Audit Log

The Audit Log in the CloudRepo admin portal lists actions taken in your organization, newest first. It is included on every plan, and organization owners can open it.

Open the Audit Log

1. Sign in to the CloudRepo portal as an organization owner.
2. In the sidebar, click Security, then click the Audit Log card.

When recording began

Audit tracking began on 2026-09-10. Events from before that date are not guaranteed to be in your Audit Log, so do not rely on it for anything earlier. Some events were added in later production deploys, and the table below gives each event its own date.

What the Audit Log records

The Event column shows each event by the name in the first column below.

Event	Recorded when	Since
cloudrepo.audit.event/login-success	Someone signs in to the admin portal with a password.	2026-09-10
cloudrepo.audit.event/login-failure	A password sign-in to the admin portal fails.	2026-09-10
cloudrepo.audit.event/signed-out	Someone signs out of the admin portal. The Target column names the session that ended.	Next release
cloudrepo.audit.event/audit-log-viewed	The Audit Log page loads events.	2026-09-10
cloudrepo.audit.event/audit-log-viewed	The Overview home page loads events for its Latest activity.	2026-10-13
cloudrepo.audit.event/member-removed	A member is removed from the organization.	2026-09-10
cloudrepo.audit.event/repository-token-minted	A repository token is created.	2026-09-10
cloudrepo.audit.event/repository-token-mint-failed	Creating a repository token fails.	2026-09-10
cloudrepo.audit.event/repository-token-rotated	A repository token is rotated.	2026-09-10
cloudrepo.audit.event/repository-token-revoked	A repository token is revoked.	2026-09-10
cloudrepo.audit.event/token-use-clamp-denied	A write or delete is refused because the member’s role at this repository doesn’t allow it, even though the token’s scope or the member’s role at another repository does. For example, a delete by a member who can publish but not delete.	2026-09-10
cloudrepo.audit.event/artifact-access-refused	A package or Docker request is refused by the repository’s permission check.	Next release
cloudrepo.audit.event/docker-bearer-minted	A signed-in Docker client is issued a registry token.	2026-09-10
cloudrepo.audit.event/subscriber-access-key-granted	A software distribution access key is issued.	2026-09-10
cloudrepo.audit.event/subscriber-access-key-rotated	An access key is rotated.	2026-09-10
cloudrepo.audit.event/subscriber-access-key-expired	An expired access key is refused for the first time (Docker and other token logins).	2026-09-10
cloudrepo.audit.event/artifact-uploaded	A package client publishes to a hosted Maven, npm, PyPI or Docker repository.	2026-09-10
cloudrepo.audit.event/artifact-uploaded	Someone uploads a file in the admin portal.	2026-10-13
cloudrepo.audit.event/artifact-downloaded	A signed-in package client downloads from a hosted Maven, npm, PyPI or Docker repository, from a Maven, npm or PyPI proxy repository, or through a Maven group repository.	2026-09-10
cloudrepo.audit.event/artifact-downloaded	A signed-in Docker client pulls through a Docker proxy or group repository.	2026-10-07
cloudrepo.audit.event/artifact-deleted	A Docker client deletes an image tag or manifest.	2026-09-10
cloudrepo.audit.event/artifact-deleted	An npm client deletes a package, or one of its tarballs (one event for each tarball).	2026-09-10
cloudrepo.audit.event/artifact-downloaded	Someone downloads a file in the admin portal, one at a time or several in a ZIP (one event for each file).	Next release
cloudrepo.audit.event/artifact-deleted	Someone deletes a file, or a Docker image tag, in the admin portal.	Next release
cloudrepo.audit.event/artifact-deleted	An npm client unpublishes a version of a package that keeps other versions (one event for each version removed).	Next release
cloudrepo.audit.event/repository-created	A repository is created in the portal.	2026-09-29
cloudrepo.audit.event/repository-deleted	A repository is deleted in the portal.	Next release
cloudrepo.audit.event/repository-visibility-changed	A repository is made public or private in the portal.	Next release
cloudrepo.audit.event/subscriber-access-key-expiry-changed	An access key’s expiry date is changed or removed.	2026-09-29
cloudrepo.audit.event/admin-demotion-notice-failed	A member loses an administrator permission and the email telling the other administrators could not be sent.	2026-10-07
cloudrepo.audit.event/subscription-cancelled	Someone cancels the organization’s subscription in the admin portal.	Next release

Before 2026-10-07, a download that filled a Maven proxy repository’s cache was also recorded as cloudrepo.audit.event/artifact-uploaded, with the person who downloaded it as the actor. Those rows are kept as they were written. Since 2026-10-07 the same download is recorded once, as cloudrepo.audit.event/artifact-downloaded.

Not recorded today

Anything not in the table above may not be recorded. Don’t rely on it.

• Existence checks (HEAD requests and directory listings) and npm and PyPI index pages are not recorded as downloads; file downloads are, including Maven metadata files.
• In the admin portal: deleting a directory, bulk deletes, and anything purged or restored from the trash.
• Changing a member’s permissions. The cloudrepo.audit.event/admin-demotion-notice-failed event above records only that an email about a removed administrator permission could not be sent, not the change itself.
• Inviting or adding a member in the portal.
• Changing or resetting a password.
• Changes to webhooks, to a proxy repository’s upstream credentials, or switching plans or payment details.
• Single sign-on (SSO) and multi-factor authentication (MFA) events.
• Downloads through a repository’s public address or by anyone who is not signed in.
• An expired access key refused at a Maven, pip or other username-and-password login. Docker is the exception: an expired key’s first refusal at docker login or on a pull writes one row for that key.
• A subscriber key refused at docker login, or when it tries to push, for a reason other than its expiry (no row yet).

A few other events may appear, such as an npm token being created. Don’t rely on those as a record.

If you need an action recorded that this page does not list, tell us in the portal’s chat.

How the dates were set

Each date is the day (UTC) the production deploy that first recorded that event finished rolling out. A deploy finishes about two hours after it starts serving traffic, so the first rows of an event can be up to about two hours earlier than its date. A date is never the day the code was written or merged: the code behind the first events was merged months before 2026-09-10, but production did not run it until that deploy, so a merge date would claim history that does not exist. When an event is added, it gets the date of the production deploy that carries it. Until that deploy has finished, its row says Next release.

What each row shows

• The event, as a sentence: what was done and, when recorded, who acted (an account’s email address, or the API token, access key, SCIM connection or CloudRepo process that acted) and what it acted on, listed under the day it happened in UTC.
• Where it came from: when recorded, the address and the client.
• Package downloads are hidden until you select Show package downloads.
• Audit log views are hidden until you select Show audit log views. Each view’s details show which page loaded the events: From: Audit log page or From: Home page. Views recorded before 2026-10-13 don’t show a page.

Select a row to open the event: its type; the time in UTC and in your time zone; when recorded, who acted and what it acted on; the details recorded for that kind of event; and its reference ID. Most events show their result, the IP address and client it came from, and how the person signed in.

• Reference ID: An ID for this event. Events from the same request share it. Copy it with the button.

What the Audit Log is not

• It is not a complete record of everything that happens in your organization. Only some actions are recorded, and an event can fail to be stored without the action it describes failing.
• The page has no search or export. It shows your most recent events, newest first.