Skip to content
EnvoryxEnvoryx

Audit log

“Who changed the PHP version?” - the audit log knows. Under Settings → Audit log Envoryx records sign-ins, every change to a project, backups, database operations, commands run through the API, SSH or a terminal, and settings. Every project also has its own slice of it under History.

The audit log with filters for text, user, category and date, the CSV and JSON Lines export and a list of recent entriesThe audit log with filters for text, user, category and date, the CSV and JSON Lines export and a list of recent entries

Finding entries

Section titled “Finding entries”

You can filter by text (it searches action, user, project, address and details), by user - that includes the account’s API tokens -, by category and by date. Load older entries pages further back, and clicking a user shows only what they did.

Open an entry to see everything it recorded. For a project change that’s the interesting part: each setting with its value before and after, whether it’s the PHP version, the services, the document root, variables or workers. Secret values never show up - you only see that a secret was added or removed.

Every entry also keeps the name of what it’s about, the project, user or token, so it still reads right after that project or account is gone. Entries from before Envoryx 0.20 didn’t store the name; they show it as long as the target still exists.

Who did something is spelled out, too. Changes made with a token appear as user (token: name), things Envoryx did on its own as Envoryx (automatic), and commands of the envoryx admin recovery tool as cli. A secret key replacement is logged as settings.secret_key_rotated with the old and new key IDs, also when it happens at start (ENVORYX_SECRET_KEY_OLD, or the switch from the key file to the variable); such an entry carries atStart in its details.

Export

Section titled “Export”

CSV and JSON Lines export exactly the entries your filters show, so filter first, then export. Through the API it looks like this:

Terminal window
curl -H "Authorization: Bearer stq_…" \
  "https://envoryx.test/api/v1/audit/export?format=csv&action=project.&since=2026-09-01"

GET /api/v1/audit and the export take the same parameters: q, user, action (a prefix, repeatable), project, since, until, after, limit. Cells a spreadsheet would treat as a formula get a ' in front, so opening the CSV can’t run anything.

The command line has the same filters:

Terminal window
envoryx audit --project shop --action backup. --since 2026-10-01
envoryx audit --user stefan --export csv -o audit.csv

Retention

Section titled “Retention”

By default the log is kept forever. Under Retention you can shorten that to anything from 30 days to two years; Envoryx then deletes older entries every hour.