Important

New database features are no longer connected to engine versions; features are now enabled independently during scheduled update windows, and “major” and “minor” releases no longer exist in Helios. Please visit the release notes to view the latest features available in your database clusters.

Control Plane Audit Logs

Category	Event
Cluster	Create, resize, suspend, or delete a cluster Detach a database from a cluster Modify auto-suspend configuration of a cluster Create or delete private connections to a cluster
Cluster group	Create or delete a cluster group Add or update firewall rules for a cluster group Update the password Add RBAC rules at the cluster group level Change the update window for a deployment Create a database
Observability	Add, update, or remove an alert for the database operations Add, update, or remove subscribers to the alert
Cloud Portal	Generate API keys Add a user Add a RBAC property at the organization level Add a payment method Change the database admin password
Team	Create, update, or delete a team Add or delete members in a team
Authentication	User login events Add, update, or delete a SCIM connection
Notebook	Create or delete a notebook on the Cloud Portal

Access Control Plane Audit Logs

Use the AuditLogs path (/v1/auditLogs endpoint) in the Management API to access the Control Plane audit logs. For example:

Shell

curl -X 'GET' \
  'https://api.singlestore.com/v1/auditLogs' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <API_key>'

The following parameters can be used to filter the audit logs fetched from the Management API:

Parameter	Description
`type` `source` `firstName` `lastName` `email` `userID`	Returns audit log entries that match the specified value for the respective field in the audit log. Refer to Control Plane Audit Log Format for related information.
`startDate`	Returns audit log entries where the `createdAt` timestamp is greater than the specified `startDate`.
`endDate`	Retrieves audit log entries where the `createdAt` timestamp is earlier than the specified `endDate`.
`limit`	Limits the number of returned audit log entries to the specified value.
`nextToken`	Returns the audit log entries generated after the specified `nextToken` value.
`sortByDescending`	If enabled, audit log entries are returned in descending order by the `createdAt` timestamp (newest first).

Refer to Management API Reference for more information.

Control Plane Audit Log Format

The Management API returns the Control Plane audit logs formatted as JSON records. For example:

JSON

{
  "nextToken": "2025-08-23T20:10:24.566869Z",
  "auditLogs": [
   {
      "orgID": "d4226b30-0000-1000-9000-e56cc36be262",
      "auditID": "9a189082-0000-1000-9000-d574adbbe889",
      "type": "WorkspaceGroupCreate",
      "source": "Portal",
      "createdAt": "2025-07-22T03:15:06.693055Z",
      "reason": "Workspace group (1baae325-0000-1000-9000-17b67a0af1ce) created in project (3c8d7c87-0000-1000-9000-feebd4f92dcf)",
      "userType": "Employee",
      "version": 0
    }
  ]}

Each Control Plane audit log entry may contain a subset of the fields listed in the following table:

Field	Description
`orgID`	ID of the organization associated with this event.
`auditID`	ID of the audit log entry.
`type`	Type of the audit log event. Refer to Audit Log Event Types for more information.
`userEmail`	Email ID of the user that triggered this event.
`userID`	ID of the user that triggered this event.
`userType`	Type of the user that triggered this event. It can have one of the following values: `Unspecified`, `System`, `Employee`, `Customer`, `Automation`, `Studio`, `CIAutomation`, `SharedTier`, `SNIProxy`, `NimbusGateway`, or `Cluster`.
`workspaceID`	ID of the cluster associated with this event.
`projectID`	ID of the project associated with this event.
`sessionID`	ID of the authorization session associated with this event.
`teamID`	ID of the team associated with this event.
`source`	Source of the audit log entry. It can have one of the following values: `Portal`, `Admin`, or `SystemJob`.
`createdAt`	The timestamp (in the RFC3339Nano format) of when the audit log entry was created.
`attributes`	Additional keys and values specific to the audit log.
`error`	Error message, if any, related to this audit log entry.
`reason`	A detailed description of the event.
`firstName`	First name of a redacted user.
`lastName`	Last name of a redacted user.
`labels`	List of audit-related keywords.
`nextToken`	Timestamp of the latest audit log entry. If specified in the API call, the API only returns the audit log entries generated after the specified timestamp.

Control Plane Audit Log Event Types

The following is a list of logged event types for each category:

Category	Event Type
Notebook Management	NotebookCreate NotebookDelete
Cluster Operations	ClusterCreate ClusterTerminate
Workspace Management	WorkspaceGroupTerminate WorkspaceTerminate WorkspaceCreate WorkspaceGroupCreate	WorkspaceScale WorkspacePause WorkspaceResume WorkspaceGroupDelete
Alert Management	SubscribedAlert UnsubscribedAlert	SubscriberAlertUpdated
User Management	InvitedNewUserToPortal AddedNewUserToPortal	UserRemovedFromPortal
Team Management	TeamCreate TeamUpdate TeamDelete	TeamAddMember TeamRemoveMember
Billing & Payment	NewPaymentMethod NovaPoolBillingUpdate ComputeOverageChange BalanceCorrection	BalanceIncrease SubscriptionBundleCreated SubscriptionBundleDeleted SubscriptionBundleUpdated
Security & Access	GenerateAPIKey RevokeAPIKey WorkspaceGroupAccessGranted WorkspaceGroupAccessRevoked OrganizationAccessGranted OrganizationAccessRevoked NovaAppAccessGranted NovaAppAccessRevoked NovaServiceAPIKeyCreate NovaServiceAPIKeyRevoke	ChangeAdminDatabasePassword WorkspaceAccessGranted WorkspaceAccessRevoked AgentDomainAccessGranted AgentDomainAccessRevoked SecretAccessGranted SecretAccessRevoked NotifySAMLCertExpire UpdateOAuthIntegrationAvailability MFAMethodChange
Maintenance & Config	MaintenanceWindowUpdate AutoSuspendDisableOnResume	UpdateAutoSuspendConfiguration
Firewall Management	FirewallRuleAdded FirewallRuleUpdate	FirewallRangesUpdate
Storage Management	BottomlessRetentionPeriodUpdate
Job Scheduling	CreateScheduledJob ScheduledJobUpdate	ScheduledJobRemove
Database Operations	DatabaseCreated DatabaseDetached	DatabaseRemoved
Network & Connectivity	PrivateConnectionCreated PrivateConnectionDeleted
SCIM Integration	SCIMCreateConnection SCIMUpdateConnection	SCIMDeleteConnection
Operations API	OpsAPIRequest
Encryption Management	CMEKScheduleDeletionAlert