# Audit Log and Activity Tracking Security and compliance teams can use this guide to answer: **what did Duvo do, on whose behalf, and when?** It covers what Duvo records, where to find that data in the product, how to export it for your SIEM or compliance tooling, and what is not yet captured so you can plan compensating controls. *** ## What Gets Recorded Duvo records activity in four event families. ### Actor events Changes to who can access Duvo and how they authenticate: | Event | What is captured | | ------------------------------------ | ---------------------------------------------------------------- | | User login | User, timestamp, identity provider | | User invited to team or organization | Inviting user, invitee, role assigned, timestamp | | Role changed | Acting user, target user, old role, new role, timestamp | | Connection added or removed | User, connection type, team, timestamp | | Login or secret created or rotated | User, secret name (never the value), assignment scope, timestamp | | API key created or revoked | Creating user, key name, timestamp | ### Builder events Changes to automation configuration: | Event | What is captured | | ---------------------------- | -------------------------------------------------- | | Assignment created | User, assignment name, team, timestamp | | SOP edited | User, assignment, version number, timestamp | | Assignment published | User, assignment, version promoted, timestamp | | Schedule enabled or disabled | User, assignment, interval, timestamp | | Trigger added or removed | User, assignment, trigger type, timestamp | | Assignment duplicated | User, source assignment, new assignment, timestamp | | Assignment deleted | User, assignment, timestamp | ### Job events Activity during each Job execution: | Event | What is captured | | --------------------------------- | --------------------------------------------------- | | Job started | User or trigger type, assignment, run ID, timestamp | | Tool call made | Tool name, connection, run ID, timestamp | | Human-in-the-Loop request created | Assignee, run ID, request title, timestamp | | HITL request approved or rejected | Reviewer, decision, run ID, timestamp | | Job completed | Run ID, status, duration, timestamp | | Job stopped manually | User, run ID, timestamp | ### Admin events Organizational-level changes: | Event | What is captured | | -------------------------------------- | --------------------------------------------- | | Team created | User, team name, organization, timestamp | | User removed from team or organization | Acting admin, removed user, timestamp | | Owner or Admin role assigned | Acting user, target user, new role, timestamp | | Billing plan changed | Admin, old plan, new plan, timestamp | *** ## Finding Audit Data in the Product ### Jobs List **Past Jobs** (left sidebar) is the primary place to review job-level activity. Every Job across all assignments appears here with its status, trigger source, creating user, and timestamps. Admins and Managers see the **Created by** column, which shows which team member started each Job. Use the filter bar to narrow by: * **Assignment** — activity for a specific automation * **Status** — Failed, Completed, Running, or Stopped jobs * **Created by** — activity from a specific team member (Admin and Manager only) * **Trigger** — jobs started manually, by schedule, by API, or by event trigger ### Team Insights **Team Insights** (sidebar, under Team) shows aggregated activity: run counts, completion rates, active assignments, and usage trends over time. Use this to spot sudden drops in activity or failure rate spikes across the whole team. ### Human-in-the-Loop activity All HITL approval requests, responses, and outcomes are recorded as part of the Job's message thread. Open any Job that included a HITL step to see who approved or rejected the request, when, and with what context. *** ## Exporting Audit Data ### From the Jobs List To export job-level activity: 1. Open **Past Jobs** from the sidebar. 2. Apply filters (assignment, date range, status, created by). 3. Click **Export** in the top-right corner. 4. Choose **CSV** or **JSON**. Each export row contains: assignment name, run ID, status, trigger type, created-by user, start time, end time, and duration. The run ID can then be used to retrieve the full message log via the API (see below). Download sample exports to inspect the exact field names and format: * [past-jobs-sample.csv](https://github.com/duvoai/monorepo/blob/staging/knowledge-base/user-guide/.gitbook/assets/security/past-jobs-sample.csv) * [past-jobs-sample.json](https://github.com/duvoai/monorepo/blob/staging/knowledge-base/user-guide/.gitbook/assets/security/past-jobs-sample.json) ### Via the Public API Use the API to retrieve job history and build a custom audit export pipeline. **List recent runs for your team:** ```bash curl -X GET "https://api.duvo.ai/v1/runs?limit=100&sort_by=created_at&sort_order=desc" \ -H "Authorization: Bearer dv_your_api_key" ``` Filter parameters: | Parameter | Description | | ---------- | --------------------------------------------------------------- | | `limit` | Number of runs per page (1–100, default 20) | | `offset` | Number of runs to skip for pagination | | `agent_id` | Scope to a specific assignment | | `status` | Filter by run status (completed, failed, running, stopped) | | `source` | Filter by how the run was started (api, schedule, manual, etc.) | **Get status for a specific Job:** ```bash curl -X GET "https://api.duvo.ai/v1/runs/{run_id}" \ -H "Authorization: Bearer dv_your_api_key" ``` **Get the full execution log for one Job:** ```bash curl -X GET "https://api.duvo.ai/v1/runs/{run_id}/messages?limit=100" \ -H "Authorization: Bearer dv_your_api_key" ``` The messages endpoint returns every step the assignment took — tool calls, model responses, HITL requests, and final output — in chronological order. *** ## Integrating with a SIEM or Observability Tool Duvo does not currently have a native push connector for SIEM tools (Splunk, Datadog, Elasticsearch, etc.). The supported approach is a pull-based pipeline using the public API. ### Building a polling pipeline 1. Schedule a polling script (a cron job, Lambda, or Cloud Run job) that calls `GET /v1/runs` with `sort_order=asc` and an `offset` cursor to page through new Jobs since your last poll. 2. For each Job, call `GET /v1/runs/{run_id}/messages` to get the full execution log. 3. Transform and forward the results to your SIEM using its HTTP ingestion endpoint — for example, Splunk HTTP Event Collector (HEC) or the Datadog Logs API. `GET /v1/runs/{run_id}` returns a JSON object like this: ```json { "run_id": "550e8400-e29b-41d4-a716-446655440000", "assignment_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7", "assignment_name": "Invoice Processing", "status": "completed", "trigger": "schedule", "created_by": "user@example.com", "started_at": "2026-05-18T09:00:00.000Z", "completed_at": "2026-05-18T09:03:42.000Z", "duration_seconds": 222 } ``` For the full API reference, see [Running Assignments via API](/running-assignments/running-assignments-via-api.md). *** ## Retention and Access Control ### Who can view audit data | Role | Job history | Created by column | Run Debugger | Team Insights | API access | | ------- | ------------- | ----------------- | ------------ | ------------- | ------------- | | Member | Own jobs only | No | No | No | Own jobs only | | Manager | All team jobs | Yes | No | Yes | All team jobs | | Admin | All team jobs | Yes | Yes | Yes | All team jobs | | Owner | All team jobs | Yes | Yes | Yes | All team jobs | Organization Admins, Owners, and Executives have access to every team's data within the organization. For a full breakdown of role capabilities, see [Team Roles and Permissions](/teams/roles-and-permissions.md) and [Organization Roles and Permissions](/organizations/roles-and-permissions.md). ### Data retention Job history and audit data is retained for the duration of your subscription. Contact if you need a full data export or have questions about retention windows under your plan. *** ## Known Gaps Be aware of these limitations when planning compensating controls. | What you may expect | Current state | Workaround | | ---------------------------------------- | -------------------------------------------- | --------------------------------------------------------------------- | | Native SIEM push (Splunk HEC, Datadog) | Not available — pull only | Schedule a polling script that forwards runs to your SIEM (see above) | | Dedicated audit log API endpoint | Not available — use the runs API | Use `GET /v1/runs` with message logs for per-run detail | | Actor and builder event export | In-product only — not yet exportable via API | Contact for a data extract | | Per-step tool timing | Not exposed via the API | Overall Job duration is available via `GET /v1/runs/{run_id}` | | Per-step cost breakdown | Not exposed via the API | Use Team Insights for aggregated cost trends | | OpenTelemetry trace IDs in API responses | Not currently exposed | Use `run_id` as the stable correlation key in your SIEM | | Signed or tamper-evident log export | Not currently supported | Supplement with your SIEM's ingestion integrity controls | *** ## Related * [Guardrails for High-Risk Automations](/security/high-risk-guardrails.md) — Risk tiers, HITL patterns, and kill switches for sensitive assignments * [Jobs List](/running-assignments/jobs-list.md) — Filtering and monitoring all Jobs across your team * [Running Assignments via API](/running-assignments/running-assignments-via-api.md) — API reference for starting runs, polling status, and retrieving messages * [Team Roles and Permissions](/teams/roles-and-permissions.md) — Team-level roles and what each can see * [Organization Roles and Permissions](/organizations/roles-and-permissions.md) — Org-level access and which roles have cross-team visibility * [Security & Privacy](/resources/security-and-privacy.md) — Platform-level security controls, SOC 2, and data handling --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.duvo.ai/security/audit-log.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.