---
description: >-
  The areas of a Verda project the audit log covers today, and how to see the
  exact event types available in your log.
revision_date: 12.08.2026
---

# Supported events

The audit log covers these areas today.

| Area                            | Recorded activity                                                                                                                     |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Instances and instant clusters  | Deploy, start, shut down, delete, hibernate, spot eviction and conversion, transfer into the project, and the same actions on a single cluster node |
| Volumes and shared file systems | Create, attach, detach, clone, resize, rename, delete into **Deleted volumes**, restore, permanently delete                            |
| Object storage                  | Create and delete buckets, create and delete S3 access keys, suspend and unsuspend access when the balance runs out and recovers       |
| SSH keys                        | Add and delete SSH keys                                                                                                                |
| Cloud API credentials           | Create and delete credentials, and authenticate with them (repeated authentications from the same credential and IP coalesce into a single event per token lifetime, not one per request) |
| Startup scripts                 | Create and delete startup scripts                                                                                                      |
| Team membership                 | Invite a member, accept or revoke an invitation, change a role, remove a member                                                        |
| Billing                         | Card top-ups started, completed, and cancelled, coupon redemptions, balance transfers in and out including SEPA funding                |
| Account security                | Sign-in, sign-out, password reset, two-factor enable, disable, challenge, and verify                                                   |

New event types are added without a separate announcement, so treat the list as growing and let your tooling pass through types it does not recognize. [What is not supported yet](https://docs.verda.com/resources/audit-logs/#what-is-not-supported-yet) covers the gaps that matter today.

***

## See the exact event types in your log

The full `type` of an event follows the pattern `com.verda.api.<producer>.<object_type>.<action>.v1`, for example `com.verda.api.cloud.compute.delete.v1`. Actions on one node of an instant cluster use a `node_` prefix, such as `com.verda.api.cloud.compute.node_shutdown.v1`.

Two ways to see what your own project produces, without guessing from this page:

* In the console, open **Audit logs** and use **Filter by**. It lists the object types and actions available.
* Through the API, read a page without filters and look at the `type` and `data` of the events that come back. See [Public API](https://docs.verda.com/resources/audit-logs/public-api/).

***

## Fields worth knowing

Payloads embed the object the event is about and reference related objects by id. Beyond that, a few fields answer common questions:

| Field                     | On                        | Meaning                                                                                                        |
| ------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------- |
| `actor_id`                | Any user-triggered event  | The user who performed the action. Absent when the platform acted on its own, for example a spot eviction, an automatic top-up, or an object storage suspend or unsuspend |
| `discontinue_reason`      | `compute` delete events   | Why the instance is gone: `by_user_action`, `by_admin`, `evicted_by_on_demand`, or a failed deployment such as `no_capacity` or `quota_error` |
| `direction` and `source`  | `balance` transfer events | `credit` into the project or `debit` out of it, funded by `bank_transfer` or another `balance`                   |
| `service`                 | `volume` events           | The internal component that made the change, which tells you whether a volume was touched directly or as part of an instance action |

Secrets are never recorded. Client secrets, S3 secret keys, SSH public keys, and passwords do not appear in any event.

!!! info
    Field names inside `data` may still change while the audit log is in Beta. The CloudEvents envelope fields (`specversion`, `id`, `source`, `subject`, `type`, `time`) are stable.