Audit logs

Every administrative action in your workspace writes an immutable audit record - who did what, when, and from where. Available on Team plans and above.

What's logged

Not logged: routine API reads, webhook deliveries, and app-level traffic - those live in the request log, not the audit trail.

Log entry shape

{
  "id": "aud_4mP8xK2nL9qR",
  "timestamp": "2026-09-17T10:41:19Z",
  "actor": { "type": "member", "email": "ops@acme.io" },
  "action": "key.created",
  "target": { "type": "api_key", "id": "key_3nQ7wPx2vM" },
  "source_ip": "203.0.113.41",
  "user_agent": "dashboard/2.4.1",
  "environment": "live",
  "metadata": { "scopes": ["projects:read"], "expires_in_days": 90 }
}

actor.type is member, service_account, scim, or system (e.g., automatic key expiry).

Querying

Dashboard

Settings → Audit log - filter by action, actor, date range, and environment. Export to CSV for compliance reviews.

API

curl "https://api.meridian.dev/v2/audit_logs?action=key.created&since=2026-09-01" \
  -H "Authorization: Bearer $MERIDIAN_API_KEY"

Filter params: action, actor, since, until, environment, limit, cursor (same pagination as every list - see API overview).

Streaming to SIEM

For real-time ingestion (Splunk, Datadog, Sentinel), stream audit events as webhook deliveries:

meridian webhooks create \
  --url https://siem.acme.io/meridian-audit \
  --events 'audit.*'

Retention

Entries are immutable - neither admins nor Meridian support can alter or delete them inside the retention window.

Compliance uses

• SOC 2 evidence - the log demonstrates access review and change control.
• Incident forensics - reconstruct exactly what an actor touched.
• Access reviews - periodic export for "who had admin in Q3" questions.