Overview

Audit logs are available under Infisical’s Pro, Advanced, and Enterprise plans, with retention that varies by plan.If you’re self-hosting Infisical, contact [email protected] to purchase an Enterprise license.

Infisical records every action performed in your organization as a structured event, so security and compliance teams can investigate incidents, prove access boundaries to auditors, and answer questions about who did what.

View audit logs

Anyone with the Read permission on Audit Logs has access to view audit logs. For more information, check out Role-based access controls.

For an organization

To view all events in an organization across every product:

Infisical UI
API

From your organization’s home page, go to Audit Logs.

Narrow down the results with filters.

Call the endpoint without a projectId to get events across the whole organization.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "limit=100"

See the audit log export API reference for the full parameter list.

For a product

To view all events scoped to a single product:

Infisical UI
API

Open the product from the organization sidebar.

For Secrets Management, Certificate Manager, KMS, and Secret Scanning, select the project you want to audit.

For Privileged Access Manager and Agent Vault, skip this step.

Select Audit Logs in the product’s sidebar.

Narrow down the results with filters.

Pass a projectId to scope the response to one project’s events.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "limit=100"

See the audit log export API reference for the full parameter list.

Privileged Access Manager and Agent Vault use a single project that Infisical manages internally. There’s no public API for looking up that project’s ID.Instead, call the organization endpoint (see For an organization) and filter eventType to Privileged Access Manager and Agent Vault event types, (e.g., eventType=pam-session-start,pam-session-end).

Log structure

Each log contains the following fields:

string

The log entry’s UUID.

string

The source IP address of the request.

string

The raw User-Agent header of the client.

string

The client category: web, cli, k8-operator, terraform, InfisicalPythonSDK, InfisicalNodeSDK, or other.

string

When Infisical will delete the log entry, based on your plan’s retention.

string

When the action occurred, in ISO 8601 format.

string

Always equals createdAt. Audit log entries are append-only.

string

The organization the action occurred in.

string

The project the action affected. Empty for organization-level events.

string

The name of the project at the time of the action. Empty for organization-level events.

object

The action that occurred.

Show properties

string

The event type (for example, create-secret). See Event types for the full catalog.

object

Context specific to the event. The shape depends on event.type; a get-secret event carries environment, secretPath, secretKey, and secretVersion, while a batch event like create-secrets carries a secrets array.

object

Who performed the action.

Show properties

string

The actor category: commonly user, identity, or platform. Machine and system actors add more categories, for example kmipClient, scimClient, and gateway.

object

Identifying information for the actor. The shape depends on actor.type.

Show user actor

string

The user’s ID.

string

The user’s email.

string

The user’s username.

object

The user’s effective permissions at the time of the action.

Show identity actor

string

The machine identity’s ID.

object

The identity’s effective permissions at the time of the action.

Example payload

{
   "id": "[UUID]",
   "ipAddress": "[IP_ADDRESS]",
   "userAgent": "[USER_AGENT_STRING]",
   "userAgentType": "web",
   "expiresAt": "[TIMESTAMP]",
   "createdAt": "[TIMESTAMP]",
   "updatedAt": "[TIMESTAMP]",
   "orgId": "[ORGANIZATION_UUID]",
   "projectId": "[PROJECT_UUID]",
   "projectName": "[PROJECT_NAME]",
   "event": {
       "type": "get-secret",
       "metadata": {
           "environment": "prod",
           "secretPath": "/db",
           "secretId": "[SECRET_UUID]",
           "secretKey": "DATABASE_URL",
           "secretVersion": 3
       }
   },
   "actor": {
       "type": "user",
       "metadata": {
           "email": "[EMAIL]",
           "userId": "[USER_UUID]",
           "username": "[USERNAME]",
           "permission": {
               "metadata": {},
               "auth": {}
           }
       }
   }
}

Filtering audit logs

You can filter audit logs to find events more easily. When you set more than one filter, an event needs to match all of them to appear in the results.

Every filter is an exact match, so wildcards like * aren’t supported.

By date

Infisical UI
API

Use the date range buttons at the top of the audit logs page. The page defaults to the last hour on load. Presets include 1 day, 1 week, 1 month, and 3 months, and the custom picker takes any range up to 3 months.

