Audit and metrics
Read the append-only audit log, pull operational metrics, and tail new sessions live over SSE.
Three read surfaces sit behind the dashboard: what changed in the workspace, how the workspace is performing, and what is happening right now. All three take an admin session token.
Audit log
Every administrative change is written to an append-only log. Sentisec never issues an update or a delete against it — a row, once written, stays as written. Alongside the workspace security events it captures a control-plane trail for mutating API calls: who acted, what they acted on, from which address, and the outcome.
Filter with ?event_type=, ?since= (ISO-8601), and ?limit=
(1–500, default 50). The response envelope names the list events:
{
"workspace_id": "…",
"events": [
{
"id": "…",
"actor_clerk_user_id": "…",
"event_type": "api_key.created",
"event_payload": {},
"created_at": "2026-08-03T14:25:13Z"
}
]
}The event-type catalogue is a closed set, so a filter built against it cannot drift. It covers, in customer terms:
| What happened | Event type |
|---|---|
| An API key was minted or revoked | api_key.created, api_key.revoked |
| Someone joined or left the workspace | workspace.member_added, workspace.member_removed |
| Protection was switched between shadow and enforce | enforcement_mode.changed |
| The egress allowlist was edited | egress_allowlist.updated |
| An alert rule was created, changed, or deleted | alert_rule.created, .updated, .deleted |
| The plan changed | workspace.tier_changed |
| A CLI was paired | sdk_pair |
| An operator revealed stored request content | admin.content_revealed |
That last one matters for privacy reviews: revealing recorded content is itself an audited act, so "who looked at this prompt, and when" has an answer.
Reading the audit log requires workspace access, not the admin role — an auditor can review every change without being able to make one.
Metrics
/v1/org/summary is the one to poll for a fleet dashboard — it answers
"across all our workspaces, what is the state" in a single call rather
than a fan-out.
/metrics/rate-limits returns your plan's limits, this minute's usage,
and limits.refusals: how many requests were refused for each limit
over the last day. Any workspace member can read it. See
Rate limits.
Sessions and evidence
The forensic endpoint takes ?format=json for the record itself, or
?format=verify to get back a verification envelope — signature,
signing key id, and the integrity check — so a third party can confirm a
record has not been altered without trusting the API that served it. Any
other value returns 422.
Live feed
A standard SSE stream. The dashboard's live view is built on it; point your own display at it the same way.
Delivery health
Both answer the same question — "is what I configured actually arriving?" — over a rolling window of recent attempts. Forwarding fails open by design: a collector that is down never costs you a verdict, so these endpoints are how you find out it was down. See Log exports.
Related
- Sessions
- Log exports — forwarding to your SIEM
- Dashboard — the same data, rendered
Administration
Workspaces, API keys, upstream credentials, CLI pairing, and the identity webhook — the endpoints a platform calls on its customers' behalf.
Security
Sentisec's own posture: how credentials are held, what request content is stored and for how long, how evidence is signed, and how to report a vulnerability.