Skip to main content
Every decision Halite’s policy engine makes — allow or deny — is written to the audit log. This includes user logins, Salt command dispatches, key operations, settings changes, and any action that passes through a require_perm check. You can browse, paginate, and filter the log from the Audit page. For a conceptual explanation of what gets recorded and when, see Audit Log.
Table of audit entries with timestamp, user, action, resource, decision, and result code columns

Audit log table showing recent authorization decisions

​
Audit entry fields

Each entry in the log has the following fields (from AuditEntry in audit/models.py):

​
Browsing and filtering

The audit log endpoint is GET /api/audit. Results are sorted by at descending (newest first) and paginated.

​
Query parameters

​
UUID
Filter to entries created by a specific Halite user.
​
string
Filter to entries with an exact action name (e.g. salt.run).
​
string
Filter to entries with a specific decision. Use allow or deny.
​
datetime (ISO 8601)
Return entries at or after this timestamp (inclusive lower bound on at).
​
datetime (ISO 8601)
Return entries strictly before this timestamp (exclusive upper bound on at).
​
integer
default:"50"
Number of entries to return. Range: 1–500.
​
integer
default:"0"
Number of entries to skip for pagination.

​
Example: reviewing recent denied requests

This returns the 50 most recent deny decisions — useful for spotting permission misconfigurations or unauthorized access attempts.

​
Example: auditing a specific user’s actions

Returns all audit entries for the given user since 1 January 2025.

​
Example: finding all Salt jobs dispatched in a time window

Returns every salt.run action recorded during business hours on June 1st, with the salt_jid field identifying each dispatched job.

​
Permissions

The built-in viewer role does not include view:audit:*. Access to the audit log is restricted to the admin role (and any custom role you explicitly grant view:audit:*). This is intentional — the audit log contains user IDs and request arguments that may be sensitive.