Skip to main content

​
Overview

Every security-sensitive action in PassAgent is recorded in an immutable audit log. Audit events include contextual information for forensic analysis while automatically redacting sensitive data.

​
Event schema

{
  "userId": "usr_abc123",
  "actor": "user",
  "action": "vault.travel_fortress_enable",
  "resource": "vault",
  "resourceId": "pwd_xyz789",
  "ipAddress": "203.0.113.42",
  "userAgent": "Mozilla/5.0...",
  "metadata": { "itemCount": 12 },
  "requestId": "req_correlate_123",
  "timestamp": "2026-03-04T12:00:00Z"
}

​
Tracked actions

​
Vault operations

ActionTrigger
vault.item_accessedPassword reveal or decryption
password.importedBulk password import
password.exportVault export
password.reset_initiatedAI reset flow started
password.sharedCredential shared with another user

​
Travel fortress

ActionTrigger
vault.travel_fortress_pin_setTravel PIN created
vault.travel_fortress_duress_pin_setDuress PIN created
vault.travel_fortress_enableTravel mode activated
vault.travel_fortress_disableTravel mode deactivated
vault.travel_fortress_pin_failedIncorrect PIN attempt
vault.travel_fortress_duressDuress PIN entered
vault.travel_fortress_duress_recoveredRecovery from duress
vault.travel_fortress_markItems marked for travel
vault.travel_pin_forgot_requestedPIN reset requested
vault.travel_pin_forgot_verifiedPIN reset verified
vault.travel_pin_reset_completedPIN reset completed

​
Family and sharing

ActionTrigger
family.createdFamily vault created
family.updatedFamily settings changed
family.deletedFamily vault deleted

​
Authentication

ActionTrigger
rate_limitRate limit hit
breach.checkedHIBP breach check performed

​
Metadata redaction

Sensitive keys in metadata are automatically redacted (one level deep):
  • password, token, secret, key
  • credential, authorization, cookie
These values are replaced with [REDACTED] before storage.

​
Storage and retention

  • Stored in the audit_logs Supabase table
  • Timestamps added automatically by the database
  • Request IDs enable cross-log correlation
  • Retention: minimum 365 days for compliance
  • Admin export: available via /api/admin/audit-export

​
Viewing audit logs

Navigate to Dashboard > Security to view your audit log. Filter by:
  • Action type
  • Date range
  • Resource
  • IP address