Audit

Introduction

The Audit module collects business-relevant changes performed through the platform — one entry per Flow run, Schedule execution, API call, or manual action — and persists them as a three-level trail: an event, its change packages (one per affected identity), and their individual field-level changes. Unless configured headless, it also serves a dedicated audit UI and a read-only REST API over the same data.

See Data model for the event/change package/change structure, Using the audit UI for the built-in UI, and API reference for the REST API.

Configuration

Note

Module name: Audit

Properties

Name	Description	Default	Mandatory
headless	If true, no UI route is set up; the node still collects events and serves the REST API.	false
http_context	Base HTTP context for both the UI and the REST API. API routes are published under {http_context}/api.	/audit
webroot_dir	Directory the built UI is unpacked to. Ignored when headless is true.	web/audit
public	Whether the UI's static assets are served without authentication.	true
type	Storage backend for the write path: jdbc or file. The REST API always reads through jdbc, regardless of this setting.	jdbc
path	File path for JSON Lines output. Required when type is file. Write-path only.
jdbc	JDBC connection used by both the write path and the REST API's read path. See below.	{}
enrichment	LDAP target-object enrichment configuration. See below.	{}

Example

{
  "name": "Audit",
  "config": {
    "jdbc": {
      "schema": "AUDIT"
    },
    "enrichment": {
      "ldap": {
        "object_types": {
          "user": {
            "display_name_attributes": ["displayName", "cn", "uid"]
          },
          "group": {
            "display_name_attributes": ["displayName", "cn"],
            "reference_attributes": {
              "member": {
                "value_object_type": "user",
                "identity_bearing": true
              }
            }
          }
        }
      }
    }
  }
}

The REST API is always available, whether or not headless is set — the UI is the optional part, not the API.

jdbc properties

Name	Description	Default	Mandatory
jdbc.destination	JdbcClient instance name used by both the write path and the REST API's read path.	default
jdbc.schema	Schema the audit tables live in — the single source for both write and read.	audit
jdbc.identity_bearing_attributes	Attribute names that override the default identity/object routing rule, independent of enrichment configuration. Write-path only.	[]

By default, events are written through jdbc to the configured database, in its own schema (audit by default), and the REST API reads through the same jdbc connection. For test or throwaway setups, events can instead be appended to a JSON Lines file by setting type to file — the REST API still reads through jdbc regardless.

Enriching LDAP changes

Raw change events reference LDAP entries by DN and attribute name. To show human-readable names, and to correctly attribute a change to the right identity — for example, a change to a group's member attribute should be attributed to the person added, not to the group — configure enrichment.ldap.object_types.

enrichment.ldap object type properties

Configured per object type under enrichment.ldap.object_types.<name>, for example enrichment.ldap.object_types.user.

Name	Description	Default	Mandatory
display_name_attributes	Ordered list of attributes to use as this object type's display name. The first attribute with a value on a given entry is used.
reference_attributes	Attributes on this object type that reference another object type. See below.	{}

enrichment.ldap reference attribute properties

Configured per attribute under enrichment.ldap.object_types.<name>.reference_attributes.<attribute>, for example enrichment.ldap.object_types.group.reference_attributes.member.

Name	Description	Default	Mandatory
value_object_type	The object type referenced by this attribute's values. Must also be defined under object_types.
identity_bearing	If true, a change to this attribute is attributed to the referenced value instead of the entry the write targeted.	false

Enrichment performs a live directory lookup per changed entry, using the same destination that made the original write. If a lookup fails — the entry was deleted, or the directory is unreachable — the raw change is still recorded; only the enriched values are missing.

Authentication

The audit UI's static assets are public by default (public: true) — access control belongs to the network or gateway, not the module itself. The REST API has no built-in authentication of its own; deploy it behind an authenticated gateway or reverse proxy, or restrict network access, rather than relying on the module for access control.

In this section

• Data model
• Using the audit UI
• API reference