Audit logs capture security-relevant actions across users, agents, and system configuration.

What Is Logged

Bruce records structured audit events for actions including, but not limited to:

Authentication and Access

User login and logout events
API key creation, rotation, and revocation
Permission and role changes

Agent Lifecycle

Agent creation, update, and deletion
Configuration changes to agents
Enablement and disablement of agents

Operational and Administrative Activity

Chats with Bruce (all conversations are logged)
CRM actions (creates, updates, reads, and deletes in connected CRM systems)
Agent execution and system-initiated actions
Administrative changes affecting customer data or configuration
Security-relevant system events

Event Structure

Each audit event includes:

Timestamp in ISO 8601 format
Event type
Acting user ID or system actor
Affected agent or resource ID
Associated metadata relevant to the action

Event Type Catalog

Bruce logs the following event types, organized by category:

Category	Event Type	Description
Authentication	user.login	User successfully authenticated
Authentication	user.logout	User session terminated
Authentication	api_key.created	New API key generated
Authentication	api_key.rotated	API key rotated
Authentication	api_key.revoked	API key revoked
Authorization	permission.granted	Permission granted to user
Authorization	permission.revoked	Permission revoked from user
Authorization	role.changed	User role modified
Agent	agent.created	New agent created
Agent	agent.updated	Agent configuration modified
Agent	agent.deleted	Agent removed
Agent	agent.enabled	Agent activated
Agent	agent.disabled	Agent deactivated
Agent	agent.executed	Agent execution started
Chat	chat.started	Chat session initiated with Bruce
Chat	chat.message	Message sent in chat (user or system)
Chat	chat.ended	Chat session terminated
CRM	crm.record.created	Record created in CRM (contact, deal, account, etc.)
CRM	crm.record.updated	Record updated in CRM
CRM	crm.record.read	Record read from CRM
CRM	crm.record.deleted	Record deleted from CRM
System	audit_log.accessed	Audit log accessed (meta-event)

Immutability and Integrity

Audit logs are append-only.

Audit events cannot be modified or deleted through any API or user interface.
Logs are stored separately from operational application data.
No user, including administrators, can alter historical audit records.

This ensures audit trails remain reliable for forensic analysis, investigations, and compliance reviews.

Access Controls

Audit logs are scoped at the organization level.
Only authorized users within an organization can access audit logs.
Access is restricted based on role and permissions.
Users can only view audit events generated within their own organization.
All access to audit logs is itself logged.

Retention

Audit logs are retained for a minimum of 12 months by default.
Extended retention periods are available for Enterprise plans upon request.
Customers may export audit logs at any time during the retention period.

How Customers Can Access Audit Logs

Bruce provides multiple ways for customers to access, review, and export audit logs based on their operational and security needs.

Web User Interface

Audit logs are available directly in the Bruce dashboard. Events are logged in near real-time (typically within seconds of occurrence). The Web UI allows customers to:

View audit events in near real-time
Search and filter logs by user, agent, event type, and date range
Review activity during security investigations or internal audits

The Web UI is designed for security reviews, compliance checks, and operational monitoring.

Audit Log API

Audit logs are also accessible via a dedicated API endpoint. The API provides:

Programmatic access to audit events
Paginated responses for large log volumes
Filtering by user ID, agent ID, event type, and date range

Audit data is returned in JSON format and is suitable for ingestion into SIEM, logging, and monitoring systems.

bash

GET /api/v1/audit?page=1&page_size=50&start_date=2024-01-01&end_date=2024-01-31

Full API Documentation

For complete API reference, including all query parameters, response schemas, and authentication details, see the Audit Logs API documentation.

Example Response

The API returns paginated audit events in the following JSON structure:

json

{
  "items": [
    {
      "id": "evt_abc123xyz",
      "timestamp": "2024-01-15T10:30:45.123Z",
      "event_type": "agent.created",
      "actor": {
        "type": "user",
        "id": "user_123",
        "email": "admin@example.com"
      },
      "resource": {
        "type": "agent",
        "id": "agent_456",
        "name": "Sales Outreach Agent"
      },
      "metadata": {
        "agent_type": "outbound",
        "configuration_changes": ["enabled_email_tracking"]
      },
      "organization_id": "org_789"
    },
    {
      "id": "evt_def456uvw",
      "timestamp": "2024-01-15T10:31:12.456Z",
      "event_type": "api_key.rotated",
      "actor": {
        "type": "user",
        "id": "user_123",
        "email": "admin@example.com"
      },
      "resource": {
        "type": "api_key",
        "id": "key_abc"
      },
      "metadata": {
        "key_name": "Production API Key",
        "rotation_reason": "scheduled"
      },
      "organization_id": "org_789"
    }
  ],
  "total": 1250,
  "page": 1,
  "page_size": 50,
  "total_pages": 25
}

