audit
The account's control-plane mutation trail — who changed what, newest first
audit lists the account's audit events: every recorded mutation to projects, budgets, keys, team membership, billing, notification channels, and agent runs, newest first. It is account-scoped and requires a user login; a project key exits 3 before any request with a hint that depends on where the key came from. There is no --project — the trail covers the whole account.
solwyn audit [--range 7d|30d|90d|365d] [--action <action>] [--cursor <c>] [--all]| Option | Type | Default | Purpose |
|---|---|---|---|
--range | 7d | 30d | 90d | 365d | 30d | Audit window. |
--action | string, 1–100 chars | none | Exact-match action name. |
--cursor | string | none | Continue from a previous page. |
--all | boolean | false | Follow every cursor and return all remaining events. |
| Contract | |
|---|---|
| Auth | JWT |
| Exit codes | 0 success · 1 generic/API · 2 usage · 3 auth |
| JSON schema | solwyn.audit.v1 |
$ solwyn audit --range 7d
Field Value
Event audit_02
Created 2026-08-30T16:45:00Z
Account acct_alpha
Actor user_operator
Action agent_run.stopped
Target agent_run:run_0123456789abcdef0123456789abcdef
Detail {"reason":"manual_kill"}
Event audit_01
Created 2026-08-29T12:00:00Z
Account acct_alpha
Actor user_owner
Action project.updated
Target project:proj_alpha
Detail {}Each event records the actor, the action, the target as type:id, a timestamp, and a small detail object explaining why — for a stopped run, {"reason":"manual_kill"}. This is an account audit, not call telemetry: no cost events, no prompts.
Actions
The --help epilog lists the known action names:
account.created, account.updated, team.member_removed, team.member_role_changed,
team.invitation_created, team.invitation_revoked, project.created, project.updated,
project.archived, budget.defaults_restored, budget.updated, api_key.rotated,
api_key.deleted, agent_run.stopped, billing.plan_intent_deleted, billing.plan_changed,
billing.cancel_scheduled, billing.cancel_undone, billing.plan_change_discarded,
notification_channel.created, notification_channel.updated, notification_channel.deleted,
account_phone.verified, account_phone.deleted, consent.sms_alerts_changed, upsertedBudget rule add and remove are not audited; only budget.updated lands here. For per-rule lifecycle, use alerts list --rule-type.
Paging
Without --all, one page is returned. In table mode, when more remain, stderr prints three lines: that more events exist, the next cursor (JSON-escaped, so an opaque value can never inject terminal control sequences), and the --all suggestion. With --all, the CLI follows cursors until exhausted and returns one combined payload with has_more: false; a repeated cursor aborts with exit 1 rather than looping.
Related
- Agent runs — each stop writes an
agent_run.stoppedevent runs stop— stop a run from the CLI- Team — the roles and invitations these events record