Audit log
An append-only record of every security-relevant change on your account — for SOC 2 evidence, incident review, and SIEM export.
Append-only
A tamper-evident event trail
Anoman keeps an append-only audit log (the audit_events store) of security-relevant mutations. Events are only ever added — never edited or deleted — so the log stands up as SOC 2 evidence.
Each event carries the actor, the action, the target it affected, structured metadata, the source IP, and a timestamp.
What's recorded
Security-relevant mutations
The log captures the changes an auditor cares about, including:
- API key create and revoke;
- policy and guardrail-config changes;
- billing credits and adjustments;
- member and role changes;
- pricing updates and MCP tool-policy changes.
Read-only actions and completion traffic are not in the audit log — those live in your request records. The audit log is only for mutations.
Audit API
List and export
Use GET /anoman/v1/audit/events for a cursor-paginated list (filterable by event type) and GET /anoman/v1/audit/events/export to stream the whole log as NDJSON for your SIEM or an evidence packet.
# Cursor-paginated list, filterable by event type
curl "https://api.anoman.io/anoman/v1/audit/events?action=api_key.revoke&limit=50" \
-H "Authorization: Bearer anm-sk-..."Prove what changed
Open the Audit Log to filter events and export NDJSON evidence.