Audit log

Guapocado records an append-only audit entry for every mutating action, so you can answer “who changed what, when, and with which token.”

Each entry captures:

• the action (e.g. usage.consume, subscription.change, config.push, apikey.create, contract.create)
• the actor — which API key (id + prefix…last4) or dashboard user
• the resource type and id
• the request id, mode (test/live), IP, and a JSON metadata payload
• a timestamp

Reading the log

const { logs, hasMore, nextCursor } = await guap.audit.list({
  action: "usage.consume", // optional filters
  resourceType: "meter",
  resourceId: "api-calls",
  actorId: "key_123",
  limit: 50,
  cursor: previousNextCursor,
});

Over HTTP:

GET /v1/audit?action=config.push&limit=50

What’s recorded

Mutating paths are audited, including config push (with a config fingerprint and key-level diff), API key create/revoke, subscription change/cancel, checkout, usage consume, and enterprise deal changes.

Audit writes never block the underlying operation; a failed write is logged loudly rather than silently dropped.