Audit log
emma records the actions taken on your infrastructure — who did what, and when — so you can answer "what happened?" long after it did.
Safety & confirmations decides whether a change happens. The audit log is the durable record of what did. Together they answer the two questions every security and compliance review asks: can someone change this without approval, and can we see who did what after the fact.
In a nutshell:
- State-changing actions are recorded — creates, modifications, deletes, and the approvals behind them
- Sensitive reads too — some read actions, such as accessing stored credentials, are recorded on purpose
- Scoped to your company — you only ever see your own tenant's events
- Kept for 365 days by default — operator-tunable
- Admin-only — owners and admins can read the log
What gets recorded
Each entry captures who did what, to which resource, and when:
| Field | What it is |
|---|---|
action | the event, e.g. deploy_repo.success — dotted, so related events share a prefix |
userId | who performed it |
resourceType / resourceId | what it acted on |
details | optional structured context for the event |
ipAddress | where the request came from |
createdAt | when it happened |
Every event also carries the company it belongs to, so the log is always tenant-scoped.
Who can read it
Reading the audit log requires an owner or admin role. It is tenant-isolated by design: the company is always taken from your session, never from a request parameter, so one company can never read another's log.
Reading the log
There is no in-product audit-log screen today; admins read the log through the API:
GET /api/audit-logAll filters are optional and combine:
| Query param | Effect |
|---|---|
action | exact match on a single event |
actionPrefix | every event under a prefix, e.g. deploy_repo. (mutually exclusive with action) |
userId | events by one actor |
resourceType / resourceId | events touching a specific resource |
from / to | a time window (Unix milliseconds, or an ISO date); from is inclusive, to is exclusive |
limit | page size, 1–200 (default 50); a value outside that range is rejected |
cursor | the nextCursor from the previous page |
Events come back newest-first with a nextCursor for paging; when nextCursor is null, you've reached
the end.
Authenticate the same way as any other emma API call — see Bring your own model keys for where credentials live, and your account's API settings for a service token.
Retention
Entries are kept for 365 days by default and pruned on a rolling schedule. Retention is a single global setting an operator can tune; there is no per-tenant retention override in this version.
What's next
- Safety & confirmations — the gate that decides whether a change runs
- The copilot — what proposes the changes you'll see logged
- Infrastructure-as-Prompt — the plan → preview → execute flow each change moves through
Last updated on 25 Aug 2026