Activity & Audit
Every credential access, agent request, policy decision, and config change — metadata in your dashboard, the full record on your webhook.
The Audit Log page records every significant event in your vault: credential access, agent and MCP proxy requests, token refreshes, policy decisions, and create/update/delete changes to tokens, agents, proxies, and policies.
Where events live
Every event is written through a single choke point and lands in two places:
| Copy | Where | Contains |
|---|---|---|
| Activity feed | Token Vault (drives the dashboard) | PII-stripped metadata only — event type, service, agent/proxy names, policy verdicts. Client IP and user agent are deliberately never stored here. |
| Sovereign copy | Your webhook | The full original event, including client IP and user agent. Yours to retain, query, and alert on however you like. |
The dashboard reads only the metadata feed, so your activity history works even while your webhook is offline — and the complete record stays on your infrastructure.
Event Types
| Event | Description |
|---|---|
| Secret Access | A credential was read directly from the dashboard |
| Agent Access | An agent retrieved a credential via API or MCP |
| Token Refresh | A token was refreshed |
| Policy Denied | An access attempt was blocked by an ABAC policy |
| Config Changes | Tokens, agents, proxies, and policies created, updated, or deleted — including MCP access enabled via OAuth consent |
Sources
Each event records how the access happened:
- Direct -- from the Token Vault dashboard.
- Agent -- an AI agent using its API key or an OAuth session.
- MCP Proxy -- a credential injected into an upstream call via the proxy.
- OAuth Consent -- a change made during the in-browser OAuth authorization step.
Filtering
Use the filter bar to narrow by event type, source, service (e.g.
github), or agent. Other pages deep-link here pre-filtered — e.g. "View
activity" on an agent card shows just that agent's events.
Event Details
Each entry shows what happened, the service badge, a relative timestamp, and — for
policy denials — the specific rule that blocked the request (e.g. time_window,
rate_limit). Request-level forensics (client IP, user agent) live in the full
event on your webhook's copy, not in Token Vault.
Retention
The activity feed is append-only — entries cannot be modified or deleted from the dashboard. Retention of the full sovereign copy is up to your webhook.
Ready to try it?
Sign up free with Google — your credentials stay on your own webhook, and the quickstart gets an agent fetching its first credential in about ten minutes.