Secret audit log

The audit log is an append-only record of every secret event — each read by an agent, and every grant and revoke. It lets you confirm a credential is being used as expected, spot unexpected access, and keep an accountability trail for sensitive secrets.

View it

Open Secrets and switch the header toggle from Secrets to Audit log. Events are grouped by day, newest first, each row showing the secret, the action (Accessed, Denied, or Error), and which agent — or skill — was involved. A row also shows whether that agent still has access right now, and clicking a row opens the related secret.

Filter

Filter the timeline by action (All, Used, Denied, Error) or by agent, and search by secret, agent, or action. If denied or errored requests spike, a suspicious activity banner summarizes them across the last hour.

Access history

For a more detailed, filterable table of every credential access — including the exact result and reason for each — open the Access History view at /secrets/audit.

Retention

Access events are kept for 90 days by default, or 1 year for secrets with extended audit retention turned on.