Audit Log

Sairo records a comprehensive audit log of user actions. The audit log is accessible to admins via the UI and API.

Tracked Actions

37 action types are tracked, including:

Category	Actions
Authentication	login, change_password, enable_2fa, disable_2fa, reset_2fa
Users	create_user, delete_user, update_user, set_permissions, remove_permission
Buckets	create_bucket, delete_bucket
Objects	upload, delete, copy, rename, create_folder
Versions	purge_versions, restore_version, delete_version
Config	config_versioning, config_lifecycle, config_cors, config_policy, config_acl, config_object_acl, config_tagging, config_object_tagging, abort_multipart
Sharing	create_share_link, delete_share_link
Tokens & Endpoints	create_token, delete_token, create_endpoint, update_endpoint, delete_endpoint
Licensing	activate_license

Each log entry records:

• Timestamp (UTC)
• Username of the acting user
• Action type
• Bucket (if applicable)
• Details (free-text field with action-specific metadata, may include object keys and other context)

Viewing the Audit Log

Navigate to Admin Panel > Audit Log in the sidebar. The log displays entries in reverse chronological order with color-coded action badges for quick scanning.

The UI auto-refreshes every 30 seconds to show new entries.

Filtering

Use the filter controls at the top of the audit log to narrow results:

• Action type — select one or more action types from the dropdown
• Username — filter to a specific user
• Bucket — filter to actions on a specific bucket

Filters can be combined. For example, filter to delete actions by user jane on bucket backups.

Pagination

Results are paginated with a default limit of 50 entries. The API uses limit and offset parameters. Use the pagination controls at the bottom of the UI to navigate through history.

API Access

The audit log is available via the API for integration with external logging systems:

# Get the latest entries
curl -H "Authorization: Bearer sairo_xxx" \
  "https://your-sairo-instance/api/audit-log"

# Filter by action and username
curl -H "Authorization: Bearer sairo_xxx" \
  "https://your-sairo-instance/api/audit-log?action=delete&username=jane"

# Filter by bucket with pagination
curl -H "Authorization: Bearer sairo_xxx" \
  "https://your-sairo-instance/api/audit-log?bucket=backups&limit=100&offset=100"

The endpoint is admin-only. Viewer tokens receive 403 Forbidden.

Response Format

{
  "entries": [
    {
      "id": 1234,
      "timestamp": "2026-02-28T14:30:00Z",
      "username": "jane",
      "action": "delete",
      "bucket": "backups",
      "details": "old-backup.tar.gz"
    }
  ],
  "total": 5678,
  "limit": 50,
  "offset": 0
}