cubeship

cubeship audit

Read who changed what on this instance

Read the audit log, newest first: every change made through the dashboard, the API or MCP, and every refused attempt — a read included, so a key trying to read a secret shows up. Request bodies are never kept, and events are kept for 90 days.

Admin only. The last line says how to read the page before it.

cubeship audit [flags]
FlagDefaultWhat it does
--beforeonly events older than this id
--fromonly events at or after this: YYYY-MM-DD (midnight UTC) or RFC 3339
--limitat most this many, up to 500 (default 100)
--outcomeok, refused or failed
--targetonly events whose target contains this, e.g. an app's reference
--toonly events before this, in the same form
--useronly this username
--viadashboard, api or mcp