The Audit log is the append-only record of every state change in an organization: who did what, when, and from which request. It covers changes to members, API keys, agents, delegations, tools, policies, approvals, executions and more. Once recorded, an audit event cannot be changed or deleted: K-Block refuses every attempt, whether it comes from a member, an API key or K-Block itself.
Use it to answer questions like "who changed this policy?" or "which request revoked this key?". For the list of event types and what each one records, see Audit events.
Personal account events (sign-in, e-mail, personal keys) are not organization events, and the page says so: they are not listed here. See Events outside the organization log.
Who can see it
Only owners and admins can read the audit log. For other roles, the Audit log item is not in the navigation, and opening the page directly shows "Restricted to owners and admins". The Cloud API enforces the same rule, and management API keys can never read it. See Roles and permissions.
What an entry shows
Events are grouped by day, newest first. The day headings read Today, Yesterday, or the full date, in your browser's time zone.
Each entry shows on one line:
| Part | What it shows |
|---|---|
| Icon | The kind of event. Events that change what agents may do are marked, for example an emergency stop, a denial, a rejection, a failed execution or a started observe window. |
| Title | The event in words, for example "Policy version activated", "API key revoked" or "Approval granted". Other event types are shown as their readable name. |
| Time | The time of day, to the second. |
| Actor | Who did it: the member's name, Gateway, the API key's name, or K-Block Cloud for the system. |
| Target | What it was done to: its kind (Action, Approval, Policy, Agent, Delegation, MCP server, Tool, Webhook endpoint, API key, Member, Invitation, Organization, K-Block identity) and its name, linking to its page when there is one. |
Select the arrow at the end of a line to expand its details:
- Event: the exact event type, for example
api_key.revoked; - When: the full date and time;
- Actor: the actor type, name and e-mail, or key name, and the actor's ID;
- Target: the target type and ID;
- Request: the request ID and the client IP address, when recorded;
- Metadata: the event's recorded details as JSON, for example the key prefix of a revoked API key and, when a key was revoked automatically because its creator lost access, the reason.
Paging, filters and export
The page loads the newest 100 events. Load more events at the bottom loads the next 100.
The dashboard has no filters, search or export for the audit log in this version, and the Cloud API's audit endpoint offers only paging (see Cloud API). To find a specific event, load more events until you reach its date.
The page does not refresh by itself. Reload it to see new events.