Auditing

Every state-changing call (POST, PUT, DELETE) is recorded as METHOD /path with its actor, role, outcome and request id. Routes that know better record their own action (token.create, user.role, mfa.reset, workflow.bulk_cancel, ...). The SDK gateway records sdk.job.enqueue, sdk.job.enqueue_batch (one row for a batch), sdk.workflow.start, sdk.workflow.signal, sdk.schedule.register and sdk.blueprint.register. Command-line tasks record actor cli:<user>.

The Audit page, with CSV and JSON export (mock data).

• Critical changes (tokens, roles, activation, erasure, the second factor, notification channels) write a pending intent row first; when it cannot be written the call is refused with 503.
• Never in a row: a body, a password, a token, a code or a URL. Search attribute rows name attributes, never values.
• Read it: GET /api/v1/audit?actor=&action=&outcome=success|failure|denied|pending&from=&to=&cursor=&limit= (admin), newest first. format=csv|json downloads the whole selection (at most 10,000 events) and is itself recorded (audit.export); CSV cells that start with =, +, - or @ get a leading apostrophe.
• Retention: JOOBQUI_AUDIT_RETENTION_DAYS (365 by default), purged by the holder of the retention lease.