Audit logs

OpsNexus records every sign-in, every change and every secret access in an append-only audit log. Each entry carries the hash of the entry before it, so editing or deleting a row breaks the chain.

Open it from Audit logs in the sidebar. You need Read only on the Audit logs module. Among the built-in roles, Organization Admin, DevOps Engineer and Security Engineer have it.

#What an entry contains

The audit log also records the project an action happened in.

#What is never logged

Secret values never go into the audit log. Before an entry is saved, any detail whose key contains password, token, secret, api_token, private_key, client_secret or value is replaced with ***. Credential changes log the field names only.

#Recorded actions

The table lists the action names found in OpsNexus, grouped by area.

Failed sign-ins are recorded as auth.login with result failed and a reason, for example the attempt count or "account locked".

#Search and filter

• Type in Search user, action, resource or IP to match the actor, action name, resource or IP address. The search runs after a short pause in typing.
• Select a category: All, Sign-in, Access, Secrets, Deploy, Integrations, Agents or System.
• Results are newest first, 50 per page.
• Select a row to open its details: category, resource, resource type, source IP, the details JSON and the entry's hash.

The API supports more filters than the page. GET /api/audit-logs accepts category, q, result (success, failed or denied), since (an ISO date-time), page and page_size (up to 200).

curl -H "X-API-Key: <access-key>.<secret-key>" \
  "https://opsnexus.example.com/api/audit-logs?result=failed&since=2026-11-01T00:00:00Z"

#Export

Select Export CSV to download audit-logs.csv. The export uses the current category and search filter. It contains up to 50,000 entries, newest first, with these columns:

time,actor,action,category,resource,result,ip,details,hash

The export endpoint is GET /api/audit-logs/export.csv and accepts category, q and since.

You can also generate the Audit log report as PDF, Excel or CSV for a date range, or email it on a schedule. See Dashboards & reports.

#The hash chain

Each organization has its own chain. When OpsNexus writes an entry, it:

1. Reads the hash of the organization's most recent entry.
2. Stores it in the new entry as prev_hash.
3. Computes the new entry's hash as the SHA-256 of a JSON array holding the organization ID, actor ID, action, resource type, resource ID, result, the scrubbed details and prev_hash, serialized with sorted keys.

If someone changes a stored entry, its hash no longer matches its content. If someone deletes an entry, the next entry's prev_hash no longer points at an existing hash.

#Check the chain

OpsNexus has no built-in verify button. To check the chain yourself, query the audit_logs table and confirm that each entry's prev_hash equals the hash of the entry before it in the same organization:

docker compose exec -T db psql -U opsnexus -d opsnexus -c "
SELECT id, created_at, action
FROM (
  SELECT id, created_at, action, prev_hash,
         LAG(hash) OVER (PARTITION BY organization_id ORDER BY created_at) AS expected
  FROM audit_logs
) t
WHERE expected IS NOT NULL AND prev_hash IS DISTINCT FROM expected;"

An empty result means the links are intact. Replace the user and database names with the POSTGRES_USER and POSTGRES_DB values from your .env.

#Retention

OpsNexus doesn't delete audit entries. There is no retention setting for the audit log, so it grows until you archive it. Plan database size with that in mind, and export older entries to long-term storage if your policy needs it.

Audit entries are included in platform backups. See Backup & restore.

#Related pages

• Access control
• Secrets & variables
• Security center