Admin Dashboard: Audit Log
Audit Log records management-plane changes such as creating, updating, deleting, importing, linking, or reloading resources. It answers who changed configuration and when. Agent tool execution belongs in Tool Call Log.
Typical entries include changes to agents, schemas, models, MCP servers, API keys, settings, Knowledge resources, configuration imports, and resilience controls. Read-only requests are not a substitute for a dedicated access log, and model/tool activity is not recorded here.
Filter the log
Section titled “Filter the log”Use the actor type, action, resource, From, and To filters together. The actor selector distinguishes Admin sessions from API tokens; it does not search individual actor IDs. Results are paginated and display timestamp, actor type and ID, action, resource, and a detail summary. Select an entry to inspect the full details.
| Field | How to use it |
|---|---|
| Timestamp | Establish the order of changes and correlate with an incident window. |
| Actor type and ID | Distinguish an administrator session from an API-key or automation identity. |
| Action | Narrow the list to creates, updates, deletes, imports, links, or reloads. |
| Resource | Identify the affected route or resource family. |
| Details | Inspect the recorded identifiers and change context. |
Investigation workflow
Section titled “Investigation workflow”- Bound the time window around the observed change.
- Filter the resource type and action.
- Identify the actor and inspect the detail payload.
- Correlate with Tool Call Log or server logs when the configuration change led to a runtime failure.
The expected result is an attributable administrative event. A missing event can mean the action occurred outside an audited route or outside the selected tenant/time range.
Operational cautions
Section titled “Operational cautions”Audit details may contain configuration and identifiers. Restrict access and apply your required retention and backup policy. Records on this page cannot be edited or deleted from Admin.
An audit entry proves that SyntheticBrew recorded an administrative request; it does not by itself prove that a downstream MCP server, model provider, or external system completed an action. Correlate those operations with Tool Call Log and the external system’s audit trail.