Keep track of everything happening in AxiomDB—from network tweaks and credential rotations to team changes and more.

Audit Log

Ever wonder who changed what and when? AxiomDB keeps a close eye on all security-sensitive events by writing them to an immutable audit log. Think of it as a diary for your project's security. It gives you full visibility for compliance, troubleshooting, and keeping things running smoothly. Best of all, these audit records actually outlive the resources they describe. Even if a branch or project gets deleted, its audit log stays safe and sound.

Event Catalog

Project Events

Event	Description	Actor
`project.created`	A brand new project was created	Owner
`project.deleted`	A project was permanently deleted (no going back!)	Owner
`project.settings.updated`	Project settings were updated	Owner/Admin

Branch Events

Event	Description	Actor
`branch.created`	A brand new branch was created	Admin/Developer
`branch.deleted`	A branch was deleted	Admin
`branch.credentials.viewed`	Someone looked at the connection credentials	Developer+
`branch.credentials.rotated`	Credentials were rotated	Admin
`branch.restored`	A branch was restored from a backup	Admin

Network Events

Event	Description	Actor
`network.rule.created`	A new CIDR rule was added	Admin
`network.rule.deleted`	A CIDR rule was removed	Admin
`network.policy.changed`	The security mode was changed	Owner

Backup Events

Event	Description	Actor
`backup.snapshot.created`	A backup snapshot was created	System
`backup.restore.started`	A restore operation started	Admin

Team Events

Event	Description	Actor
`team.invitation.created`	An invitation was sent to a new member	Admin
`team.member.removed`	A member was removed from the project	Admin/Owner
`team.member.role_changed`	A member's role was updated	Admin/Owner

Event Schema

No matter what kind of event is logged, they all follow a predictable and easy-to-read schema. Here is an example of what an event looks like:

{
  "id": "evt_7xK2mP9nQ3w8",
  "event": "branch.credentials.rotated",
  "timestamp": "2026-01-15T10:30:00Z",
  "actor": {
    "id": "usr_8xK2mP",
    "email": "alice@example.com",
    "role": "admin",
    "ip_address": "203.0.113.42",
    "user_agent": "axiom-cli/1.4.0"
  },
  "resource": {
    "type": "branch",
    "project_id": "prj_abc123",
    "project_name": "my-project",
    "branch_id": "br_main",
    "branch_name": "main"
  },
  "details": {
    "target": "both",
    "rotation_id": "rot_9xK2mP3n",
    "previous_rotation": "2025-10-15T10:30:00Z",
    "trigger": "manual"
  },
  "metadata": {
    "request_id": "req_4nR8wP2x",
    "session_id": "ses_3mZ7kF9x",
    "api_token_id": "ptk_xxxxxxxxxxxx"
  }
}

Field reference

Field	Type	Description
`id`	string	A unique ID for the event. This is globally unique and can't be changed.
`event`	string	The type of event (from the catalog above).
`timestamp`	ISO 8601	When the event happened, in UTC (ISO 8601 format).
`actor`	object	The user or system that took the action.
`actor.id`	string	The user's ID, or `system` if it was automated.
`actor.email`	string	The actor's email address (if it was a human).
`actor.role`	string	Their role when they performed the action.
`actor.ip_address`	string	The IP address the action came from.
`actor.user_agent`	string	The app or tool they used (CLI, API, or dashboard).
`resource`	object	The specific resource that was affected.
`resource.type`	string	The type of resource, like a project, branch, network rule, or team member.
`resource.project_id`	string	The project's ID.
`resource.branch_id`	string	The branch's ID (if it applies to a branch).
`details`	object	Extra details specific to this event type.
`metadata`	object	Request metadata to help you tie things together.

Querying the Audit Log

Need to find something in your logs? You have a few ways to query them.

Via Dashboard

If you prefer a visual interface, you can search logs directly in the dashboard:

Head over to Project Settings → Audit Log.
Use the filters to narrow things down by event type, who did it, a date range, or a specific resource.
Click on any event to expand it and see the full details.

Via CLI

If you live in the terminal, you can use the CLI to search your logs:

# List recent events
axiom audit list --project my-project

# Filter by event type
axiom audit list --project my-project --event branch.credentials.rotated

# Filter by actor
axiom audit list --project my-project --actor usr_8xK2mP

# Filter by date range
axiom audit list --project my-project --since "2026-01-01" --until "2026-01-31"

# Filter by resource
axiom audit list --project my-project --branch br_main

# Combine filters
axiom audit list \
  --project my-project \
  --event network.policy.changed \
  --since "2025-06-01" \
  --format json

Via API

You can also fetch audit events programmatically using our API:

curl -G "https://api.axiom.cloud/v1/projects/prj_abc123/audit" \
  -H "Authorization: Bearer ptk_xxxxxxxxxxxx" \
  --data-urlencode "event=branch.credentials.rotated" \
  --data-urlencode "since=2026-01-01T00:00:00Z" \
  --data-urlencode "limit=50" \
  --data-urlencode "cursor=evt_previous_last_id"

