Audit and insights

Authio keeps two records of everything that happens in your account: an access trail of every authentication attempt and a change trail of every administrative change. The console reads both through filters, rankings and charts computed on the server, streams sign-ins live, and sums the account up on the dashboard and in the notifications inbox.

All of it is scoped to your account: whatever realm or filter you ask for, you only ever see the activity of realms you own.

Two trails

Reading either trail requires the audit:read permission. Records past their retention are deleted automatically once a day.

The access trail

Each attempt is recorded with who made it, from where, with what credential and how it ended:

The grant types recorded are Password, ClientCredentials, PersonalAccessToken, AuthorizationCode, ApiKey, RefreshToken, TokenExchange, DeviceCode, Federated and Unknown. Federated marks a sign-in through an external provider that the hosted login then refused: a suspended or inactive account, no access to the client, an address not yet approved or a second factor rejected.

Reading it

• The overview shows the period’s key figures against the previous period of the same length, what was used and where it came from, and a heat map of when sign-in is attempted by day and hour.
• Rankings by grant type, realm, client, resource server, identity and IP address are clickable: each one becomes a filter.
• The pulse shows successes and failures per day; click a day to narrow the period to it.
• Records are paginated (5, 10, 25 or 50 per page). Each opens a detail panel with every field above, and a failed attempt offers Open in Wire Bench, already set up with its client and grant, to reproduce it.

The change trail

Every POST, PUT, PATCH and DELETE to the Admin API is recorded automatically after it runs, whether it came from the console or from your own tooling. Because recording happens in one place rather than endpoint by endpoint, a new part of the API is audited from the day it ships.

• Actions are Create, Update, Delete and Impersonate.
• Each record holds the action, the kind and id of the resource, the realm and client, the author (id, name and e-mail), IP address, user agent, HTTP method, path, status code, whether it succeeded, the reason it failed and the request id.
• A secret rotation also records details: its mode (Immediate, Overlap or Compromise), previous_value_valid_until and issued_tokens_revoked_before. See Rotating secrets.
• Rejected attempts are recorded too, with their reason: a run of refused deletions is exactly what an audit wants to see.
• Reads are not recorded, and neither are writes that change no configuration, such as pinning a favourite, marking notifications as read or asking the AI advisor a question.

The overview counts changes, deletions, applied and rejected changes, ranks them by action, resource kind, realm and author, and shows when changes are made by day and hour.

Filter and export

• The period is 24 hours, 7, 30 or 90 days, or days you pick on the calendar. The trails open on the last 30 days.
• Search by user, address, client or resource, or paste a request id to find a single call. Outcome, grant type and resource server narrow the access trail; the action narrows the change trail.
• Realm, period and search stay in place when you switch between Access and Changes.
• The screens of a resource server, a connection provider and an identity provider link to the access trail already filtered to them.
• Export CSV downloads the whole filtered trail, not only the page on screen, as access-logs-{date}.csv or audit-trail-{date}.csv.

Live Auth Stream

Live Auth Stream shows sign-ins, token issuance and failures across every realm you own as they happen. Narrow it to one client, pause it, and open a failed event in Wire Bench to reproduce it. It keeps the latest 200 events and does not fill gaps: what happens while it is paused or disconnected is not shown there, so use the access trail for anything you need to look back on.

Activity where you work

You rarely need the full trail to answer a question about one thing. The Activity tab of a realm gathers its sign-in activity, open sessions, delegations and webhooks; the Activity tab of a client does the same for that application. Every activity list opens on its 5 most recent entries, pages through the rest at 5, 10, 25 or 50, and narrows to 24 hours, 7, 30 or 90 days, or to days you pick.

The dashboard

The Dashboard is where everyone lands after signing in. Each block appears only to people allowed to read what it shows, and a block that fails to load says so with a retry instead of showing zeros.

Notifications

Authio checks your account every hour, and again whenever a watched resource changes, and raises a notification in Notifications when something needs you. A condition — a secret about to expire, a disabled webhook — stays open while it holds and clears itself once it stops. An event — a revoked key, a reused refresh token — stays until someone closes it. Marking a notification as read only records that it was seen.

Notifications always appear in the inbox. The account owner chooses in Preferences whether they also go out by e-mail (on by default, to the account’s address unless another is given) and by webhook, and can switch a kind off entirely, which stops it being raised at all.

Reading the trails from the API

The same data is available to your own tooling through the Admin API, with the audit:read permission:

Ask in plain language

When your plan includes the AI advisor, the access trail accepts a question such as “failures on the storefront yesterday afternoon” and turns it into filters you can see and undo. With a single realm chosen, Read this period asks the advisor whether the failures look like a setting of yours or like credentials being tried. Both are described in Authio AI.

Next steps