Audit log
See who changed which flag, segment, environment, or key, and what the change was.
The audit log records every change that a workspace makes through the Toggld API, from the dashboard, from API keys, and from AI agents. Each event stores who made the change and the complete state before and after it.
What Toggld records
| Resource | Actions |
|---|---|
| Flag | flag.create, flag.update, flag.delete |
| Segment | segment.create, segment.update, segment.delete |
| Environment | environment.create, environment.update, environment.delete |
| API key | apiKey.create, apiKey.revoke |
Notes:
flag.updatecovers both full replacements and partial updates.- Changes to a segment's member list are recorded as
segment.update. - A new environment order records one
environment.updateevent for each environment that moved. - Events never contain secret keys. An API key event contains the key's ID and prefix only.
The audit log does not record flag evaluations, reads, or changes to members and invitations. Internal workspace provisioning events are not shown either.
Toggld writes the audit event in the same transaction as the change. If the audit event cannot be saved, the change is not saved either.
Actors
Each event names the actor that made the change:
| Actor type | Who | id |
|---|---|---|
user | A person in the dashboard, or an AI agent that acts for that person | The user ID |
apiKey | A management key | The API key ID, as listed in API keys |
The event format also defines the actor type service for internal Toggld operations.
View the audit log
Open Audit log in your workspace. It shows recent changes, newest first, with the actor and the saved change. Every role, including readers, can view it.
- Filter by Resource type, such as Flag or API key.
- Filter by Resource key or ID, such as
new-checkout. - Select View saved change to see the full state that an event saved.
The page shows the latest 100 matching events. Use the filters to find older events.
Each flag page also has an Activity section with that flag's recent changes. Each change shows its environment.
To restore an earlier configuration from the audit log, follow Restore a bad change.
Read the audit log with the API
GET /api/v1/audit-log returns events newest first. It requires a management key. Server SDK keys and public tokens receive HTTP 403.
curl "https://api.toggld.io/api/v1/audit-log?resourceType=flag&resourceId=new-checkout" \
-H "Authorization: Bearer ffk_YOUR_MANAGEMENT_KEY"| Query parameter | Description |
|---|---|
resourceType | flag, segment, environment, or apiKey |
resourceId | A flag key, segment key, environment ID, or API key ID |
environmentId | An environment ID |
action | One of the actions above, such as flag.update |
The API returns at most the latest 100 matching events. It has no paging. Narrow the filters to find older events.
Event format
{
"id": "aud_7861940f-57e6-421d-9231-88d37864cf4a",
"tenantId": "t_workspace_123",
"environmentId": "env_b7a6e99e-b358-4143-beac-30a1687ad930",
"actor": { "type": "apiKey", "id": "key_a2849d00-5262-4484-b18b-7a7ba362ad7e" },
"action": "flag.update",
"resourceType": "flag",
"resourceId": "new-checkout",
"before": { "key": "new-checkout", "enabled": false },
"after": { "key": "new-checkout", "enabled": true },
"metadata": {},
"occurredAt": "2026-10-31T12:00:00.000Z"
}| Field | Description |
|---|---|
environmentId | The environment that the change touched. null for changes to shared definitions, such as flag deletion and segment changes. |
before | The full state before the change. null for a create. |
after | The full state after the change. null for a delete. |
occurredAt | When Toggld recorded the change, in ISO 8601 format. |
The example shortens before and after. Real events contain the complete resource.