Pass startDate and endDate as ISO 8601 timestamps, up to 3 months apart. If you omit startDate, the endpoint defaults to the previous day at 00:00 UTC; if you omit endDate, it defaults to now.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "startDate=2026-01-01T00:00:00Z" \
  --data-urlencode "endDate=2026-01-31T23:59:59Z"

Advanced filters

Infisical UI
API

Select Search audit logs from the audit logs menu and choose the filter you want to add:

Filter	Matches	Requires
`event`	One or more event types (for example, `create-secret`, `update-secret`)
`actor`	The actor type (for example, `user`, `identity`, `platform`, `kmipClient`, `scimClient`, and so on)
`actor_id`	A specific actor ID	`actor` set to a type that carries an ID (see below)
`source`	The client that made the request: `web`, `cli`, `k8-operator`, `terraform`, an SDK, or `other`
`project`	A single project
`environment`	An environment slug in that project (for example, `prod`)	`project`; applies to secret events only
`secret_path`	The folder path a secret event touched (for example, `/db`)	`project`; applies to secret events only
`secret_key`	The exact key name a secret event touched (for example, `DATABASE_URL`)	`project`; applies to secret events only

Pass filters as query parameters to GET /api/v1/organization/audit-logs:

Parameter	Matches	Requires
`eventType`	One or more event types, comma-separated (for example, `create-secret,update-secret`)
`actorType`	The actor type (for example, `user`, `identity`, `platform`, `kmipClient`, `scimClient`)
`actor`	A specific actor ID	`actorType` set to a type that carries an ID (see below)
`userAgentType`	The client that made the request: `web`, `cli`, `k8-operator`, `terraform`, an SDK, or `other`
`projectId`	A single project
`environment`	An environment slug in that project (for example, `prod`)	`projectId`; applies to secret events only
`secretPath`	The folder path a secret event touched (for example, `/db`)	`projectId`; applies to secret events only
`secretKey`	The exact key name a secret event touched (for example, `DATABASE_URL`)	`projectId`; applies to secret events only
`eventMetadata`	A key/value pair inside `event.metadata`. See Filtering by event metadata.

Actor ID filtering is only supported for actor types that carry an ID: user, identity, service, kmipClient, kmipServer, gateway, relay, agentVaultProxy, acmeProfile, acmeAccount, estAccount, and scepAccount.platform, scimClient, and unknownUser don’t have an ID field and can only be filtered by type.

Special characters

Every filter compares the raw string value as-is, so filter values that contain $, ., /, @, or any other special character work without escaping. For example, to filter for a secret key named $DB/PROD.URL:

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=get-secret" \
  --data-urlencode "secretKey=\$DB/PROD.URL"

In the above example, \$ is only there to stop the shell from expanding $DB as a variable. The filter itself takes $DB/PROD.URL as-is.

Filtering by event metadata

The API accepts an eventMetadata query parameter that matches key/value pairs inside event.metadata. Pass it as key1=value1,key2=value2. Every pair has to match on the same event. Use it for queries the built-in filters can’t express, like every login for a specific identity, or every secret sync run for a specific destination:

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=login-identity-universal-auth" \
  --data-urlencode "eventMetadata=identityId=<identity-id>"

Values that contain a literal , can’t be filtered this way, because , separates the pairs. Values with = work: only the first = in each pair is treated as the separator, so the rest of the string passes through.

Common filters

Here are a few common patterns for filtering audit logs, grouped by product.

Secrets Manager

Who read a specific secret

Find every read of DATABASE_URL in the prod environment.

Infisical UI
API

Go to Organization > Audit Logs.

Select Search audit logs and add these filters:

event: get-secret
project: the project holding the secret
environment: prod
secret_key: DATABASE_URL

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "environment=prod" \
  --data-urlencode "eventType=get-secret" \
  --data-urlencode "secretKey=DATABASE_URL"

Who opened a folder

Find every time someone loaded the secrets in the /db folder — for example, by opening it in the web UI, running infisical secrets, or having an app fetch it at startup. Each event records the folder, the actor, and how many secrets came back.

Infisical UI
API

Go to Organization > Audit Logs.

Select Search audit logs and add these filters:

event: get-secrets
project: the project holding the folder
environment: prod
secret_path: /db

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "environment=prod" \
  --data-urlencode "eventType=get-secrets" \
  --data-urlencode "secretPath=/db"

All writes to production

Find every creation, update, and deletion of secrets in a project’s prod environment over the last 7 days.

