Audit Trail

{
  "id": "evt_01J8K3X7B4N9VQRM2P5C6WDJH4",
  "event": "secret.read",
  "actor_id": "ast_tok_7f3a...",
  "actor_type": "token",
  "actor_description": "GPT-4 inference agent",
  "resource_type": "secret",
  "resource_path": "production/openai/api-key",
  "resource_version": "v3",
  "tenant_id": "ten_abc123",
  "ip": "10.0.1.50",
  "user_agent": "agentsecretstore-python/1.2.0",
  "status": "success",
  "metadata": {
    "scope_used": "secrets:read:production/openai/*",
    "token_ttl_remaining": 2834
  },
  "timestamp": "2025-01-15T14:22:31.847Z"
}

from agentsecretstore import AgentVault
from datetime import datetime, timezone, timedelta

async def query_audit_trail():
    async with AgentVault() as vault:
        # Get all reads in the last 24 hours
        events = await vault.audit.query(
            event_types=["secret.read"],
            since=datetime.now(timezone.utc) - timedelta(hours=24),
        )
        for e in events:
            print(f"{e.timestamp} | {e.actor_id} read {e.resource_path}")

        # Filter by resource path (supports glob patterns)
        production_events = await vault.audit.query(
            resource_path="production/*",
            limit=100,
        )

        # Filter by actor (agent or token)
        agent_events = await vault.audit.query(
            actor_id="ast_tok_7f3a...",
            event_types=["secret.read", "token.issued"],
        )

        # Filter by event outcome
        failed_reads = await vault.audit.query(
            event_types=["secret.read"],
            status="denied",
            since=datetime.now(timezone.utc) - timedelta(days=7),
        )

        print(f"Denied reads in last 7 days: {len(failed_reads)}")

import { AgentVault } from '@agentsecretstore/sdk';

const vault = new AgentVault();

// Check for anomalous access patterns
const suspiciousReads = await vault.audit.query({
  eventTypes: ['secret.read'],
  resourcePath: 'production/stripe/*',
  since: new Date(Date.now() - 3600_000), // last hour
});

if (suspiciousReads.length > 100) {
  console.warn(`Unusual spike: ${suspiciousReads.length} Stripe reads in the last hour`);
}

// Export CSV for compliance team
const csvBlob = await vault.audit.export({
  since: new Date('2025-01-01'),
  until: new Date('2025-03-31'),
  format: 'csv',
});

# List recent events — newest first
curl https://api.agentsecretstore.com/v1/audit \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -G \
  --data-urlencode "event_types=secret.read,token.issued" \
  --data-urlencode "since=2025-01-01T00:00:00Z" \
  --data-urlencode "limit=50"

# Filter by resource path
curl https://api.agentsecretstore.com/v1/audit \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -G \
  --data-urlencode "resource_path=production/stripe/*"

# Export to CSV (response is CSV content)
curl https://api.agentsecretstore.com/v1/audit/export \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -H "Accept: text/csv" \
  -G \
  --data-urlencode "since=2025-01-01T00:00:00Z" \
  -o audit-export.csv

# SOC 2 evidence: all access to critical-tier secrets in Q1 2025
curl https://api.agentsecretstore.com/v1/audit/export \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -H "Accept: text/csv" \
  -G \
  --data-urlencode "since=2025-01-01T00:00:00Z" \
  --data-urlencode "until=2025-03-31T23:59:59Z" \
  --data-urlencode "resource_tier=critical" \
  -o soc2-q1-critical-access.csv

# HIPAA audit: all reads by a specific agent in a date range
curl https://api.agentsecretstore.com/v1/audit/export \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -H "Accept: text/csv" \
  -G \
  --data-urlencode "actor_id=ast_agent_hipaa_processor" \
  --data-urlencode "since=2025-01-01T00:00:00Z" \
  -o hipaa-agent-audit.csv

# Incident investigation: everything that happened to a compromised key
curl https://api.agentsecretstore.com/v1/audit \
  -H "Authorization: Bearer $ASS_AGENT_KEY" \
  -G \
  --data-urlencode "resource_path=production/stripe/secret-key" \
  --data-urlencode "since=2024-12-01T00:00:00Z"