Loading page
Audit Logs
Every catalog, membership, invite, provider-connection, workspace-lifecycle and agent-connection write is appended to a hash-chained ledger. Read it in the console with filters and export it as JSON with chain verification. Ingesting your own application's events is planned.
Available in part — Audit Logs: The workspace ledger, the console view, the JSON export with chain verification and the secret-free workspace export exist today; ingestion of your own events, streaming and retention policies do not. Items listed as planned below cannot be enabled yet. What Paycux provides today.
Status
How it works today
When a member creates a plan, invites a colleague or rotates a provider secret, the same transaction appends an event with the actor, the action and a payload free of secrets.
Within its scope the row takes the next sequence number, records the previous row's hash and hashes its own canonical document, so a gap, an edit or a removed row is detectable.
Owners and admins filter the ledger in the console and download it as JSON. The export verifies every scope's chain and reports the result.
Integrity
Every event hash is SHA-256 over the previous hash, a newline and the canonical JSON of the event document. The API returns that document as the row's payload, so verifying a scope means walking its rows from sequence 1 and recomputing; the export does this for you and reports chainVerified per scope.
Scope and privacy
Events live in one of three scopes: the workspace, a project or an environment. Payloads carry ids, keys, roles and outcomes, never provider keys, invite tokens or raw e-mail addresses.
Available today
Each item marked available is a route or a console screen today. The planned item cannot be enabled from the console.
Requests
Both audit routes require an owner or admin session cookie. The list is newest first; the export is ascending per scope. Long responses are abridged.
1curl "https://api.paycux.com/v1/workspace/audit-events?limit=1" \2 --cookie "__Host-paycux_session=<session cookie>"34HTTP 2005{6 "events": [7 {8 "id": "1c2d3e4f-5a60-4b7c-9d8e-9f0a1b2c3d4e",9 "scopeType": "environment",10 "projectId": "a1000000-0000-4000-8000-000000000002",11 "environmentId": "a1000000-0000-4000-8000-000000000003",12 "sequence": 18,13 "actorType": "user",14 "actorId": "6d1f0b2e-3c4a-4d5e-8f60-7a8b9c0d1e2f",15 "action": "catalog.plan.created",16 "payload": {17 "action": "catalog.plan.created",18 "actorId": "6d1f0b2e-3c4a-4d5e-8f60-7a8b9c0d1e2f",19 "actorType": "user",20 "environmentId": "a1000000-0000-4000-8000-000000000003",21 "payload": {22 "planId": "5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b",23 "productId": "4d5e6f7a-8b9c-4d0e-9f1a-2b3c4d5e6f70",24 "key": "team",25 "name": "Team",26 "version": 127 },28 "projectId": "a1000000-0000-4000-8000-000000000002",29 "scopeKey": "environment:a1000000-0000-4000-8000-000000000003",30 "scopeType": "environment",31 "sequence": 18,32 "workspaceId": "3f9d2c1e-5b7a-4c8d-9e0f-1a2b3c4d5e6f"33 },34 "previousHash": "176d8ecf891bc3a13b0c43a670b4159e20468c3d0f19e1b76f1bfd1ee6aa2c99",35 "eventHash": "d583c0ed8204d4f038de8403812a8c7554e12c247e0532a3919e9ab86db93850",36 "createdAt": "2026-10-12T10:02:41.117Z"37 }38 ],39 "nextCursor": "<opaque cursor>"40}
Transparent pricing
In part No separate price for what works today.Workspace plans
Included in every workspace plan. Limits (projects, provider connections, members, usage events) are listed on the pricing page.
Questions
Not yet. The ledger records control-plane writes made through the Paycux API and console. An ingestion API for your own events is planned.
Owners and admins of the workspace, through the console at /dashboard/audit and the two audit routes. End users of your application have no access to it.
Walk a scope's rows in sequence order. Each event hash is SHA-256 over the previous hash, a newline and the canonical JSON of the event document, which the API returns as the row's payload with its keys sorted; the first previous hash is 64 zeros. The export does this and reports chainVerified per scope.
Payloads carry ids, keys, roles and outcomes. Provider keys, invite tokens and raw e-mail addresses are never written.
No. Streaming destinations, retention policies, search by target and notifications are planned. Today you export JSON on demand.
Keep exploring
Create a workspace and every catalog, membership and connection change is recorded from the first write. Open /dashboard/audit to read it and export it as JSON.