Audit log

ModelRig records who changed your organization's governance settings, model pins and keys: who (a user or a key), when, and the values before and after. No secret and no prompt content is ever written to the log.

The audit log is server-side; no SDK change is needed to produce it. The provider policy it records is enforced by modelrig 0.15.0 or newer.

What is recorded

Action	Recorded when	Target	Before / after
`org.settings.update`	Capture posture, telemetry posture, contribution, retention days, managed serving or the provider policy changes	`org`	Only the columns that changed
`route.call_config.write`	A new version of a route's model pin or A/B config is written	`route:<route>`	The previous and new version, mode and config
`step.call_config.write`	A new version of a step's model pin is written	`step:<step>`	The previous and new version, mode and config
`api_key.create` / `api_key.revoke`	An API key is created or revoked	`key:<last four>`	Name, last four, scopes, project, rotated-from; never the key or its hash
`provider_key.create` / `provider_key.rotate` / `provider_key.delete`	A provider key is added, rotated or deleted	`provider_key:<provider>`	Provider and last four only; never the key material

The rows are written by database triggers, so every write path is covered the same way: the console, the server API and MCP tools.

Who. Each row carries an actor_kind:

`actor_kind`	Meaning
`user`	A signed-in user made the change (`actor_user_id`).
`key`	An API key made the change through the server (`actor_key_id`).
`deployment`	ModelRig's own deployment token made the change.
`system`	Neither could be identified.

An audit write never blocks the change it records: if writing the audit row fails, the change still applies and the database logs a warning.

Who can read it

Console: the Security page shows the latest 50 events to owners and admins, with an Export CSV button. Members see "Owners and admins can view the audit log."
API: GET /v1/orgs/:org/audit, with an owner or admin session or a key with the org-settings scope. A member session or an unscoped key gets 403. The org comes from your credential; a path naming a different org returns 404.

Parameter	Meaning
`since`	ISO timestamp, inclusive.
`until`	ISO timestamp, exclusive.
`format`	`json` (default) or `csv`.
`limit`	1–5000, default 1000, newest first.


curl -H "authorization: Bearer $MODELRIG_API_KEY" \
  "https://api.modelrig.ai/v1/orgs/<org>/audit?format=csv&since=2026-10-01T00:00:00Z" \
  -o modelrig-audit.csv

The CSV columns are occurred_at, actor_kind, actor_user_id, actor_key_id, action, target, before, after. Any cell that starts with =, +, -, @, a tab or a carriage return is prefixed with ', so a spreadsheet never evaluates it as a formula.

Retention

Audit rows are not subject to your content retention setting (retention_days). They are kept for the life of the organization; they contain no prompt content. There is no API to edit or remove an audit row.