Audit activity
See which key touched which route, how GearDex answered, and where a failed request came from.
GearDexStudio consoleActivity
Studio API audit log
What is recorded
GearDex writes an audit entry for Studio API requests and key management actions. Request entries pair the route and method with the key, required scope, HTTP result, and authentication result.
| Name | Type | Description |
|---|---|---|
event_type | string | The action, such as api_request, key_create, key_revoke, or key_list. |
api_key_id / api_key | string / object | The key ID plus its display name and safe prefix, when a key applies. |
route / method | string | The requested API route and HTTP method. |
scope | scope | The permission checked for the request. |
status_code | number | The HTTP result returned to the caller. |
auth_code | string | The authentication outcome or error code. |
ip_address | string | The source IP address recorded for the request. |
user_agent | string | The client user-agent value, when supplied. |
metadata | JSON | Extra request context, including request IDs where available. |
created_at | timestamp | When GearDex recorded the event. |
Event types
| Name | Type | Description |
|---|---|---|
api_request | Request | A Studio API route received a request. |
key_create | Key management | A workspace member created a new Studio key. |
key_revoke | Key management | A workspace member revoked a Studio key. |
key_list | Key management | A workspace member opened the API key list. |
Read activity
Audit activity belongs to the signed-in GearDex workspace. It is not a bearer-key route in the public Studio API. Open Settings and choose API & Agents to inspect activity through the authenticated dashboard.
Audit activity response shape
{
"logs": [
{
"event_type": "api_request",
"method": "GET",
"route": "/api/studio-agent/v1/gear",
"scope": "gear:read",
"status_code": 200,
"created_at": "2026-08-02T19:48:22.000Z"
}
],
"pagination": {
"limit": 25,
"returned": 1
}
}Investigation workflow
- Start with the time, route, method, and status code reported by the integration.
- Match the key name and request ID to the corresponding audit entry.
- Check the required scope and authentication code before changing permissions.
- Compare the source IP and user agent with the expected service.
- Revoke the key if its origin or request pattern is unfamiliar.
Privacy and retention
Audit entries can contain IP addresses, user-agent strings, route names, and request metadata. Limit access to workspace members who need operational or security visibility, and avoid placing secrets or sensitive client data in query strings.