Audit & activity logs
The control-plane record of who did what across your organization, and how long it is retained.
The activity log is Relay's control-plane audit trail: every action taken against your Relay resources. Filter, search, and inspect events across the organization.
Events cover create/update/delete and membership changes across resources such as workspaces, roles, role bindings, connections, connection groups, access grants, policies, teams, members and invitations, agents and their replicas, enrollment tokens, API keys, SSO, the IP allowlist, private endpoints, cloud integrations, backups, backup schedules, and databases — plus system lifecycle events (e.g. snapshot started/completed/failed).
Retention
The activity log on this page is not purged automatically: its entries are kept indefinitely.
Retention applies to the per-query query audit. By default it is kept indefinitely. An organization can set a retention window, and the plan sets the longest window allowed; once a window is set, query-audit entries older than it are deleted (the job runs hourly).
| Plan | Longest window you can set |
|---|---|
| Free | 7 days |
| Team | 30 days |
| Business | 1 year |
| Enterprise | Custom |
The window is the audit_retention_days field of the organization update API.
There is no dashboard or CLI control for it yet.
Stream to your SIEM
Both the activity log and the query audit can be pushed to a SIEM within seconds through log destinations: an HTTPS webhook (signed NDJSON), Splunk HEC, Datadog Logs, or syslog over TLS. Delivery is at least once, with a cursor that survives restarts, and each event keeps its hash-chain fields where the trail is chained. See Integrations → Log destinations.
Each activity event is one JSON object with schema: relay.activity.v1:
timestamp, actor_id, actor, action, resource_type, resource_name,
resource_id, metadata, origin, ip_address, id, organization_id,
workspace_id, and, when chained, chain_seq, prev_hash and row_hash.
Query audit events use schema: relay.audit.v1. Ignore fields you do not know:
new ones may be added.
For agents, resource_type keeps the older names: an
agent_pool resource is an agent, and an agent resource is one of its
replicas.
Activity log vs. query audit
- Activity log (this page) — the control plane: who changed what in Relay.
- Query audit — the data plane: every SQL query proxied through Relay.