Supported events¶
The audit log covers these areas today.
| Area | Recorded activity |
|---|---|
| Instances and instant clusters | Deploy, start, shut down, delete, hibernate, spot eviction and conversion, transfer into the project, and the same actions on a single cluster node |
| Volumes and shared file systems | Create, attach, detach, clone, resize, rename, delete into Deleted volumes, restore, permanently delete |
| Object storage | Create and delete buckets, create and delete S3 access keys |
| Credentials and keys | Add and delete SSH keys, create and delete Cloud API credentials, each token request made with them, create and delete startup scripts |
| Team membership | Invite a member, accept or revoke an invitation, change a role, remove a member |
| Billing | Card top-ups started, completed, and cancelled, coupon redemptions, balance transfers in and out including SEPA funding |
| Account security | Sign-in, sign-out, password reset, two-factor enable, disable, challenge, and verify |
New event types are added without a separate announcement, so treat the list as growing and let your tooling pass through types it does not recognize. What is not supported yet covers the gaps that matter today.
See the exact event types in your log¶
The full type of an event follows the pattern com.verda.api.<producer>.<object_type>.<action>.v1, for example com.verda.api.cloud.compute.delete.v1. Actions on one node of an instant cluster use a node_ prefix, such as com.verda.api.cloud.compute.node_shutdown.v1.
Two ways to see what your own project produces, without guessing from this page:
- In the console, open Audit logs and use Filter by. It lists the object types and actions available.
- Through the API, read a page without filters and look at the
typeanddataof the events that come back. See Public API.
Fields worth knowing¶
Payloads embed the object the event is about and reference related objects by id. Beyond that, a few fields answer common questions:
| Field | On | Meaning |
|---|---|---|
actor_id |
Any user-triggered event | The user who performed the action. Absent when the platform acted on its own, for example a spot eviction or an automatic top-up |
discontinue_reason |
compute delete events |
Why the instance is gone: by_user_action, by_admin, evicted_by_on_demand, or a failed deployment such as no_capacity or quota_error |
direction and source |
balance transfer events |
credit into the project or debit out of it, funded by bank_transfer or another balance |
service |
volume events |
The internal component that made the change, which tells you whether a volume was touched directly or as part of an instance action |
Secrets are never recorded. Client secrets, S3 secret keys, SSH public keys, and passwords do not appear in any event.
Info
Field names inside data may still change while the audit log is in Beta. The CloudEvents envelope fields (specversion, id, source, subject, type, time) are stable.