the audit log — those live in your request records. The audit log is only for mutations.

Audit API

List and export

Use GET /anoman/v1/audit/events for a cursor-paginated list (filterable by event type) and GET /anoman/v1/audit/events/export to stream the whole log as NDJSON for your SIEM or an evidence packet.

# Cursor-paginated list, filterable by event type
curl "https://api.anoman.io/anoman/v1/audit/events?action=api_key.revoke&limit=50" \
  -H "Authorization: Bearer anm-sk-..."
Related: Guardrail-config changes recorded here are configured on the Guardrails page.

Prove what changed

Open the Audit Log to filter events and export NDJSON evidence.