Audit (audit_events)

Audit

Terma Grand maintains a log of all significant actions (audit_events). Access to the audit log is via the API.

What is Logged

Event	Description
pass.created	Pass created
pass.cancelled	Pass cancelled (by user or system)
pass.verified	Pass verified by a guard
blacklist.blocked	Vehicle added to blacklist
blacklist.unblocked	Vehicle removed from blacklist
invite.created	Invite link created
invite.activated	Invite link activated (role granted)

Event Fields

Field	Description
id	Unique event identifier
eventType	Event type (see table above)
actorUserId	ID of the user who performed the action
payload	Additional data (depends on event type)
createdAt	Timestamp (UTC)

API Access

The audit log is accessible via the internal REST API:

GET /api/audit?limit=50&offset=0
Authorization: Bearer <INTERNAL_API_SECRET>

Response:

{
  "events": [
    {
      "id": "evt_abc123",
      "eventType": "pass.created",
      "actorUserId": "usr_xyz",
      "payload": { "passId": "pass_001", "plate": "A777AA77" },
      "createdAt": "2025-01-15T10:30:00.000Z"
    }
  ],
  "total": 150
}

Data Retention

Events are stored in PostgreSQL in the audit_events table. Data is not automatically deleted — configure a retention policy according to your compliance requirements.