Audit Log

GitBlixt records security-relevant changes in an append-only audit log: who made each change, when, from which IP address, and what changed. Open it under Admin → Audit log. It needs the audit:read permission, which admins hold unless it is denied them.

What Is Recorded

• Env vars (env_var.created, .updated, .deleted, .imported): the key, and whether it is shared or belongs to one environment. Never the value.
• Environments (environment.created, .updated, .deleted): each changed setting with its old and new value, deployment protection, stops and database provisioning included; enabling or removing a managed database's extension is environment.extension_enabled or environment.extension_disabled, with its name, and turning its Track I/O timing setting on or off is environment.io_timing_enabled or environment.io_timing_disabled. Enabling or disabling an app is app.updated.
• Instance settings (setting.updated, setting.cleared): the old and new value, or only the key for secrets such as passwords and API keys.
• Permissions (permission.granted, .denied, .revoked) and admin and root status (user.admin_granted, user.admin_revoked, user.root_granted, user.root_revoked).
• User accounts: user.created, user.updated (admin edits), user.email_changed, user.deleted, user.banned, user.unbanned, user.password_changed, user.password_reset, user.totp_enabled, user.totp_disabled, user.backup_codes_regenerated and user.two_factor_reset (an admin reset someone's 2FA).
• Credentials: personal access and impersonation tokens (token.created, token.revoked) with their name and scopes, and SSH keys (ssh_key.added, ssh_key.removed) with their fingerprint, passkeys (passkey.created, passkey.deleted) with their name, and OAuth applications (oauth_app.created, oauth_app.deleted).
• Organizations and federation: quota overrides (organization.updated), the two-factor requirement (organization.require_two_factor_updated), and peers added, trusted or blocked and their public keys re-read (federation_peer.added, .updated, .key_changed).
• Backups: backup.created, backup.deleted, and backup.restored once a restore finishes.

Changes GitBlixt makes on its own, such as a deploy stopping an environment, the DATABASE_URL of a provisioned database or a scheduled backup, are not recorded. A restore and an admin or root promotion from the command line are, as system. Saving a setting without changing it records nothing. In the web UI, the IP is the one the page was loaded from.

Filtering and Export

Filter by the actor's username (in any case), by an action (user.banned) or a whole category (env_var), and by date. Export CSV downloads every entry the filters match. The REST API serves the log as GET /api/v4/audit_events in GitLab's audit event shape; created_after and created_before take an ISO 8601 date or a datetime with its offset.

Retention

Entries are kept forever and can't be edited or deleted from the UI or the API, and a database trigger refuses updates and deletes. The DB editor refuses statements that would change the log, but anyone with direct access to the database as GitBlixt's own user can still drop the trigger. Deleting a user keeps their entries, under the username they had.