Audit log
Who did
what.
And when.
Every mutation in the workspace is written. Twenty-two action types, indexed and filterable. The compliance review your team has been dreading just got boring.
Audit logs that nobody can read are not audit logs. They are spreadsheets that lost their meaning.
Twenty-two action types
Mapped to the things that actually happen.
Products
PRODUCT_CREATEDPRODUCT_UPDATEDPRODUCT_DELETED
Leads
LEAD_CREATEDLEAD_UPDATEDLEAD_DELETEDLEAD_BULK_CREATEDLEAD_EXPORTEDLEAD_UNSUBSCRIBEDLEAD_ERASED
Campaigns
CAMPAIGN_CREATEDCAMPAIGN_UPDATEDCAMPAIGN_DELETEDCAMPAIGN_PAUSEDCAMPAIGN_RESUMEDCAMPAIGN_ENROLLED
Integrations
INTEGRATION_CONNECTEDINTEGRATION_UPDATEDINTEGRATION_REMOVEDINTEGRATION_VERIFIED
Compliance
GDPR_EXPORT_REQUESTED
Workspace
WORKSPACE_SETTINGS_UPDATED
What gets recorded
Every row carries enough to reconstruct the moment.
Per-row fields
Actor, target, metadata, IP, user agent.
The actor is the Rook ID who triggered the action, plus the email at time of action so future renames do not lose the trail. The target is typed (lead, product, campaign) plus the row id.
Metadata captures the diff: which fields changed, how many leads were imported, the source of the change. IP and user-agent come from the request headers.
AuditLog {
id uuid
workspaceId uuid
actorId uuid? // null for system / webhook
actorEmail string? // captured at time of action
action AuditAction
targetType string? // 'lead' | 'campaign' | …
targetId string?
metadata json // diff, counts, source
ip string?
userAgent string?
createdAt timestamp
}What auditors love
Designed for the SOC 2 / ISO review.
Filter by action
Twenty-two action types, queryable.
Append-only
No update or delete API. The log is the truth.
Indexed for time + target
Per-target queries (all events for lead X) are O(log n).
Tech specs
- Storage
- Postgres table, indexed on (workspaceId, createdAt desc), (workspaceId, action), (workspaceId, targetType, targetId)
- Retention
- Indefinite. Cascade-deleted only when the workspace is deleted.
- Mutability
- Append-only. No update or delete endpoints.
- Failure mode
- Audit writes never throw upstream. Failures logged, request continues.
- Action types
- 22 enums (see above)
- Filters
- By action type. Pagination 1..200 per page.