Response:

{
  "events": [
    {
      "id": "evt_7xK2mP9nQ3w8",
      "event": "branch.credentials.rotated",
      "timestamp": "2026-01-15T10:30:00Z",
      "actor": {
        "id": "usr_8xK2mP",
        "email": "alice@example.com",
        "role": "admin"
      },
      "resource": {
        "type": "branch",
        "project_id": "prj_abc123",
        "branch_id": "br_main",
        "branch_name": "main"
      },
      "details": {
        "target": "both",
        "rotation_id": "rot_9xK2mP3n"
      }
    }
  ],
  "pagination": {
    "cursor": "evt_7xK2mP9nQ3w8",
    "has_more": true,
    "total": 1247
  }
}

Audit Event Details

Here is what you can expect the detail payload to look like for various events.

`project.created`

This event fires whenever a new project is created.

{
  "event": "project.created",
  "details": {
    "project_name": "my-project",
    "region": "us-east-1",
    "postgres_version": "16.1",
    "initial_mode": "restricted"
  }
}

`project.deleted`

This event is logged when a project is permanently deleted. Remember, there's no undoing this action!

{
  "event": "project.deleted",
  "details": {
    "project_name": "my-project",
    "confirmation_typed": true,
    "branches_deleted": 3,
    "backups_deleted": 12,
    "team_members_removed": 5
  }
}

`branch.credentials.viewed`

This shows up when someone views connection credentials.

{
  "event": "branch.credentials.viewed",
  "details": {
    "target": "runtime",
    "credential_type": "url",
    "masked_url": "postgresql://axiom_pooler:****@pooler.axiom.cloud:6432/mydb"
  }
}

`branch.credentials.rotated`

This is recorded whenever credentials are rotated.

{
  "event": "branch.credentials.rotated",
  "details": {
    "target": "both",
    "rotation_id": "rot_9xK2mP3n",
    "previous_rotation": "2025-10-15T10:30:00Z",
    "trigger": "manual",
    "password_length": 32,
    "password_entropy_bits": 192
  }
}

`network.policy.changed`

This fires when you change your project's security mode.

{
  "event": "network.policy.changed",
  "details": {
    "previous_mode": "restricted",
    "new_mode": "public_runtime",
    "confirmation_typed": false,
    "requires_confirmation": false
  }
}

`network.rule.created`

This is logged when a new CIDR rule is added to your network policy.

{
  "event": "network.rule.created",
  "details": {
    "rule_id": "rule_2kF9x3mZ",
    "label": "Office VPN",
    "cidr": "203.0.113.0/24",
    "ports": "both",
    "scope": "project",
    "expires_at": "2026-06-01T00:00:00Z"
  }
}

`network.rule.deleted`

This is logged when a CIDR rule is deleted.

{
  "event": "network.rule.deleted",
  "details": {
    "rule_id": "rule_7pQ4nR8w",
    "label": "CI Runner",
    "cidr": "198.51.100.0/24",
    "reason": "manual",
    "expired": false
  }
}

`backup.snapshot.created`

This is recorded when a new backup snapshot is automatically created by the system.

{
  "event": "backup.snapshot.created",
  "details": {
    "snapshot_id": "snap_3mZ7kF9x",
    "branch_id": "br_main",
    "size_bytes": 1073741824,
    "type": "automatic",
    "retention_days": 30
  }
}

`backup.restore.started`

This indicates that a database restore has started.

{
  "event": "backup.restore.started",
  "details": {
    "restore_id": "rst_4nR8wP2x",
    "source_snapshot": "snap_3mZ7kF9x",
    "target_branch": "br_main",
    "point_in_time": "2026-01-14T23:59:00Z",
    "estimated_duration_seconds": 120
  }
}

`team.invitation.created`

This fires when you invite someone new to your team.

{
  "event": "team.invitation.created",
  "details": {
    "invitation_id": "inv_7xK2mP9n",
    "email": "bob@example.com",
    "role": "developer",
    "expires_at": "2026-01-22T10:30:00Z"
  }
}

`team.member.role_changed`

This is recorded when a team member is assigned a new role.

{
  "event": "team.member.role_changed",
  "details": {
    "member_id": "usr_bob456",
    "member_email": "bob@example.com",
    "previous_role": "developer",
    "new_role": "admin"
  }
}

Retention Policy

Here is a quick look at our retention policies:

Policy	Duration
Default retention	2 years
Extended retention	7 years (just ask us!)
Minimum retention	1 year
Branch deletion	Events persist
Project deletion	Events persist

Events outlive resources

Audit events are stored separately from the actual resources they describe. This means that deleting a branch won't wipe out its history. We do this to make sure you stay compliant even after cleaning up old resources!

