Skip to main content
The audit log records one entry for each HTTP request a space serves: who made it, what they called, and how it went. Use it to review access, trace what an agent did, or find slow calls. It is off by default. The audit log covers requests. To see what changed inside a file, use versioning: every write is a git commit with its actor.

​
Turn it on

.kiwi/config.toml
Restart the server. While the log is off, GET /api/kiwi/audit returns 501.

​
File format

Entries are appended to one JSON Lines file per UTC day:
.kiwi
audit
2026-10-18.jsonl
2026-10-19.jsonl
.kiwi/audit/2026-10-19.jsonl
Every route is logged, including the web UI and static assets, except /health, /healthz, /readyz, and /metrics. Each space writes to its own .kiwi/audit/ folder.
Audit files are plain JSON Lines, not signed or hash-chained. Ship them to write-once storage if you need tamper evidence. KiwiFS does not rotate or delete them, so prune old days yourself.

​
Query the log

Terminal
​
string
RFC 3339 timestamp. Defaults to 24 hours ago.
​
integer
default:"100"
Maximum entries, from 1 to 10000. Values outside that range fall back to 100.
The response is a JSON array of entries in the same shape as the file, oldest first. To narrow by actor or status, filter the result yourself or read the files directly:
Terminal

​
Use cases

Group entries by actor and token_hash to see which keys are in use and what each one touched. Look for 401 and 403 statuses to spot misconfigured or probing clients.
Filter by the agent’s actor and a time window to reconstruct its sequence of calls. Pair it with GET /api/kiwi/versions to see the exact content each write produced.
Sort by duration_ms to find slow routes. For dashboards, scrape the Prometheus metrics at /metrics instead.

Audit log API

Endpoint reference.

Configuration

The [audit] section.

Versioning

Content history for every write.

Authentication

How actors and tokens are assigned.
Last modified on October 19, 2026