Skip to main content
Every project has an audit log that records changes to its configuration. Use it to see who toggled a setting, when a change happened, and what changed. Entries are read-only and sensitive values are masked where applicable.

When to use it

  • Investigate why a setting suddenly changed (for example, authentication was disabled, or an allowed domain was removed).
  • Confirm which team member enabled or updated an OAuth provider.
  • Track updates to external database or storage credentials without exposing the credentials themselves.
  • Review recent changes before rolling back a setting.

Access the audit log

  1. Open your project in the urBackend dashboard.
  2. In the project sidebar, click Audit Log.
  3. The Config History page lists changes newest-first, showing the actor’s email, the change label, the category, and the timestamp.

What gets logged

urBackend writes a log entry after any successful configuration mutation on a project. Each entry captures:
  • The project the change applies to.
  • The developer who performed the action, plus their email at the time (kept even if the account is later deleted).
  • A category, such as auth or allowed_domains.
  • A human-readable label describing the change, such as Authentication toggled ON or Allowed domains updated (3 domains).
  • An optional structured diff showing which fields changed.
  • The exact timestamp of the change.

Categories

Filter the log by category to narrow the view to one type of setting.

Sensitive value masking

Secrets never appear in the log. Fields like external database URIs, storage credentials, and third-party API keys are replaced with a mask (••••••••) before the entry is written. The log records that the field changed and who changed it, not the value itself.

Fetch the log programmatically

The audit log is served from the dashboard API and is authenticated with your dashboard session cookie. It is not part of the public API and does not accept pk_live or sk_live keys.
Query parameters Response
Passing a category value that is not in the list above returns 400 Bad Request. Any project member (admin or viewer) can read the log. Entries cannot be edited or deleted from the API or the dashboard.