Sample Audit Events

Below are example audit events for common scenarios:

User Login Event

json

{
  "id": "evt_login_001",
  "timestamp": "2024-01-15T14:22:33.789Z",
  "event_type": "user.login",
  "actor": {
    "type": "user",
    "id": "user_789",
    "email": "john.doe@example.com"
  },
  "resource": {
    "type": "session",
    "id": "session_abc123"
  },
  "metadata": {
    "ip_address": "192.168.1.100",
    "user_agent": "Mozilla/5.0...",
    "authentication_method": "sso"
  },
  "organization_id": "org_789"
}

Agent Configuration Change

json

{
  "id": "evt_agent_update_002",
  "timestamp": "2024-01-15T15:45:12.234Z",
  "event_type": "agent.updated",
  "actor": {
    "type": "user",
    "id": "user_456",
    "email": "admin@example.com"
  },
  "resource": {
    "type": "agent",
    "id": "agent_789",
    "name": "Customer Onboarding Agent"
  },
  "metadata": {
    "changes": {
      "enabled": true,
      "max_concurrent_tasks": 10,
      "notification_settings": "updated"
    },
    "previous_config": {
      "enabled": false,
      "max_concurrent_tasks": 5
    }
  },
  "organization_id": "org_789"
}

Chat Message with Bruce

json

{
  "id": "evt_chat_003",
  "timestamp": "2024-01-15T16:20:45.567Z",
  "event_type": "chat.message",
  "actor": {
    "type": "user",
    "id": "user_789",
    "email": "john.doe@example.com"
  },
  "resource": {
    "type": "chat",
    "id": "chat_session_xyz789"
  },
  "metadata": {
    "message_type": "user",
    "message_length": 142,
    "chat_session_id": "chat_session_xyz789",
    "agent_involved": "agent_456"
  },
  "organization_id": "org_789"
}

CRM Record Update

json

{
  "id": "evt_crm_004",
  "timestamp": "2024-01-15T17:15:30.890Z",
  "event_type": "crm.record.updated",
  "actor": {
    "type": "agent",
    "id": "agent_456",
    "name": "Sales Outreach Agent"
  },
  "resource": {
    "type": "crm_record",
    "id": "deal_abc123",
    "crm_system": "salesforce",
    "record_type": "Opportunity"
  },
  "metadata": {
    "crm_action": "update",
    "fields_changed": ["Stage", "Amount", "CloseDate"],
    "previous_values": {
      "Stage": "Prospecting",
      "Amount": 50000
    },
    "new_values": {
      "Stage": "Qualification",
      "Amount": 75000
    }
  },
  "organization_id": "org_789"
}

Export and External Analysis

Customers may export audit logs at any time during the retention period. Exported logs can be used for:

Security investigations
Compliance audits
Long-term archival
Integration with external security and analytics tools

This enables customers to analyze audit data using their existing security infrastructure.

SIEM Integration

Audit logs can be exported in JSON format and integrated with SIEM platforms such as Splunk, Datadog, Sumo Logic, and others. The structured JSON format ensures compatibility with common log aggregation and analysis tools.

Monitoring and Compliance

Bruce is SOC 2 compliant and HIPAA compliant.

Audit logging supports security and governance requirements evaluated during:

SOC 2 assessments
HIPAA Security Rule reviews
Enterprise security and risk evaluations

Audit logs are designed to support incident response, operational transparency, and regulatory obligations for customers operating in regulated environments.

Questions

For additional details on audit logging, access methods, retention, or compliance, contact security@bruce.sh

Audit Logging

What Is Logged

Authentication and Access

Agent Lifecycle

Operational and Administrative Activity

Event Structure

Event Type Catalog

Immutability and Integrity

Access Controls

Retention

How Customers Can Access Audit Logs

Web User Interface

Audit Log API

Example Response

Sample Audit Events

Export and External Analysis

Monitoring and Compliance

Questions