Actor and organization
Every entry is scoped to one organization and identifies the actor that triggered it — for customer-facing actions, that's the API key that made the call, recorded as actor_type and actor_id.
Audit trail
Every mutating API call leaves a record.
When your product creates a post, deletes one, allows or revokes a connect origin, or starts a media upload through PostGate's API, that action is written to an append-only audit log — who did it (which API key), what happened, which resource it touched, and the IP address it came from. This page is an honest account of what that log actually is today, not a claim about a product we haven't built yet.
What gets recorded, per action
Four fields on every entry: who, what, where, when
Action and resource
A stable action string (like post.created or connect_origin.revoked) plus the resource type and ID it applied to, so an entry is self-describing without needing to join against application state that may have since changed.
Origin and timestamp
Where PostGate captures it, the request's IP address is stored alongside the entry, and every row is timestamped at write time — an ordered, append-only history per organization.
What's actually logged today
A real list, not a category — pulled directly from the API source
01
Post lifecycle
post.created on every successful POST /api/posts, and post.deleted when a post is removed — each entry keeps a digest of the request body so the exact input that created a post stays reconstructable later.
02
Connect origins
connect_origin.allowed and connect_origin.revoked whenever an origin is added to or removed from the allowlist that hosted OAuth redirects are permitted to return to.
03
Media uploads
media.upload_started, media.upload_completed, and media.upload_aborted track a chunked upload's full lifecycle, including byte count and MIME type on start.
04
Profile disconnects
profile.disconnected records the reason a connected profile was disconnected, whether triggered by your product or by PostGate reacting to a provider-side revocation.
The honest gap
What this isn't — yet
Internal today, not self-serve
This audit trail exists and is written on every action above — but there is currently no customer- facing API endpoint or dashboard UI for your organization to query its own audit log directly. It is used internally, by PostGate's own team, for support and security investigations.
Not a compliance product
Don't build a SOC 2 or HIPAA audit-log requirement around this page — we're not representing it as one. It's an operational record PostGate keeps, not a certified, exportable compliance artifact today.
Need something traced?
If you suspect an action on your account needs explaining — a post that disappeared, a connect origin that changed unexpectedly — contact support with your organization details and, if you have it, the X-Request-Id from the relevant call (see Errors & retries). We can look it up on our side today, even without a self-serve UI in front of it yet.
What you can already act on yourself
Request IDs and delivery evidence are self-serve today
While the audit log itself is internal, PostGate already gives you two things you can use without waiting on us: every response carries an X-Request-Id you should store alongside failed calls, and every post carries per-target delivery evidence you can read or subscribe to directly — see delivery evidence.
- X-Request-Id on every API response
- Per-target delivery evidence on every post
- Terminal webhooks signed with HMAC-SHA256