Audit Log and Activity Tracking

Security and compliance teams can use this guide to answer: what did Duvo do, on whose behalf, and when? It covers what Duvo records, where to find that data in the product, how to export it for your SIEM or compliance tooling, and what is not yet captured so you can plan compensating controls.

---

What Gets Recorded

Duvo records activity in four event families.

Actor events

Changes to who can access Duvo and how they authenticate:

Event	What is captured
User login	User, timestamp, identity provider
User invited to team or organization	Inviting user, invitee, role assigned, timestamp
Role changed	Acting user, target user, old role, new role, timestamp
Connection added or removed	User, connection type, team, timestamp
Login or secret created or rotated	User, secret name (never the value), assignment scope, timestamp
API key created or revoked	Creating user, key name, timestamp

Builder events

Changes to automation configuration:

Event	What is captured
Assignment created	User, assignment name, team, timestamp
SOP edited	User, assignment, version number, timestamp
Assignment published	User, assignment, version promoted, timestamp
Schedule enabled or disabled	User, assignment, interval, timestamp
Trigger added or removed	User, assignment, trigger type, timestamp
Assignment duplicated	User, source assignment, new assignment, timestamp
Assignment deleted	User, assignment, timestamp

Job events

Activity during each Job execution:

Event	What is captured
Job started	User or trigger type, assignment, run ID, timestamp
Tool call made	Tool name, connection, run ID, timestamp
Human-in-the-Loop request created	Assignee, run ID, request title, timestamp
HITL request approved or rejected	Reviewer, decision, run ID, timestamp
Job completed	Run ID, status, duration, timestamp
Job stopped manually	User, run ID, timestamp

Admin events

Organizational-level changes:

Event	What is captured
Team created	User, team name, organization, timestamp
User removed from team or organization	Acting admin, removed user, timestamp
Owner or Admin role assigned	Acting user, target user, new role, timestamp
Billing plan changed	Admin, old plan, new plan, timestamp

---

Finding Audit Data in the Product

Jobs List

Past Jobs (left sidebar) is the primary place to review job-level activity. Every Job across all assignments appears here with its status, trigger source, creating user, and timestamps.

Admins and Managers see the Created by column, which shows which team member started each Job. Use the filter bar to narrow by:

• Assignment — activity for a specific automation
• Status — Failed, Completed, Running, or Stopped jobs
• Created by — activity from a specific team member (Admin and Manager only)
• Trigger — jobs started manually, by schedule, by API, or by event trigger

Team Insights

Team Insights (sidebar, under Team) shows aggregated activity: run counts, completion rates, active assignments, and usage trends over time. Use this to spot sudden drops in activity or failure rate spikes across the whole team.

Human-in-the-Loop activity

All HITL approval requests, responses, and outcomes are recorded as part of the Job’s message thread. Open any Job that included a HITL step to see who approved or rejected the request, when, and with what context.

---

Exporting Audit Data

From the Jobs List

To export job-level activity:

1. Open Past Jobs from the sidebar.
2. Apply filters (assignment, date range, status, created by).
3. Click Export in the top-right corner.
4. Choose CSV or JSON.

Each export row contains: assignment name, run ID, status, trigger type, created-by user, start time, end time, and duration. The run ID can then be used to retrieve the full message log via the API (see below).

Download sample exports to inspect the exact field names and format:

• past-jobs-sample.csv
• past-jobs-sample.json

Via the Public API

Use the API to retrieve job history and build a custom audit export pipeline.

List recent runs for your team:

curl -X GET "https://api.duvo.ai/v2/teams/{teamId}/runs?limit=100&sort_by=created_at&sort_order=desc" \
  -H "Authorization: Bearer dv_your_api_key"

Filter parameters:

Parameter	Description
limit	Number of runs per page (1–100, default 20)
offset	Number of runs to skip for pagination
agent_id	Scope to a specific assignment
status	Filter by run status (completed, failed, running, stopped)
source	Filter by how the run was started (api, schedule, manual, etc.)

Get status for a specific Job:

curl -X GET "https://api.duvo.ai/v2/runs/{run_id}" \
  -H "Authorization: Bearer dv_your_api_key"

Get the full execution log for one Job:

curl -X GET "https://api.duvo.ai/v2/runs/{run_id}/messages?limit=100" \
  -H "Authorization: Bearer dv_your_api_key"

The messages endpoint returns every step the assignment took — tool calls, model responses, HITL requests, and final output — in chronological order.

---

Integrating with a SIEM or Observability Tool

Duvo does not currently have a native push connector for SIEM tools (Splunk, Datadog, Elasticsearch, etc.). The supported approach is a pull-based pipeline using the public API.

Building a polling pipeline

1. Schedule a polling script (a cron job, Lambda, or Cloud Run job) that calls GET /teams/{teamId}/runs with sort_order=asc and an offset cursor to page through new Jobs since your last poll.
2. For each Job, call GET /runs/{run_id}/messages to get the full execution log.
3. Transform and forward the results to your SIEM using its HTTP ingestion endpoint — for example, Splunk HTTP Event Collector (HEC) or the Datadog Logs API.

GET /runs/{run_id} returns a JSON object like this:

{
  "run_id": "550e8400-e29b-41d4-a716-446655440000",
  "assignment_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "assignment_name": "Invoice Processing",
  "status": "completed",
  "trigger": "schedule",
  "created_by": "[e-mail]",
  "started_at": "2026-05-18T09:00:00.000Z",
  "completed_at": "2026-05-18T09:03:42.000Z",
  "duration_seconds": 222
}

For the full API reference, see Running Assignments via API.

---

Retention and Access Control

Who can view audit data

Role	Job history	Created by column	Run Debugger	Team Insights	API access
Member	Own jobs only	No	No	No	Own jobs only
Manager	All team jobs	Yes	No	Yes	All team jobs
Admin	All team jobs	Yes	Yes	Yes	All team jobs
Owner	All team jobs	Yes	Yes	Yes	All team jobs

Organization Admins, Owners, and Executives have access to every team’s data within the organization.

For a full breakdown of role capabilities, see Team Roles and Permissions and Organization Roles and Permissions.

Data retention

Job history and audit data is retained for the duration of your subscription. Contact [e-mail] if you need a full data export or have questions about retention windows under your plan.

---

Known Gaps

Be aware of these limitations when planning compensating controls.

What you may expect	Current state	Workaround
Native SIEM push (Splunk HEC, Datadog)	Not available — pull only	Schedule a polling script that forwards runs to your SIEM (see above)
Dedicated audit log API endpoint	Not available — use the runs API	Use GET /teams/{teamId}/runs with message logs for per-run detail
Actor and builder event export	In-product only — not yet exportable via API	Contact [e-mail] for a data extract
Per-step tool timing	Not exposed via the API	Overall Job duration is available via GET /runs/{run_id}
Per-step cost breakdown	Not exposed via the API	Use Team Insights for aggregated cost trends
OpenTelemetry trace IDs in API responses	Not currently exposed	Use run_id as the stable correlation key in your SIEM
Signed or tamper-evident log export	Not currently supported	Supplement with your SIEM’s ingestion integrity controls

---

Related

• Guardrails for High-Risk Automations — Risk tiers, HITL patterns, and kill switches for sensitive assignments
• Jobs List — Filtering and monitoring all Jobs across your team
• Running Assignments via API — API reference for starting runs, polling status, and retrieving messages
• Team Roles and Permissions — Team-level roles and what each can see
• Organization Roles and Permissions — Org-level access and which roles have cross-team visibility
• Security & Privacy — Platform-level security controls, SOC 2, and data handling