Audit log

The audit log records changes to the account:

• API keys created, rotated and revoked
• Sandboxes created, changed, stopped, started (also by auto-start), forked, restored and deleted
• Snapshots saved and deleted
• Public URLs and their tokens
• Environment variables, secret files and the setup
• Webhooks, SSH keys and OpenTelemetry
• The plan, the wallet, auto top-up and data controls

Each entry says who did it (the API key's id and name, or session for the dashboard), when, from which IP, and the request's X-Request-Id. What froog does on its own is there too, with the actor system: sandbox.auto_stop, sandbox.lifetime_stop, sandbox.auto_delete, sandbox.disk_expired (14 days stopped), sandbox.billing_stop (the grace period ended, or the trial's hours ran out), sandbox.abuse_stop, and plan changes that come from Stripe (billing.plan_synced: a renewal, a failed payment, a cancellation. billing.plan_ended). It is kept 90 days. Reads and failed requests aren't logged, nor are command runs (see command history).

$ froog audit --limit 20
$ froog audit --sandbox ci-1 --action sandbox.delete --action sandbox.auto_stop
$ froog audit --export csv > audit.csv      # every entry of the 90 days, oldest first (or ndjson)
WHEN                 ACTION                 TARGET                   BY                         IP
2026-11-12 09:14:03  api_key.revoke         key_3f2a9c1d8e7b         session (you@example.com)  203.0.113.9
2026-11-12 09:02:41  sandbox.create         ci-1                     key_8b1e0c2d4f6a (ci-bot)  198.51.100.7

API: GET /audit?limit=&cursor= answers {events: [{id, at, action, target, actor, actor_label, ip, request_id, detail}], next_cursor}, newest first (sort=asc: oldest first). Pass next_cursor as cursor for the next page. Filters: action (exact, comma-separated for several), sandbox (entries whose target is the sandbox, or one of its ports or snapshots), and since and until (unix seconds). GET /audit/export?format=csv|ndjson takes the same filters and answers every match as one file, oldest first, with the columns id, at, action, target, actor, actor_label, ip, request_id, detail. detail holds the harmless parts of the request, such as the size, labels or new name. Values of variables, files, scripts and webhook URLs are never in it. Reading the log needs account.admin, and a key limited to some sandboxes gets an empty list.