:::

Events

Activity events recorded by Armor.

Events appear in Armor logs as name plus metadata. The event name identifies what happened; metadata adds context such as who performed the action, which team it affected, and where it occurred.

Dotenvx

No events are recorded without Armor. Local encrypt, decrypt, and run do not write an audit log.

Armor

Event	Description
`connection/create`	A provider connection was added.
`connection/delete`	A provider connection was removed from Dotenvx.
`connection/reauthorize`	A provider connection was reauthorized, or reauthorization failed.
`connection/revoke`	A provider connection was revoked or disconnected, or revocation failed.
`connection/update`	A provider connection was renamed.
`destination/create`	Infra was added to Dotenvx.
`destination/delete`	Infra was removed from Dotenvx. The remote infrastructure and its secrets were left unchanged.
`destination/sync`	A sync attempt finished with a success or unsuccessful outcome. This is the summary for the selected secrets.
`destination/update`	An infra display name was changed.
`destination/view`	An infra Secrets or Settings page was opened.
`destinations/view`	The Infra list was opened.
`destinations_new/view`	The Add infra page was opened.
`device/create`	A CLI device was registered.
`invitation/create`	A team invitation was created.
`invitation/delete`	A team invitation was cancelled.
`invitation/update`	A team invitation was updated.
`invitation/view`	A team invitation was opened for management.
`invitations/view`	The team invitations list was opened.
`join_request/cancel`	A join request was cancelled.
`join_request/create`	Someone requested to join the team.
`join_request/update`	A join request was accepted or declined.
`join_request/view`	A join request was opened for review.
`join_requests/view`	The team join requests list was opened.
`keypair/access`	The private key was accessed.
`keypair/create`	An armored key was created.
`keypair/decrypt`	Secrets were decrypted via Enclave without revealing the private key.
`keypair/delete`	An armored key was deleted.
`keypair/move`	An armored key was moved to another team.
`keypair/view`	The keypair Details page was opened.
`keypair_access/grant`	A member was granted access to a keypair.
`keypair_access/revoke`	A member's keypair access was revoked.
`keypair_infra/view`	The Infra tab for an armored key was opened.
`keypair_name/update`	A keypair name was changed.
`keypair_setting_enclave/update`	Enclave was turned on or off.
`keypair_setting_guard/update`	Guard was turned on or off.
`keypair_settings/view`	The keypair Settings page was opened.
`keypair_team/view`	The keypair Team page was opened.
`keypair_viz/view`	The keypair Viz page was opened.
`keypairs/view`	The armored keys list was opened.
`logs/read`	Logs were read.
`logs/view`	The logs page was opened.
`member/create`	A member was added to the team.
`member/delete`	A member was removed from the team.
`member/update`	A member's role was changed.
`member/view`	A team member's profile was opened.
`member_keypairs/view`	A team member's keypair access was opened.
`oauth_token/activate`	An OAuth access token was activated.
`oauth_token/create`	An OAuth access token was created.
`oauth_token/delete`	An OAuth access token was deleted.
`oauth_token/revoke`	An OAuth access token was revoked.
`organization/create`	A team or workspace was created.
`secret/create`	A managed secret was added, including starting management of an existing remote secret. Its source can be a literal value or a linked keypair.
`secret/delete`	Management of a secret was stopped by removing its Dotenvx record. The remote secret was left unchanged.
`secret/sync`	A managed secret write succeeded or failed during a sync attempt.
`secret/update`	A managed secret was saved after editing its name, value, or linked keypair.
`settings/view`	Settings home was opened.
`settings_avatar/update`	The team avatar was changed.
`settings_avatar/view`	Avatar settings were opened.
`settings_billing/view`	Billing settings were opened.
`settings_connection/view`	A provider connection detail page was opened.
`settings_connections/view`	The Connections list was opened.
`settings_connections_new/view`	The Add connection page was opened.
`settings_danger_zone/cancel`	The team plan was cancelled.
`settings_danger_zone/delete`	The team was deleted.
`settings_danger_zone/view`	The danger zone was opened.
`settings_digest/update`	Digest preferences were changed.
`settings_digest/view`	Digest settings were opened.
`settings_join_requests/update`	Join-request settings were changed.
`settings_keypair_access/update`	Default keypair access for a role was changed.
`settings_name/update`	The team name was changed.
`settings_name/view`	Team name settings were opened.
`settings_organization/view`	Organization settings were opened.
`settings_security/view`	Security settings were opened.
`settings_slack/request`	A Slack support-channel request was submitted.
`settings_slack/view`	Support settings were opened.
`settings_team/read`	Team members, invitations, or join requests were read.
`settings_team/view`	The team settings page was opened.
`settings_tokens/view`	Automation tokens were opened.
`user/create`	A user signed up.

Infra and secret events

Adding or editing a managed secret saves it in Dotenvx; it does not write to the provider until sync. Starting management uses secret/create, just like Add secret. Linked keypairs use the same events with source: keypair.

Each sync records secret/sync for the secrets whose writes were attempted, plus one destination/sync summary. This also applies when syncing a single secret. Check outcome for success or unsuccessful; a failed summary can include earlier successful secret writes.

Secret event metadata identifies the destination, secret, endpoint, and actor. It never includes secret values or private keys. These audit entries use the existing activity log; they are separate from the stored secret records.

Validation failures on create or update, and failures fetching remote secrets, do not currently produce dedicated audit events. Opening or cancelling an editor does not create a secret event. Existing historical events retain their original names.