Audit details
Select an entry in the audit log to open Audit event. The page shows the event title, outcome, and timestamp including seconds, followed by the details recorded for that event.
Outcome and decision source
Section titled “Outcome and decision source”The outcome describes this stage of the operation:
| Outcome | Meaning |
|---|---|
| Received | A request arrived. |
| Approved | An operation or review was approved. |
| Denied | Secret use, signing, or authentication was refused. |
| Rejected | A pairing, upload, or invalid request was rejected. |
| Aborted | The client stopped the request. |
| Completed | The recorded operation or confirmation completed. |
| Changed | A setting or stored item changed. |
| Failed | An operation, review, or confirmation failed. |
| Needs user review | AI review deferred the decision to you, including when AI review was inactive. |
Read the event title together with the outcome. An approved AI review and a confirmed signature delivery are different events, even when they belong to the same request.
When relevant, the page identifies the decision source: you, approval settings, AI review, temporary access, multiple approval sources, non-sensitive data, or request validation. Temporary-access events show their recorded expiry time; a historical expiry does not establish that a grant is still active now.
Event context
Section titled “Event context”Only fields relevant to the selected event are shown. Available details include:
- Secret use: the client, requested secrets, command and arguments, working directory, reason, variable delivery, missing secrets, and reported client system.
- Git signing: the signing key, signed content, and available repository context.
- SSH authentication: the key, authentication method, signature algorithm, and available host-key fingerprint and algorithm.
- Uploads: the requested upload action, uploaded and saved names, secret type, supplied description, variable names and sensitivity, public-key details, and any upload problem.
- Pairing and client changes: pairing address, verification-code result, client state, reported system information, and changes to names or instructions.
- Secret and approval changes: affected secret or variable, old and new settings when recorded, instructions, variable sensitivity and value-change indicators, or public-key information.
AI events show the review decision, explanation, or problem. If the app could not apply the review result because its inputs changed, the event can also show the decision and explanation that were actually applied. Completion events can include the client’s result, reason, message, and transport error.
Git signing content is stored in the audit event as text. For binary content, use the request’s exact content view; the audit text can contain replacement characters where bytes could not be decoded as UTF-8.
These are recorded facts from the time of the event, rather than a lookup of today’s client or secret settings. Sensitive environment values and private SSH keys are excluded from structured secret data; non-sensitive values and other supplied request text can appear.
Copy the event
Section titled “Copy the event”Expand Technical information · JSON to inspect the complete stored event, including fields not included in the readable summary. Copy event JSON copies that event to the Android clipboard.
The JSON includes the event sequence, timestamp, event type, outcome, available decision source, recorded client and request IDs, and event-specific data. It can contain additional context such as the remote SSH username or full AI review input. Timestamps in the JSON use milliseconds since the Unix epoch. Related request IDs let you connect receipt, review, decision, and confirmation events; an original invocation ID can connect a signature to the command that led to it.
The readable text is also selectable for copying individual details. Copying an event does not send it anywhere automatically.