Infisical UI
API

Go to Organization > Audit Logs.

Set the date range to the last 7 days.

Select Search audit logs and add these filters:

event: create-secret, update-secret, delete-secret, create-secrets, update-secrets, delete-secrets
project: the project you want to audit
environment: prod

Include the batch event types (create-secrets, update-secrets, delete-secrets) so that bulk changes from the CLI or SDKs aren’t missed. The environment filter only applies when a project is set.

Replace <start-date> with an ISO 8601 timestamp for 7 days ago (for example, 2026-09-15T00:00:00Z).

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "environment=prod" \
  --data-urlencode "eventType=create-secret,update-secret,delete-secret,create-secrets,update-secrets,delete-secrets" \
  --data-urlencode "startDate=<start-date>"

Include the batch event types (create-secrets, update-secrets, delete-secrets) so that bulk changes from the CLI or SDKs aren’t missed.

Who deleted a secret

Find who removed a specific secret key. Include the batch event so single and bulk deletes are both matched.

Infisical UI
API

Go to Organization > Audit Logs.

Select Search audit logs and add these filters:

event: delete-secret, delete-secrets
project: the project holding the secret
secret_key: the key that was deleted

Read the actor column on each result to see who ran the delete. The secret_key filter only applies when a project is set.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=delete-secret,delete-secrets" \
  --data-urlencode "secretKey=DATABASE_URL"

Read actor.type and actor.metadata on each result to see who ran the delete.

Certificate Manager

Recent certificate issuance

Find every certificate issued from a project in the last 7 days.

Externally-issued certificates (from a linked external CA) don’t emit an issuance audit event when Infisical attaches the certificate. The order-certificate-from-profile event captures the request at submit time (typically with event.metadata.status = pending), and Infisical doesn’t update the audit row later. To confirm which orders resulted in issued certificates, check the certificate list in Certificate Manager.

Infisical UI
API

Go to Certificate Manager, select the project, and open Audit Logs.

Set the date range to the last 7 days.

Select Search audit logs and add:

event: issue-cert, issue-pki-subscriber-cert, issue-certificate-from-profile

The returned event.metadata varies by issuance path:

issue-cert records the certificate authority (CA), its distinguished name (DN), and serial number
Subscriber and profile events record the subscriber or profile ID and common name, with the serial number added once the certificate is issued

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=issue-cert,issue-pki-subscriber-cert,issue-certificate-from-profile" \
  --data-urlencode "startDate=<start-date>"

Who revoked a certificate

Find every revocation in a project.

Infisical UI
API

Go to Certificate Manager, select the project, and open Audit Logs.

Select Search audit logs and add:

event: revoke-cert

Read the actor column on each result to see who ran the revocation.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=revoke-cert"

KMS

Recent key use

Find every encryption, decryption, signature, and verification against KMS keys in a project.

Infisical UI
API

Go to KMS, select the project, and open Audit Logs.

Select Search audit logs and add:

event: cmek-encrypt, cmek-decrypt, cmek-sign, cmek-verify

To narrow the results to a specific key, read event.metadata.keyId on each row.

cmek-* events carry keyId in event.metadata, so match it with eventMetadata to scope to a specific key.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=cmek-encrypt,cmek-decrypt,cmek-sign,cmek-verify" \
  --data-urlencode "eventMetadata=keyId=<kms-key-id>"

Key lifecycle changes

Find every KMS key created, updated, or deleted in a project.

Infisical UI
API

Go to KMS, select the project, and open Audit Logs.

Select Search audit logs and add:

event: create-cmek, update-cmek, delete-cmek

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=create-cmek,update-cmek,delete-cmek"

Secret Scanning

Recent scan runs

Find every completed scan run in the last 7 days (both scheduled and on-demand). Each row represents one run, and event.metadata records the data source, the scan type, and the status. Successful runs also include numberOfSecretsDetected.

Infisical UI
API

Go to Secret Scanning, select the project, and open Audit Logs.

Set the date range to the last 7 days.

