Skip to main content
When audit logging is enabled, KiwiFS records every API request as a structured entry. Use audit logs for compliance, debugging, and understanding how agents and users interact with your knowledge base.

​
Enabling audit logging

.kiwi/config.toml
Without this setting, the audit endpoint returns 501 Not Implemented.

​
Querying the audit log

​
string
ISO 8601 timestamp. Defaults to the last 24 hours.
​
integer
default:"100"
Maximum entries to return (max 10,000).

​
Entry fields

​
Use cases

Audit logs provide a tamper-evident record of who accessed or modified knowledge. Filter by actor or token_hash to trace activity by a specific agent or user.
When an agent writes unexpected content, query the audit log by time range and actor to reconstruct the sequence of API calls.
Use duration_ms to identify slow requests. Combine with Prometheus metrics for dashboards.
The X-Space header is also recorded when present, allowing you to trace cross-space operations in multi-space deployments.

Configuration

Enable audit logging in config.toml.

Optional features

Feature matrix — audit requires explicit opt-in.

Utilities API

REST endpoint details.
Last modified on May 31, 2026