# Audit

Who did what, kept as a record: things created, changed, deleted, and changes to access.

Pattern: `audit.*` (this page) · Written with: [`log()`](https://www.prongs.dev/docs/profiles/logs.md) · Intents: [5](#intents) · Levels: `info`

## Intents

| Intent | Status | Use it for |
|---|---|---|
| [`audit.created`](https://www.prongs.dev/docs/intents/audit/created.md) | `info` | Someone created something that matters later: an account, a page, an API key |
| [`audit.changed`](https://www.prongs.dev/docs/intents/audit/changed.md) | `info` | Someone changed something that matters: settings, a role, a published page |
| [`audit.deleted`](https://www.prongs.dev/docs/intents/audit/deleted.md) | `info` | Someone deleted something: a page, an account, content |
| [`audit.signedin`](https://www.prongs.dev/docs/intents/audit/signedin.md) | `info` | Someone signed in, the ordinary way |
| [`audit.signedout`](https://www.prongs.dev/docs/intents/audit/signedout.md) | `info` | Someone signed out |

## Recording one

Name what happened. The intent sets the level and whether it alerts.

```ts
// Someone created something that matters later: an account, a page, an API key
log('audit.created', 'Page created', { pageId: 'p_123', by: 'u_42' });

// Someone changed something that matters: settings, a role, a published page
log('audit.changed', 'Page settings saved', { pageId: 'p_123', fields: 'theme' });

// Someone deleted something: a page, an account, content
log('audit.deleted', 'Page deleted', { pageId: 'p_123', by: 'u_42' });

// Someone signed in, the ordinary way
log('audit.signedin', 'Something happened', {  });

// Someone signed out
log('audit.signedout', 'Something happened', {  });
```

Writes (audit.created)

```ts
{
  "intent": "audit.created",
  "level": "info",
  "alert": false,
  "message": "Page created",
  "data": {
    "pageId": "p_123",
    "by": "u_42"
  },
  "time": "2026-10-09T12:00:00.000Z"
}
```

## Is it an audit entry?

Find the row that describes your case, and use the domain on the right.

| If the problem is | Use |
|---|---|
| Who did what, kept as a record: things created, changed, deleted, and changes to access. | `audit.*` (this page) |
| Signals worth watching: failed sign-ins, bad tokens, rate limits, probing. | [`security.*`](https://www.prongs.dev/docs/intents/security.md) |
| Something broke or degraded, and someone should look. | [`incident.*`](https://www.prongs.dev/docs/intents/incident.md) |
| Background work: syncs, backups, migrations, scheduled runs. | [`job.*`](https://www.prongs.dev/docs/intents/job.md) |
| Detail for working on the code, dropped in production. | [`debug.*`](https://www.prongs.dev/docs/intents/debug.md) |

## For registry authors

**Starter intents.** These are the intents `prongs add logs` puts in your registry. Change levels through the [`level.*`](https://www.prongs.dev/docs/intents/logs.md#level) intents, and point [`log()`](https://www.prongs.dev/docs/profiles/logs.md) at your logger.