Audit Trail

Vulnotes records server-side events such as sign-ins, permission changes, report activity, exports, and retention deletion. Records identify the actor, action, target, time, and outcome.

The audit trail currently has API endpoints but no dedicated page in the application. Use an authenticated internal user session; API keys and MCP cannot access these endpoints.

Read records

View Audit Logs (ro:audit_logs) permits these reads:

Endpoint	Purpose
GET /api/audit-logs	Filtered, paginated records, newest first
GET /api/audit-logs/target/{kind}/{id}	History of one object
GET /api/audit-logs/stats	Counts, current chain head, and recording failures

The list accepts page and limit (up to 200), plus filters including action, category, outcome, actorId, targetKind, targetId, company, from, to, and q.

Verify or export

System administration permission (admin:system) is required for GET /api/audit-logs/verify and GET /api/audit-logs/export?format=json or format=csv.

Verification checks the recorded hash chain for breaks. Exports provide records for review outside Vulnotes. These operations cover the deployment's audit trail and should be handled as sensitive administrative data.

There are no HTTP endpoints to edit or delete audit records. Reading, verifying, and exporting the trail are themselves recorded.