Select Search audit logs and add:

event: secret-scanning-data-source-scan

To also see the request rows for on-demand scans (which fire before the run completes), add secret-scanning-data-source-trigger-scan to the event filter. On-demand scans then appear twice: once as a trigger and once as a completed run.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=secret-scanning-data-source-scan" \
  --data-urlencode "startDate=<start-date>"

Add secret-scanning-data-source-trigger-scan to eventType to also see the request rows for on-demand scans. On-demand scans then appear twice: once as a trigger and once as a completed run.

Finding updates

View every finding an operator marked as remediated, dismissed, or otherwise updated.

Infisical UI
API

Go to Secret Scanning, select the project, and open Audit Logs.

Select Search audit logs and add:

event: secret-scanning-finding-update

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "projectId=<project-id>" \
  --data-urlencode "eventType=secret-scanning-finding-update"

Privileged Access Manager

All privileged sessions this week

Find every session start, end, or termination in the last 7 days.

Infisical UI
API

Go to PAM > Audit Logs.

Set the date range to the last 7 days.

Select Search audit logs and add:

event: pam-session-start, pam-session-end, pam-session-terminate

The PAM project ID isn’t exposed publicly, so call the organization endpoint and filter by exact event names.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=pam-session-start,pam-session-end,pam-session-terminate" \
  --data-urlencode "startDate=<start-date>"

Who accessed a specific PAM account

View all access to a PAM account using its account ID.

Infisical UI
API

Go to PAM > Audit Logs.

Select Search audit logs and add:

event: pam-account-access, pam-account-credentials-view

Each result’s event.metadata.accountId names the account and actor names the accessor.

pam-account-access events carry accountId in event.metadata, so match it with eventMetadata.

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=pam-account-access,pam-account-credentials-view" \
  --data-urlencode "eventMetadata=accountId=<pam-account-id>"

Agent Vault

Sessions issued this week

Find every Agent Vault session minted or revoked over the last 7 days.

Infisical UI
API

Go to Agent Vault > Audit Logs.

Set the date range to the last 7 days.

Select Search audit logs and add:

event: agent-vault-session-mint, agent-vault-session-revoke

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=agent-vault-session-mint,agent-vault-session-revoke" \
  --data-urlencode "startDate=<start-date>"

Proxy lifecycle events

Find every proxy registration, enrollment, and revocation.

Infisical UI
API

Go to Agent Vault > Audit Logs.

Select Search audit logs and add:

event: agent-vault-proxy-register, agent-vault-proxy-enroll, agent-vault-proxy-revoke, agent-vault-proxy-delete

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=agent-vault-proxy-register,agent-vault-proxy-enroll,agent-vault-proxy-revoke,agent-vault-proxy-delete"

Identities and authentication

Everything a specific identity did

Investigate every action a machine identity took.

Infisical UI
API

Go to Organization > Audit Logs.

Select Search audit logs and add these filters:

actor: identity
actor_id: the identity’s ID

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "actor=<identity-id>" \
  --data-urlencode "actorType=identity"

Set actorType for any non-user actor so the filter targets the right ID column. Only actor types with an ID field can be filtered this way; see the note under Advanced filters for the full list.

Find failed login attempts by a machine identity, across every auth method.

Infisical UI
API

Go to Organization > Audit Logs.

Select Search audit logs and add these filters:

event: login-identity-universal-auth-failed, login-identity-kubernetes-auth-failed, login-identity-oidc-auth-failed, login-identity-gcp-auth-failed, login-identity-aws-auth-failed, login-identity-jwt-auth-failed
actor: identity
actor_id: the identity’s ID

Extend the event list to include any other *-failed variants your organization uses (SPIFFE, LDAP, AliCloud, and so on).

curl -G "https://app.infisical.com/api/v1/organization/audit-logs" \
  -H "Authorization: Bearer <your-access-token>" \
  --data-urlencode "eventType=login-identity-universal-auth-failed,login-identity-kubernetes-auth-failed,login-identity-oidc-auth-failed,login-identity-gcp-auth-failed,login-identity-aws-auth-failed,login-identity-jwt-auth-failed" \
  --data-urlencode "actor=<identity-id>" \
  --data-urlencode "actorType=identity"

Event types

Infisical emits hundreds of event types. Here are some of the most common ones you’ll encounter.

