The audit log

Every change an org's people, its API keys, its users or Synq make is a row in the org's audit log, written in the same transaction as the change: a change that fails leaves no row, and a row that can't be written undoes the change.

Each row has:

• action: what happened, as <resource>.<what happened>, such as brand.updated or user.created. An action's name never changes once it ships. Webhook events lists every one.
• actor: who did it (a member, an API key, a user through the account API, or Synq itself), and act_client_id, the app that acted for them: an agent, or an MCP host.
• brand_id and resource: what it was done to.
• metadata: what changed. It never holds a secret, and changes to a user's metadata name the fields, never their values.
• ip and user_agent: where it came from.

Sign-ups are user.created. A sign-in that doesn't finish is user.sign_in_failed, with the reason and the identity tried, never what was typed as a secret, and naming the user only when one has that identity.

Read the org's audit log, newest first, filtered by action, actor, resource, brand and time; it needs org.auditLog.view. Rows are kept as long as the org's plan says (7, 30 or 365 days, or for ever). Webhooks deliver the same rows as they happen: see webhook events.