Every decision Halite’s policy engine makes — allow or deny — is written to the audit log. This includes user logins, Salt command dispatches, key operations, settings changes, and any action that passes through aDocumentation Index
Fetch the complete documentation index at: https://www.halite-app.com/llms.txt
Use this file to discover all available pages before exploring further.
require_perm check. You can browse, paginate, and filter the log from the Audit page.
For a conceptual explanation of what gets recorded and when, see Audit Log.
Audit entry fields
Each entry in the log has the following fields (fromAuditEntry in audit/models.py):
| Field | Type | Description |
|---|---|---|
id | integer | Auto-incrementing primary key |
at | datetime | Timestamp of the event (timezone-aware) |
user_id | UUID or null | The Halite user who triggered the action; null for unauthenticated requests |
action | string | Dot-separated action name (e.g. salt.run, user.create, settings.salt.update) |
resource | string | The resource path the action targeted (e.g. minion:*, user:alice) |
args_json | object or null | The request arguments — passwords are redacted to "<redacted>" |
salt_jid | string or null | The Salt JID if the action dispatched a Salt job |
decision | string | "allow" or "deny" |
result_code | integer | HTTP status code of the response |
duration_ms | integer | Request processing time in milliseconds |
Browsing and filtering
The audit log endpoint isGET /api/audit. Results are sorted by at descending (newest first) and paginated.
Query parameters
Filter to entries created by a specific Halite user.
Filter to entries with an exact action name (e.g.
salt.run).Filter to entries with a specific decision. Use
allow or deny.Return entries at or after this timestamp (inclusive lower bound on
at).Return entries strictly before this timestamp (exclusive upper bound on
at).Number of entries to return. Range: 1–500.
Number of entries to skip for pagination.
Example: reviewing recent denied requests
deny decisions — useful for spotting permission misconfigurations or unauthorized access attempts.
Example: auditing a specific user’s actions
Example: finding all Salt jobs dispatched in a time window
salt.run action recorded during business hours on June 1st, with the salt_jid field identifying each dispatched job.
Permissions
| Route | Required permission |
|---|---|
GET /api/audit | view:audit:* |