Audit history
Open a VM and select Audit to see its management history. Each record shows the action, the person or automation that initiated it, the time, and the result. The tab is available while a VM is being prepared or stopped.
Select Audit in the dashboard sidebar for history across your VMs. Filter by action, actor, outcome, or time. A namespace's detail page also links to the history of its VMs. The namespace shown in a VM's header and Overview opens that namespace directly.
What is recorded
- Creation, start, stop, restart, pause, hibernate, restore, reinstall and deletion.
- Resource and lifecycle policy changes, including expiry and idle settings.
- SSH, runtime API access, networking, public ports and custom domains.
- Managed workload actions, reported workload exits, archives, log clearing and VM disk attachment changes.
- Automatic wake, idle/expiry events and platform stops.
Account actions show the account name. API credential actions identify the credential; automated actions identify the system. Platform staff actions are labelled Platform administrator.
The history records management actions. It does not capture terminal keystrokes, command contents, environment values, passwords, keys, tokens or file contents.
Outcomes
| Outcome | Meaning |
|---|---|
| Completed | The operation completed successfully. |
| Accepted | Work was accepted for processing. A later event shows its completion. |
| Failed | The operation reported a failure. Inspect its details and current state before retrying. |
| Unconfirmed | The request was recorded, but its completion has not been confirmed. |
The latest page refreshes while the tab is visible. Times are displayed in your local time zone; hover over a time to see UTC. Clearing VM logs does not clear the audit history. Deleted VMs remain in the account history. Actions from before audit collection was introduced cannot be reconstructed.
Read through the API
Use your Oblien API credentials.
curl 'https://api.oblien.com/vms/VM_ID/audit?limit=25' \
-H 'Authorization: Bearer YOUR_ACCESS_TOKEN'For all your VMs, use GET /vms/audit. Optional filters are:
| Parameter | Values |
|---|---|
vm_id | Restrict the account history to one VM, including a deleted VM. |
namespace | Namespace slug. |
category | vm, power, lifecycle, resources, network, access, storage, workloads, logs. |
outcome | requested, accepted, succeeded, failed. |
actor_type | user, api_key, administrator, system. |
from, to | UTC ISO timestamps. from is inclusive; to is exclusive. |
limit | 1–100 records; default 50. |
before | The previous response's next_cursor, to read older records. |
Responses contain events and next_cursor. A null cursor means there are no
older results for those filters. Keep the cursor as a string. API timestamps are
UTC. Namespace and VM credentials can only read history within their
assigned scope; billing credentials cannot read VM audit history.
MCP clients can use the vm_audit tool with the same account and scope rules.