Audit log

Bailey keeps a chronological, read-only audit log of meaningful actions across the platform: who did what, to which project, and when.

This view is admin-only. Regular accounts don’t see it (and the server enforces that, not just the UI). It exists for platform operators and for accountability.

What gets recorded

Sensitive and state-changing actions, including:

• Projects: create, update, delete
• Versions: publish, restore
• Folders: create, rename, delete
• Custom domains: add, verify, delete
• Site password: set, remove
• Data: declare a store, read submissions, erase records

Each entry carries the actor (their identity, stamped server-side, never claimed by the client), the action, the target (project/folder/domain), a short metadata summary, and a timestamp.

Reading it

Admins find it under Audit in the dashboard top bar. It’s paginated (newest first), and destructive actions are visually flagged.

---

For developers

Backed by GET /v1/audit?limit=&offset= and an aggregate GET /v1/audit/stats?hours=, both admin-gated (403 otherwise). Writes are best-effort and never block the business action they describe. The application admin role is distinct from the auth token’s role; a configured super-admin id is always treated as admin.