Secrets

Event	When it fires
`get-secret`	A caller read a specific secret.
`get-secrets`	A caller listed the secrets in a folder.
`reveal-secret`	A user revealed a secret value in the UI.
`create-secret`, `create-secrets`	A caller created a secret (single or batch).
`update-secret`, `update-secrets`	A caller edited a secret (single or batch).
`delete-secret`, `delete-secrets`	A caller deleted a secret (single or batch).
`move-secrets`	A user moved secrets to another folder or environment.
`duplicate-secret`	A user copied a secret to another folder or environment.
`redact-secret-version-value`	An admin redacted a value from a secret’s version history.

Identities and authentication

Event	When it fires
`create-identity`, `update-identity`, `delete-identity`	A machine identity was added, edited, or removed.
`login-identity-*` (for example, `login-identity-universal-auth`, `login-identity-kubernetes-auth`, `login-identity-oidc-auth`, `login-identity-gcp-auth`, `login-identity-aws-auth`)	A machine identity authenticated.
`login-identity-*-failed`	A machine identity’s authentication attempt failed.
`create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`	A universal-auth client secret was issued or revoked.
`clear-identity-universal-auth-lockouts`, `clear-identity-ldap-auth-lockouts`	An admin cleared a machine identity’s lockout.

Projects and access

Event	When it fires
`create-project`, `update-project`, `delete-project`	A project was created, edited, or deleted.
`create-identity-project-membership`, `update-identity-project-membership`, `delete-identity-project-membership`	A machine identity joined, changed role in, or left a project.
`update-user-org-membership`, `delete-user-org-membership`	A user’s role or membership in the organization changed.

Integrations and secret sync

Event	When it fires
`create-integration`, `delete-integration`, `manual-sync-integration`	A legacy integration was added, removed, or manually re-synced.
`create-secret-sync`, `update-secret-sync`, `delete-secret-sync`	A user configured a secret sync destination.
`secret-sync-sync-secrets`, `secret-sync-import-secrets`, `secret-sync-remove-secrets`	A sync run pushed, imported, or removed secrets from its destination.

Approvals

Event	When it fires
`approval-request-create`, `approval-request-approve`, `approval-request-reject`, `approval-request-cancel`	The lifecycle of an approval request.
`access-approval-request-create`, `access-approval-request-review`, `access-approval-request-update`, `access-approval-request-revoke`	The lifecycle of an access approval request.
`secret-approval-request`, `secret-approval-request-review`, `secret-approval-merged`, `secret-approval-closed`, `secret-approval-reopened`	The lifecycle of a secret change request.
`approval-policy-create`, `approval-policy-update`, `approval-policy-delete`	An admin changed an approval policy.

Audit logs

Event	When it fires
`view-audit-logs`	A user opened the audit log viewer.
`create-audit-report`, `get-audit-report`, `get-audit-reports`, `delete-audit-report`	A user managed a project-level audit report.
`create-org-audit-report`, `get-org-audit-reports`, `delete-org-audit-report`	A user managed an organization-level audit report.

For the full event catalog and every field the API accepts, see the audit log export API reference.

Next steps

Stream audit logs

Forward audit logs to a SIEM, storage bucket, or observability stack.

ClickHouse storage backend

Keep queries fast when a self-hosted audit log table grows to hundreds of millions of rows.

Projects

Audit and logs

Admin console

Planning

View audit logs

For an organization

For a product

Log structure

Example payload

Filtering audit logs

By date

Advanced filters

Special characters

Filtering by event metadata

Common filters

Secrets Manager

Certificate Manager

KMS

Secret Scanning

Privileged Access Manager

Agent Vault

Identities and authentication

Event types

Next steps

Stream audit logs

ClickHouse storage backend

​View audit logs

​For an organization

​For a product

​Log structure

​Example payload

​Filtering audit logs

​By date

​Advanced filters

​Special characters

​Filtering by event metadata

​Common filters

​Secrets Manager

​Certificate Manager

​KMS

​Secret Scanning

​Privileged Access Manager

​Agent Vault

​Identities and authentication

​Event types

​Next steps

Stream audit logs

ClickHouse storage backend

View audit logs

For an organization

For a product

Log structure

Example payload

Filtering audit logs

By date

Advanced filters

Special characters

Filtering by event metadata

Common filters

Secrets Manager

Certificate Manager

KMS

Secret Scanning

Privileged Access Manager

Agent Vault

Identities and authentication

Event types

Next steps