ov audit

Commands

Command	Description
ov audit list	List your audit log entries, newest first

---

ov audit list

ov audit list
ov audit list --app acme --action read --limit 50
ov audit list --status failure --accessor-type agent_token
ov audit list -o json | jq '.[] | select(.error_code != null)'

A read-only wrapper over GET /v1/audit. The endpoint returns entries for the authenticated API key’s user, so there is no user filter.

Flags

Flag	Description
--app <slug>	Filter by app slug
--action <action>	Filter by action: read, create, update, delete, list, intercept, auth
--status <status>	Filter by status: success or failure
--accessor-type <type>	Filter by source: browser_session, cli, machine_key, agent_token
--session <uuid>	Filter to one session ID
--limit <n>	Maximum entries, 1–500 (default 200). Out-of-range values are rejected client-side.
-o, --output table|json	Output format (default table)

Output

The table shows TIMESTAMP, ACTION, STATUS, APP, ACCESSOR, RESOURCE HMAC and ERROR. The RESOURCE HMAC column is a truncated prefix of the server’s resource_id_hmac; the full value is in -o json.

-o json emits the API entries with the same keys the server sent (id, event_type, action, status, resource_id_hmac, hmac_version, details, session_id, accessor_type, accessor_version, accessor_id, accessor_meta, error_code, http_status, created_at, plus ip_address and user_agent when present). Optional fields the server omitted are omitted here too.

Resource references are HMACs

Audit entries reference secrets by resource_id_hmac, a server-side HMAC-SHA256 of the resource ID — not by name or ID (see Security model). The CLI prints that value as an opaque handle and does not look it up against your secret list. Use details.app_slug / details.env_slug and the timestamp to correlate an entry with an operation.