The audit log is K-Block Cloud's append-only record of changes in your organization: decisions on agent calls, approvals, executions, policy changes, keys, members and settings. K-Block records each event together with the change it describes, so an event exists exactly when the change took effect, and never for a change that did not.
Use it to answer "who did this, and when": who approved a refund, who activated a policy version, which key was revoked, why an endpoint was disabled. This page lists every event type the current code records. To browse the log in the dashboard, see Audit log.
Who can read the audit log
Only owners and admins can read it, and only while signed in:
- In the dashboard, Audit log appears in the navigation for owners and admins. Other roles who open the page see Restricted to owners and admins.
- Through the Cloud API,
GET /api/v1/orgs/<org-id>/auditrequires an owner's or admin's session. Management API keys can never read the audit log, whatever their scopes.
See Roles and permissions for the full role matrix.
What an event contains
| Field | Meaning |
|---|---|
event_type | A dotted name such as approval.approved. |
actor_type | user, api_key, gateway or system (see below). |
actor_id | The user ID, the management API key ID, or for gateway the ID of the gateway API key the agent called with. Empty for most system events. |
target_type, target_id | What changed, for example protected_action and the action's ID. |
metadata | Details of the change (for example the tool, amount, decision and policy version of a call). |
request_id, ip | The request ID (X-Request-Id) and client address, when the change came from a request. |
created_at | When the change was recorded. |
The actor types mean:
| Actor type | Who |
|---|---|
user | A signed-in person, through the dashboard or the Cloud API. |
api_key | A management API key. |
gateway | The Gateway, acting for an agent's call. actor_id is the gateway API key of the call that created the action. |
system | K-Block itself: expiring approval requests and approved actions that ran out of time, ending observe windows at their time limit, closing executions that never finished, closing open actions automatically, Creem, K-Block's billing provider (actor_id creem), a K-Block upgrade that changed a default setting, or K-Block deleting a person's account. |
Metadata never contains secrets: the log refuses to store metadata fields whose names or values look like passwords, tokens, API keys or private keys.
Protected actions and approvals
These events follow an agent's call through its lifecycle. See Actions and Approvals.
| Event | Triggered when | Actor |
|---|---|---|
action.denied | The Gateway denied a call (policy, no delegation, no approvers, invalid amount and similar). | gateway |
action.allowed | The Gateway allowed a call without approval. | gateway |
action.authorized | The Gateway handed the authorization of an allowed or approved decision-only call to the caller. Shown as Authorized for the caller (decision only). K-Block executed nothing. | gateway |
approval.requested | The Gateway held a call for approval and created an approval request. | gateway |
approval.approved | An approver signed an approval. | user |
approval.rejected | An approver signed a rejection. | user |
approval.expired | A pending request expired, or was closed because the action was superseded (metadata reason: SUPERSEDED). | system |
action.expired | An approved action was not executed before its task expired. | system |
action.superseded | An open action was closed because something it was decided on changed: a retried call after a configuration change, a principal replacement, a rollback or emergency stop that closes open actions, Close the remaining open actions, or an approval or execution that could no longer be accepted. | system |
action.cancelled | An owner or admin cancelled a pending or approved action. | user |
execution.started | The Gateway consumed the action's approval (or its allow decision) and began the upstream call. | gateway |
execution.completed | The upstream call succeeded and the result was recorded. | gateway |
execution.failed | The call failed (upstream error, missing or invalid attestation, a Gateway-side failure). The upstream's error text is never stored in the audit log (error_detail_omitted: true); the action's page shows it until the retention period ends. | gateway |
execution.interrupted | K-Block closed an execution that never finished (for example after a Gateway crash), as failed. | system |
execution.not_sent_upstream | The Gateway could not confirm that its consumption of the approval (or allow decision) was recorded, so it did not call the upstream. | gateway |
execution.* events name the gateway API key that created the action. If the agent retried the approved call with another of its keys, the event still names the first key.
A call refused before any decision, for example a call to an unknown or disabled tool, records no event.
Policies
See Policies and Activate, roll out and roll back.
| Event | Triggered when | Actor |
|---|---|---|
policy.created | A policy was created, empty or from a template. | user or api_key |
policy.version_created | A new version was saved: a draft, a template's first version, a restored copy or a derived version. The versions a rollback or an emergency stop create are recorded by policy.activated instead. | user or api_key |
policy.activated | A version became active. Metadata trigger says how: an activation, a promoted shadow version, a rollback or an emergency stop. | user |
policy.rolled_back | An owner or admin rolled the policy back. | user |
policy.emergency_stopped | An owner or admin used Emergency stop…. | user |
policy.shadow_started, policy.shadow_stopped | A shadow version was set or cleared, by hand or as a side effect of an activation. | user or api_key |
policy.examples_updated | The policy's saved test examples changed. | user or api_key |
policy.disclosure_changed | What agents are told about this policy's decisions changed. | user |
policy.simulation_saved | A simulation was saved. | user or api_key |
Agents, observe windows and delegations
| Event | Triggered when | Actor |
|---|---|---|
agent.created | An agent was created. | user or api_key |
agent.updated | An agent's name, description, status or policy changed (including disabling it). | user or api_key |
agent.observe_started | An owner or admin started an observe window for an agent. | user |
agent.observe_ended | A window ended: by hand, at its time limit, by an emergency stop, by disabling the agent or switching its policy, or by a change of the organization's observe settings. | user, api_key or system |
delegation.created | An owner or admin submitted a delegation signed by the organization principal. | user |
delegation.revocation_requested | A revocation was submitted while a call under the delegation was still running. The delegation is withdrawn at once, but the revocation is refused: it must be signed again once the call has finished. | user |
delegation.revoked | The delegation's revocation was recorded. | user |
Tools, MCP servers and keys
| Event | Triggered when | Actor |
|---|---|---|
mcp_server.created, mcp_server.updated, mcp_server.deleted | An MCP server was registered, changed (including its status) or deleted. | user or api_key |
tool.created, tool.updated | A tool was created or changed (including enabling or disabling it). | user or api_key |
tool.authorized | An owner or admin authorized a tool's binding. | user |
api_key.created | A gateway or management API key was created. | user |
api_key.revoked | A key was revoked by hand, or automatically because the member who created it was removed, left or lost the role needed for it (metadata reason). | user (system, see below) |
If K-Block deletes a person's account, it also revokes the API keys that person created and disables the webhook endpoints they created, in every organization, with reason: creator_deleted and the system actor. Accounts cannot be deleted from the dashboard or through the Cloud API.
