Audit Log

Asiri writes an append-only audit entry for every consequential action: API-key mints and revocations, subject create/update/delete, request transitions, consent changes, webhook endpoint changes, and admin operations. Entries record the actor (user id or API key id), the route, the request id, the old and new values where applicable, and a UTC timestamp. The log is immutable from the application’s perspective — there is no “edit” or “delete” endpoint — and is exported daily to long-term object storage for the regulator-mandated retention window.

For the full schema, retention semantics, and the integrity-hash chain we use to detect tampering, see the Compliance Ontology architecture decision.