Events appear in Armor logs as name plus metadata. The event name identifies what happened; metadata adds context such as who performed the action, which team it affected, and where it occurred.
Dotenvx
No events are recorded without Armor. Local encrypt, decrypt, and run do not write an audit log.
Armor
| Event | Description |
|---|---|
device/create |
A CLI device was registered. |
invitation/create |
A team invitation was created. |
invitation/delete |
A team invitation was cancelled. |
invitation/update |
A team invitation was updated. |
invitation/view |
A team invitation was opened for management. |
invitations/view |
The team invitations list was opened. |
join_request/cancel |
A join request was cancelled. |
join_request/create |
Someone requested to join the team. |
join_request/update |
A join request was accepted or declined. |
join_request/view |
A join request was opened for review. |
join_requests/view |
The team join requests list was opened. |
keypair/access |
The private key was accessed. |
keypair/create |
An armored key was created. |
keypair/decrypt |
Secrets were decrypted via Enclave without revealing the private key. |
keypair/delete |
An armored key was deleted. |
keypair/move |
An armored key was moved to another team. |
keypair/view |
The keypair Details page was opened. |
keypair_access/grant |
A member was granted access to a keypair. |
keypair_access/revoke |
A member's keypair access was revoked. |
keypair_name/update |
A keypair name was changed. |
keypair_setting_enclave/update |
Enclave was turned on or off. |
keypair_setting_guard/update |
Guard was turned on or off. |
keypair_settings/view |
The keypair Settings page was opened. |
keypair_team/view |
The keypair Team page was opened. |
keypair_viz/view |
The keypair Viz page was opened. |
keypairs/view |
The armored keys list was opened. |
logs/read |
Logs were read. |
logs/view |
The logs page was opened. |
member/create |
A member was added to the team. |
member/delete |
A member was removed from the team. |
member/update |
A member's role was changed. |
member/view |
A team member's profile was opened. |
member_danger_zone/view |
A team member's danger zone was opened. |
member_keypairs/view |
A team member's keypair access was opened. |
member_role/view |
A team member's role settings were opened. |
oauth_token/activate |
An OAuth access token was activated. |
oauth_token/create |
An OAuth access token was created. |
oauth_token/delete |
An OAuth access token was deleted. |
oauth_token/revoke |
An OAuth access token was revoked. |
organization/create |
A team or workspace was created. |
settings/view |
Settings home was opened. |
settings_avatar/update |
The team avatar was changed. |
settings_avatar/view |
Avatar settings were opened. |
settings_billing/view |
Billing settings were opened. |
settings_danger_zone/cancel |
The team plan was cancelled. |
settings_danger_zone/delete |
The team was deleted. |
settings_danger_zone/view |
The danger zone was opened. |
settings_digest/update |
Digest preferences were changed. |
settings_digest/view |
Digest settings were opened. |
settings_join_requests/update |
Join-request settings were changed. |
settings_keypair_access/update |
Default keypair access for a role was changed. |
settings_name/update |
The team name was changed. |
settings_name/view |
Team name settings were opened. |
settings_organization/view |
Organization settings were opened. |
settings_security/view |
Security settings were opened. |
settings_slack/request |
A Slack support-channel request was submitted. |
settings_slack/view |
Support settings were opened. |
settings_team/read |
Team members, invitations, or join requests were read. |
settings_team/view |
The team settings page was opened. |
settings_tokens/view |
Automation tokens were opened. |
user/create |
A user signed up. |