Enterprise / Security & Governance

Enterprise Audit Logs

Immutable audit trails, retention policies, PII controls, and audit log API for SOC 2, GDPR, and HIPAA compliance.

Browse docs

Overview

Enterprise audit logs provide immutable, timestamped records of all gateway activity — configuration changes, access events, and API requests. When compliance is enabled, audit logs support immutability guarantees, configurable retention, PII redaction policies, and evidence export for compliance frameworks.

Captured Events

Configuration changes — Providers, models, keys, guardrails, workflows
Authentication events — Login, logout, failed attempts, session refresh
Permission changes — Role assignments, key rotations, user status changes
Budget modifications — Limit changes, resets, setting updates
API requests — Model calls with metadata (path, provider, model, tokens, latency, status)

Configuration

Basic Audit Logging

Enabling audit logging is not Enterprise-specific — it works in OSS too. Enterprise adds compliance controls on top.

text

logging:
  enabled: true
  log_bodies: false
  log_headers: false
  only_model_interactions: true
  buffer_size: 1000
  flush_interval: 5
  retention_days: 30

text

LOGGING_ENABLED=true
LOGGING_LOG_BODIES=false
LOGGING_LOG_HEADERS=false
LOGGING_ONLY_MODEL_INTERACTIONS=true
LOGGING_BUFFER_SIZE=1000
LOGGING_FLUSH_INTERVAL=5
LOGGING_RETENTION_DAYS=30

Environment Variables

Variable	Default	Description
`LOGGING_ENABLED`	`false`	Enable audit logging
`LOGGING_LOG_BODIES`	`true`	Log request/response bodies (sensitive — may contain PII)
`LOGGING_LOG_HEADERS`	`true`	Log headers (sensitive headers auto-redacted)
`LOGGING_ONLY_MODEL_INTERACTIONS`	`true`	Only log AI model endpoints
`LOGGING_BUFFER_SIZE`	`1000`	In-memory buffer before flush
`LOGGING_FLUSH_INTERVAL`	`5`	Flush interval in seconds
`LOGGING_RETENTION_DAYS`	`30`	Auto-delete after N days (0 = forever)

Compliance Controls

With the Enterprise compliance capability enabled, audit logs gain additional controls:

text

compliance:
  enabled: true
  audit_immutability: true
  data_residency: "us"
  pii_logging_policy: "redact"  # redact | hash | block
  evidence_retention_days: 365
  access_review_cadence_days: 90
  evidence_export_target: "s3://aurora-compliance-evidence"

Field	Description
`audit_immutability`	Prevent deletion or modification of audit records after they are written
`pii_logging_policy`	How PII in logged bodies is handled: `redact` (replace with `[REDACTED]`), `hash` (replace with hash), `block` (do not log bodies at all)
`evidence_retention_days`	Override default retention for compliance evidence records
`evidence_export_target`	S3 URI or other target for periodic evidence export

Retention

Log retention is configurable. Default retention is 30 days (0 = forever). Enterprise supports extended retention periods up to the configured evidence_retention_days.

Log cleanup runs periodically based on retention_days. Records older than the retention window are automatically purged.

Admin API

For endpoint reference see the Admin API section.

text

curl -H "Authorization: Bearer $AURORA_MASTER_KEY" \
  http://your-aurora-host/admin/api/v1/audit?days=7&limit=50

Export

See Log Exports for automated export to OTLP, Datadog, webhook, or S3 destinations.

Compliance Frameworks

Aurora Enterprise audit logs support compliance with:

SOC 2 — Change logging and access tracking
GDPR — Data access and processing records
HIPAA — Access and modification audit trail
ISO 27001 — Logging and monitoring controls

Overview

Captured Events

Configuration changes — Providers, models, keys, guardrails, workflows

Authentication events — Login, logout, failed attempts, session refresh

Permission changes — Role assignments, key rotations, user status changes

Budget modifications — Limit changes, resets, setting updates

API requests — Model calls with metadata (path, provider, model, tokens, latency, status)

Configuration

Basic Audit Logging

Enabling audit logging is not Enterprise-specific — it works in OSS too. Enterprise adds compliance controls on top.

text

logging:
  enabled: true
  log_bodies: false
  log_headers: false
  only_model_interactions: true
  buffer_size: 1000
  flush_interval: 5
  retention_days: 30

text

LOGGING_ENABLED=true
LOGGING_LOG_BODIES=false
LOGGING_LOG_HEADERS=false
LOGGING_ONLY_MODEL_INTERACTIONS=true
LOGGING_BUFFER_SIZE=1000
LOGGING_FLUSH_INTERVAL=5
LOGGING_RETENTION_DAYS=30

Environment Variables

Variable	Default	Description
`LOGGING_ENABLED`	`false`	Enable audit logging
`LOGGING_LOG_BODIES`	`true`	Log request/response bodies (sensitive — may contain PII)
`LOGGING_LOG_HEADERS`	`true`	Log headers (sensitive headers auto-redacted)
`LOGGING_ONLY_MODEL_INTERACTIONS`	`true`	Only log AI model endpoints
`LOGGING_BUFFER_SIZE`	`1000`	In-memory buffer before flush
`LOGGING_FLUSH_INTERVAL`	`5`	Flush interval in seconds
`LOGGING_RETENTION_DAYS`	`30`	Auto-delete after N days (0 = forever)

Compliance Controls

With the Enterprise compliance capability enabled, audit logs gain additional controls:

text

compliance:
  enabled: true
  audit_immutability: true
  data_residency: "us"
  pii_logging_policy: "redact"  # redact | hash | block
  evidence_retention_days: 365
  access_review_cadence_days: 90
  evidence_export_target: "s3://aurora-compliance-evidence"

Field	Description
`audit_immutability`	Prevent deletion or modification of audit records after they are written
`pii_logging_policy`	How PII in logged bodies is handled: `redact` (replace with `[REDACTED]`), `hash` (replace with hash), `block` (do not log bodies at all)
`evidence_retention_days`	Override default retention for compliance evidence records
`evidence_export_target`	S3 URI or other target for periodic evidence export