📋Audit Events

The Audit Events tab gives you a full log of administrative actions taken within your Arnica org. Use it to track who changed what and when — across policies, integrations, user access, and more.

Reading the Table

Each row represents a single event and shows:

• Timestamp — when the event occurred.

• Event Action — the type of action taken (see below).

• Event Domain — the area of the product the action affected.

• User — the display name and email of the person who performed the action, or the API token name if the action was taken via API.

• Resource Type — the type of resource that was affected.

• Description — a human-readable summary of the event that includes the resource ID and, when available, the resource name.

The Audit Events table lists all administrative actions taken within your org

Resource names are captured when an event occurs. Renaming or deleting a resource does not change its name in earlier events. Older events, or events where a name could not be resolved, may show only the resource ID.

Event Actions

Actions are color-coded for quick scanning:

Action	Color	Meaning
CREATE	Green	A new resource was created
UPDATE	Orange	An existing resource was modified
DELETE	Red	A resource was deleted

Event Domains

Events are grouped into the following domains:

• Authentication — sign-in and sign-out activity.

• Authorization — permission and access control changes.

• Policy — policy creation and updates.

• Product — product configuration changes.

• Integration — integration setup and changes.

• API — API key operations.

• AI — AI configuration interactions.

Known Behaviors

Deleting a policy rule appears as UPDATE

When you remove a rule from a policy, the event is recorded as UPDATE rather than DELETE. This is because Arnica stores each policy as a single object — removing a rule modifies that object rather than deleting a standalone resource. To see exactly which rule was removed, expand the event row and check the before/after diff.

Viewing Changes

Click any row to expand it and see a side-by-side before/after diff of the affected resource. Modified fields are highlighted and unmodified sections are collapsed.

Expanding a row reveals the exact fields that changed

Sensitive fields are automatically redacted before events are stored, so credentials and secrets will never appear in the diff view.

Filtering

Use the filter icon on each column header to narrow down results:

• Timestamp — filter by date range, with quick presets for the last 7, 30, or 90 days.

• Event Action — filter by action type (CREATE, UPDATE, DELETE).

• Event Domain — filter by domain.

• User — search by email or display name.

Exporting

Click the export icon in the top right of the table to download the audit log as a CSV. Exports include all event data including the full before/after change values. Up to 50,000 rows can be exported at once.