# Audit activity

Source: https://www.geardex.app/api-docs/audit-logs

API access requires the GearDex Studio plan and a scoped Studio API key.

See which key touched which route, how GearDex answered, and where a failed request came from.

## What is recorded

GearDex writes an audit entry for Studio API requests and key management actions. Request entries pair the route and method with the key, required scope, HTTP result, and authentication result.

**GearDex API audit entry fields**

| Field | Type | Description |
| --- | --- | --- |
| `event_type` | `string` | The action, such as api\_request, key\_create, key\_revoke, or key\_list. |
| `api_key_id / api_key` | `string / object` | The key ID plus its display name and safe prefix, when a key applies. |
| `route / method` | `string` | The requested API route and HTTP method. |
| `scope` | `scope` | The permission checked for the request. |
| `status_code` | `number` | The HTTP result returned to the caller. |
| `auth_code` | `string` | The authentication outcome or error code. |
| `ip_address` | `string` | The source IP address recorded for the request. |
| `user_agent` | `string` | The client user-agent value, when supplied. |
| `metadata` | `JSON` | Extra request context, including request IDs where available. |
| `created_at` | `timestamp` | When GearDex recorded the event. |

## Event types

**GearDex API audit event types**

| Event | Kind | Recorded when |
| --- | --- | --- |
| `api_request` | Request | A Studio API route received a request. |
| `key_create` | Key management | A workspace member created a new Studio key. |
| `key_revoke` | Key management | A workspace member revoked a Studio key. |
| `key_list` | Key management | A workspace member opened the API key list. |

## Read activity

Audit activity belongs to the signed-in GearDex workspace. It is not a bearer-key route in the public Studio API. [Sign in](https://www.geardex.app/signin), open **Settings**, and choose **API & Agents** to inspect activity through the authenticated dashboard.

Dashboard authentication

The internal activity request defaults to 25 entries and accepts up to 100 per page. It uses the signed-in GearDex session, not a  `gdx_live_`  key.

**Audit activity response shape**

```json
{
  "logs": [
    {
      "event_type": "api_request",
      "method": "GET",
      "route": "/api/studio-agent/v1/gear",
      "scope": "gear:read",
      "status_code": 200,
      "created_at": "2026-08-02T19:48:22.000Z"
    }
  ],
  "pagination": {
    "limit": 25,
    "returned": 1
  }
}
```

## Investigation workflow

1. Start with the time, route, method, and status code reported by the integration.
2. Match the key name and request ID to the corresponding audit entry.
3. Check the required [scope](https://www.geardex.app/api-docs/scopes) and [authentication code](https://www.geardex.app/api-docs/errors#authentication-codes) before changing permissions.
4. Compare the source IP and user agent with the expected service.
5. Revoke the key if its origin or request pattern is unfamiliar.

## Privacy and retention

Audit entries can contain IP addresses, user-agent strings, route names, and request metadata. Limit access to workspace members who need operational or security visibility, and avoid placing secrets or sensitive client data in query strings.

Keys are never logged

GearDex records the key identity and display name, not the raw API secret. The complete secret is shown only once when the key is created.