Audit Logging
CodeStax maintains a comprehensive audit trail of all significant actions in your organization. Audit logs help you track who did what and when for compliance, security investigations, and operational visibility.
What Gets Logged
Every important action generates an audit entry:
| Category | Events |
|---|---|
| Authentication | Login, logout, API key creation, API key revocation |
| Repositories | Connected, disconnected, settings changed |
| Scans | Triggered, completed, failed, cancelled |
| Findings | Triage status changed, ignored, commented |
| Team | Member invited, role changed, member removed |
| Settings | Organization settings updated, webhook configured, policy changed |
| Integrations | Jira linked, OAuth token refreshed, webhook enabled/disabled |
Where to Find It
Navigate to Settings > Audit Log in the dashboard. The audit log is available to ORG_ADMIN and ORG_OWNER roles only.
Filtering and Search
The audit log supports filtering by:
- User — Filter by the user who performed the action.
- Action type — Filter by category (auth, scan, triage, settings, etc.).
- Date range — Narrow results to a specific time window.
- Repository — Show only events related to a specific repository.
Log Entry Details
Each audit log entry includes:
- Timestamp — When the action occurred (UTC).
- User — Who performed the action (name and email).
- Action — What was done (e.g., “scan.triggered”, “finding.triaged”).
- Target — The resource affected (repository name, finding ID, user email).
- Metadata — Additional context such as IP address, scan type, or old/new values for changes.
Export
Export audit logs in CSV or JSON format for integration with external SIEM tools or compliance reporting. Use the Export button at the top of the audit log page or the CLI:
codestax export --type audit --format csv --output audit-log.csvRetention
Audit logs are retained for 90 days on all plans. Enterprise plans can configure extended retention periods through Settings > Data Retention.