Audit Logging

Overview

Moss provides comprehensive audit logging to help you meet compliance requirements and investigate security incidents. Every API request can be tracked, reviewed, and analyzed.

What Gets Logged

Inbound Requests (SDK to Backend)

Field	Description
Timestamp	When the request was received
Application ID	Which application made the request
User ID	The authenticated user
Session ID	Associated chat session
Endpoint	API endpoint called
Request payload	Sanitized request body
Response status	HTTP status code
Duration	Request processing time

Outbound Requests (Backend to External Services)

Field	Description
Timestamp	When the request was made
Target service	LLM provider, embedding API, storage
Provider	Specific provider (OpenAI, Google, etc.)
Model	Model used for the request
Request summary	Sanitized request details
Response status	Success/failure
Token counts	For LLM requests

Sensitive Data Redaction

All audit logs are automatically sanitized before storage:

Redacted Fields

The following fields are automatically redacted:

api_key, apiKey
authorization
password
secret
token
x-api-key

Redaction Example

// Original request
{
  "headers": {
    "authorization": "Bearer eyJhbG...",
    "x-api-key": "app_abc123"
  },
  "body": {
    "query": "How do I reset my password?"
  }
}

// Logged (sanitized)
{
  "headers": {
    "authorization": "[REDACTED]",
    "x-api-key": "[REDACTED]"
  },
  "body": {
    "query": "How do I reset my password?"
  }
}

Redaction is recursive - nested objects and arrays are also sanitized.

Per-Application Control

Audit logging can be enabled or disabled per application:

Dashboard Configuration

Navigate to Settings > Developer Options > Audit Logging to enable or disable logging for your application.

Considerations

Audit Logging	Use Case
Enabled	Compliance requirements, security-sensitive applications
Disabled	High-volume applications where storage costs are a concern

We recommend enabling audit logging for all production applications, especially those handling sensitive data.

Accessing Audit Logs

Dashboard Access

View audit logs in the Dashboard under Configure > Audit Log. Features:

Filter by date range
Filter by user or session
Filter by endpoint or status
Export to CSV

API Access

Query audit logs programmatically using the Audit API:

# List audit events for an application
curl -X GET "https://moss-api.viamoss.ai/api/v1/applications/YOUR_APP_ID/audit-events?start_date=2024-01-01&end_date=2024-01-31" \
  -H "X-Audit-API-Key: YOUR_AUDIT_API_KEY"

# Export the same events as JSON or CSV
curl -X GET "https://moss-api.viamoss.ai/api/v1/applications/YOUR_APP_ID/audit-events/export?format=csv" \
  -H "X-Audit-API-Key: YOUR_AUDIT_API_KEY"

Results are paginated with page and page_size, and can be narrowed with actor_id, action, target_type, outcome, start_date, and end_date.

Audit API Key

A separate API key is used for audit log access:

Isolated Access - Audit key is separate from SDK API key
Read-Only - Cannot modify logs or other data
Revocable - Can be revoked independently

Log Retention

Retention is configurable per plan. Contact us for the retention period that applies to your account, or to arrange a custom period based on your compliance requirements.

Use Cases

Compliance Reporting

Generate reports for auditors:

Filter logs by date range
Export to CSV
Include in compliance documentation

Security Investigation

Investigate suspicious activity:

Identify the user or session
Review all related requests
Check for anomalous patterns
Export evidence for incident response

Performance Analysis

Analyze API usage patterns:

Review request durations
Identify slow endpoints
Track LLM token usage
Optimize based on data

Cost Analysis

Track LLM usage costs:

Review token counts per model
Identify high-usage sessions
Optimize prompts and context

Log Integrity

Immutability

Audit logs are immutable once created:

Logs cannot be modified after creation
Logs cannot be deleted by application owners
Deletion only through data retention policies

Timestamps

All timestamps are:

UTC normalized
Server-side generated
Cannot be client-specified

Best Practices

Enable for Production

Always enable audit logging for production applications to:

Meet compliance requirements
Enable incident investigation
Track usage patterns

Regular Review

Periodically review audit logs for:

Unusual access patterns
Failed authentication attempts
Unexpected API usage

Secure API Keys

Protect your Audit API key:

Store securely (not in code)
Rotate periodically
Monitor for unauthorized use

Next Steps

Compliance

GDPR, data deletion, and certifications

Authentication

Secure your SDK integration

Getting Started

SDK

Dashboard

Configuration

Security

Guides

Resources

Overview

What Gets Logged

Inbound Requests (SDK to Backend)

Outbound Requests (Backend to External Services)

Sensitive Data Redaction

Redacted Fields

Redaction Example

Per-Application Control

Dashboard Configuration

Considerations

Accessing Audit Logs

Dashboard Access

API Access

Audit API Key

Log Retention

Use Cases

Compliance Reporting

Security Investigation

Performance Analysis

Cost Analysis

Log Integrity

Immutability

Timestamps

Best Practices

Enable for Production

Regular Review

Secure API Keys

Next Steps

Compliance

Authentication

​Overview

​What Gets Logged

​Inbound Requests (SDK to Backend)

​Outbound Requests (Backend to External Services)

​Sensitive Data Redaction

​Redacted Fields

​Redaction Example

​Per-Application Control

​Dashboard Configuration

​Considerations

​Accessing Audit Logs

​Dashboard Access

​API Access

​Audit API Key

​Log Retention

​Use Cases

​Compliance Reporting

​Security Investigation

​Performance Analysis

​Cost Analysis

​Log Integrity

​Immutability

​Timestamps

​Best Practices

​Enable for Production

​Regular Review

​Secure API Keys

​Next Steps

Compliance

Authentication

Overview

What Gets Logged

Inbound Requests (SDK to Backend)

Outbound Requests (Backend to External Services)

Sensitive Data Redaction

Redacted Fields

Redaction Example

Per-Application Control

Dashboard Configuration

Considerations

Accessing Audit Logs

Dashboard Access

API Access

Audit API Key

Log Retention

Use Cases

Compliance Reporting

Security Investigation

Performance Analysis

Cost Analysis

Log Integrity

Immutability

Timestamps

Best Practices

Enable for Production

Regular Review

Secure API Keys

Next Steps