Webhooks
| Event | Triggered when | Actor |
|---|---|---|
webhook.created | An endpoint was created. | user |
webhook.updated | An endpoint was changed, enabled, disabled or had its secret rotated (metadata rotated), or was disabled because its creator was removed, left or lost the right to manage webhooks (metadata reason). | user (system for reason: creator_deleted) |
webhook.deleted | An endpoint was deleted. | user |
webhook.test_sent | Someone selected Send test event. | user |
webhook.redelivered | A failed delivery was queued again. | user |
Individual delivery attempts are not audit events; they are listed under Deliveries on the endpoint's page. See Webhook delivery.
Organization, members and billing
| Event | Triggered when | Actor |
|---|---|---|
organization.created | The organization was created. | user |
organization.updated | Its name or approval time-to-live changed. | user |
organization.disclosure_changed | The organization's default for what agents are told changed (also recorded once by K-Block itself, with reason: default_changed, when a K-Block upgrade changed the default for organizations that had never set it). | user or system |
organization.observe_settings_changed | The owner changed the observe settings (maximum window length, live opt-in); lists the windows this ended. | user |
organization.principal_set | The owner set or replaced the organization principal. | user |
organization.retention_changed | The owner set or cleared the organization's own, shorter retention period (data_retention_days: from, to). | user |
retention.evidence_deleted | K-Block Cloud deleted the hosted evidence of actions that ended longer ago than the retention period. Shown as Hosted evidence deleted after the retention period. Its metadata has counts only: actions, objects, receipts, retention_days and ended_before. | system |
invitation.created, invitation.accepted | Someone was invited, or accepted an invitation. | user |
invitation.revoked | An invitation was withdrawn, by hand or because the inviter was removed, left or lost the owner or admin role. | user |
member.added | An accepted invitation added a member. | user |
member.role_changed | A member's role changed. | user |
member.removed, member.left | A member was removed, or left. | user |
billing.checkout_started | An owner started a checkout for a paid plan. | user |
billing.portal_opened | An owner opened Creem's customer portal. | user |
billing.checkout_completed | Creem reported a completed checkout, which links the organization to its Creem customer. | system (creem) |
billing.subscription_updated | K-Block applied a subscription event from Creem to the organization, for example a payment, a renewal, a status change or a change of plan. The plan and status can be the same as before. | system (creem) |
Billing events never contain payment details, e-mail addresses or keys. Their metadata:
| Event | Metadata |
|---|---|
billing.checkout_started | plan, checkout_id (Creem's checkout), request_id (K-Block's identifier of the checkout, not the request ID of the event) |
billing.portal_opened | None |
billing.checkout_completed | provider_event_id (Creem's event), checkout_id, request_id, plan |
billing.subscription_updated | provider_event_id, provider_event_type (Creem's event type, for example subscription.paid), subscription_id, status, plan, previous_plan, product_id, product_unknown (true when a subscription in a status that grants a plan has a product that is not one of K-Block's plans, so it grants nothing), and replaced_subscription_id when this subscription replaced another one as the organization's subscription |
Any other Creem event, and any Creem event that K-Block ignores, records no audit event: for example a refund, a payment dispute, an event repeated by Creem, or a subscription event older than one already applied.
Events outside the organization log
Some events belong to a person's account or to K-Block itself, not to an organization. K-Block records them without an organization, so they never appear in any organization's audit log, and no Cloud API route or dashboard page shows them:
- account events:
user.signed_up,user.email_verified,user.email_change_requested,user.email_change_approved,user.email_change_rejected,user.email_change_confirmed,user.email_change_failed,user.email_changed; - sign-in and password events:
auth.signed_in,auth.signed_out,auth.signin_failed,auth.signup_existing_address,auth.password_changed,auth.password_reset_requested,auth.password_reset,auth.email_verification_requested,auth.email_link_password_failed; - personal identities:
identity.bound,identity.revoked; - K-Block itself:
service_identity.registered(a new Gateway identity was registered).
If you need the events of an account, for example for a security investigation, contact K-Block support.
Read the log through the API
GET /api/v1/orgs/<org-id>/audit?limit=100Events come newest first, at most 100 per page (limit from 1 to 100). The response is { "items": [...], "next_cursor": ... }; pass next_cursor as cursor to read older events. There are no filters: the dashboard shows the same list grouped by day, with Load more events.
Retention
Audit events cannot be changed or deleted, and K-Block never purges them. The plan's data retention period applies to the operational data and the hosted evidence of actions, not to audit events (see Data retention). Audit events name actions and receipts by their IDs; once a receipt's hosted copy was deleted, its page shows the record that stays.