Exporting Audit Data

If you need to move your audit logs into another tool or archive them, you can export them easily.

CSV export

Run this command to get a CSV file:

axiom audit export \
  --project my-project \
  --format csv \
  --since "2026-01-01" \
  --until "2026-01-31" \
  --output audit-january.csv

JSON export

If you prefer JSON format, you can run this:

axiom audit export \
  --project my-project \
  --format json \
  --since "2026-01-01" \
  --until "2026-01-31" \
  --output audit-january.json

Streaming to external systems

If you want to pipe your logs directly into another tool or SIEM in real-time, you can stream them like this:

# Stream to stdout for piping to external systems
axiom audit stream \
  --project my-project \
  --event branch.credentials.rotated,network.policy.changed \
  --format jsonl | \
  jq -c '.event' | \
  # Send to your SIEM

Integration with SIEM

AxiomDB makes it easy to send audit events to your favorite Security Information and Event Management (SIEM) systems.

Webhook delivery

Webhooks let you deliver events in real-time. Here is an example webhook configuration payload:

{
  "webhook": {
    "url": "https://siem.example.com/api/events",
    "events": ["*"],
    "format": "json",
    "headers": {
      "Authorization": "Bearer siem_token_xxxxx",
      "X-Source": "axiomdb"
    },
    "retry": {
      "max_attempts": 3,
      "backoff_seconds": [10, 60, 300]
    }
  }
}

Setting up a webhook

You can set up a new webhook using the CLI:

axiom audit webhook create \
  --project my-project \
  --url "https://siem.example.com/api/events" \
  --events "*" \
  --header "Authorization: Bearer siem_token_xxxxx"

Alerting

Don't wait to check the logs manually! You can set up alerts to ping you immediately when important events happen.

Here is a configuration sample showing how you might set up alerts for different channels:

{
  "alerts": [
    {
      "name": "Public mode enabled",
      "event": "network.policy.changed",
      "condition": "details.new_mode == 'public_all'",
      "channels": ["email", "slack"],
      "recipients": ["security@example.com"]
    },
    {
      "name": "Credential rotation",
      "event": "branch.credentials.rotated",
      "channels": ["slack"],
      "recipients": ["#ops-alerts"]
    },
    {
      "name": "Project deleted",
      "event": "project.deleted",
      "channels": ["email", "slack", "pagerduty"],
      "recipients": ["security@example.com", "#ops-alerts"]
    }
  ]
}

Creating an alert via CLI

You can also create an alert directly from your terminal:

axiom audit alert create \
  --project my-project \
  --name "Public mode enabled" \
  --event "network.policy.changed" \
  --condition "details.new_mode == 'public_all'" \
  --channel email \
  --recipient "security@example.com"

Compliance

Our audit logging is built to help you check all the right boxes for common compliance standards:

Framework	Relevant Controls
SOC 2 Type II	CC6.1 (Logical access), CC7.2 (Monitoring), CC8.1 (Change management)
HIPAA	§164.312(b) (Audit controls), §164.308(a)(1)(ii)(D) (Information system activity review)
GDPR	Article 30 (Records of processing activities), Article 5(2) (Accountability)
PCI DSS	Requirement 10 (Track and monitor all access)
ISO 27001	A.12.4.1 (Event logging), A.12.4.3 (Protection of log information)

Best Practices

Keep an eye on things. Make it a habit to check your audit logs weekly or monthly.
Automate alerts. Set up notifications for high-priority events so you can react immediately.
Archive your exports. Keep audit exports stored safely next to your compliance documents.
Tie everything together. Stream logs to your SIEM to correlate database events with other system logs.
Watch for unusual patterns. Look out for things like credential rotations from unfamiliar IPs, sudden switches to public access, or unexpected bulk deletions.
Keep it secure. Only give audit:read access to team members who absolutely need to see the logs.

Troubleshooting

Missing events

Why it happens: The event might just be filtered out by your current query settings.

How to fix it: Try removing your filters and search using a wider timestamp or actor range:

axiom audit list --project my-project --since "2026-01-15T10:00:00Z" --until "2026-01-15T11:00:00Z"

Webhook delivery failures

You can check the status of your webhook using the CLI:

axiom audit webhook status --project my-project

WEBHOOK                STATUS    LAST DELIVERY        FAILURES
https://siem...        active    2026-01-15T10:30Z    0

How to fix it: Double-check that your webhook endpoint is online, reachable, and returns a successful 2xx status code.

Export timeout

Why it happens: Trying to pull down logs for a massive date range can sometimes cause a timeout.

How to fix it: Try exporting your data in smaller, bite-sized chunks:

axiom audit export --project my-project --since "2026-01-01" --until "2026-01-15" --output part1.json
axiom audit export --project my-project --since "2026-01-16" --until "2026-01-31" --output part2.json

Audit Log

Teams & Roles

Network Policy

Credential Rotation

CORS & Data API

On this page