Audit Logs
Audit logs record the operations performed on a memory bank: what was done, how it was called, when, how long it took, and the request and response involved. This page is for bank owners and admins who need an operational or compliance record of bank activity, and for teams that want to pull that record into their own tools through the API.
Audit logs are available on Enterprise plans. If the Enable audit logging for this bank switch on a bank's Audit Logs tab is grayed out, book a call or contact your Hindsight representative to enable it for your organization.
How it works
Audit logging is turned on per bank. Once your organization has the feature, an owner or admin turns it on for each bank that needs an audit trail. The audit log view appears only on banks where it is turned on.
Each audited operation becomes one entry in that bank's audit log. Entries are written in the background, so audit logging does not hold up the operation being recorded.
Turn on audit logging for a bank
- Open the bank in the console.
- Select the Audit Logs tab on the bank profile.
- Turn on Enable audit logging for this bank.
The switch shows Enabled or Disabled. Once it is on, the audit log view appears below it. To stop recording, turn the switch off.
| Role | Can turn audit logging on or off | Can view the audit log |
|---|---|---|
| Owner | Yes | Yes |
| Admin | Yes | Yes |
| Member | No (the switch is read-only) | Yes |
You can also set it through the bank configuration API by setting audit_log_enabled on the bank:
curl -X PATCH "$HINDSIGHT_API_URL/v1/default/banks/my-bank/config" \
-H "Authorization: Bearer $HINDSIGHT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"updates": {"audit_log_enabled": true}}'
$HINDSIGHT_API_URL is your deployment's API address. See
Accessing your deployment.
What is recorded
Fields
Every entry has these fields:
| Field | Description |
|---|---|
id | Unique ID of the entry |
action | The operation, such as retain, recall or create_mental_model |
transport | How the operation arrived: http (REST API and SDKs), mcp (MCP server tools), or system (background work Hindsight ran for the bank) |
bank_id | The bank the operation applied to |
started_at | When the operation started |
ended_at | When the operation finished |
duration_ms | Time taken, in milliseconds |
request | The request body, as JSON |
response | The response body, as JSON |
metadata | Extra detail for some actions. For example, a memory_defense entry records the decision taken, the detector that matched and the document ID. |
Because entries include request and response bodies, an audit log can contain the same content as the memories in the bank, such as the text sent to retain or the results returned by recall. Control access to audit logs as you would control access to the bank itself.
Actions
These are the actions you can filter on in the console:
| Area | Actions |
|---|---|
| Memories | retain, batch_retain, file_convert_retain, recall, reflect, clear_memories, consolidation |
| Bank | create_bank, update_bank, delete_bank |
| Mental models | create_mental_model, refresh_mental_model, delete_mental_model |
| Directives | create_directive, delete_directive |
| Delivery and security | webhook_delivery, memory_defense |
Other bank operations, such as configuration changes (update_bank_config), document updates and
deletes, and webhook changes, are also recorded and appear when you view All actions. Calls
made through the MCP server are recorded under the name of the MCP tool that was called.
memory_defense entries are written when Memory Defense redacts
or blocks content during retain.
View and filter audit logs in the console
With audit logging on, the Audit Logs tab shows:
- Request volume. A chart of audited operations over Today, Last 7 days or Last 30 days, optionally narrowed to a single action.
- Filters. Filter the table by action, by transport (HTTP, MCP or System), and by time range (last hour, last 24 hours, last 7 days, last 30 days, or all time). Use Refresh to load new entries.
- Entries table. Time, action, transport and duration for each entry, newest first, 20 per page, with the total number of matching entries.
- Entry details. Select a row to see the full request, response and metadata as JSON.
Query audit logs with the API
To export audit entries or feed them into another system, use the API. Both endpoints are read-only and are scoped to a single bank.
List entries
GET /v1/default/banks/{bank_id}/audit-logs returns entries newest first.
| Parameter | Description |
|---|---|
action | Only return this action |
transport | Only return this transport: http, mcp or system |
start_date | ISO 8601 date-time; entries at or after this time |
end_date | ISO 8601 date-time; entries before this time |
limit | Entries per page, 1 to 500 (default 50) |
offset | Number of entries to skip, for paging |
curl "$HINDSIGHT_API_URL/v1/default/banks/my-bank/audit-logs?action=retain&start_date=2026-10-01T00:00:00Z&limit=100" \
-H "Authorization: Bearer $HINDSIGHT_API_KEY"
The response contains bank_id, total, limit, offset and items, where each item has the
fields listed in Fields. Page through with offset until you have read total entries.
Activity counts
GET /v1/default/banks/{bank_id}/audit-logs/stats returns entry counts grouped into time buckets,
for charting. Pass period as 1d, 7d (default) or 30d, and optionally action. Each bucket
has a time, a total, and a count per action.
Retention
By default, audit entries are kept indefinitely. A retention period, after which older entries are deleted, can be set for the whole deployment; it is not set per bank. To set a retention period for your deployment, contact your Hindsight representative.
Memory Defense security events
Audit logs record every audited operation on a bank. If you use Memory Defense, it also keeps a separate trail of each redact and block decision, with the detector, severity and source of the content. See Reading the audit trail in Building Policies. To forward those events to a SIEM, see Webhook notifications and SIEM.
Get started
- Turn on audit logging for the banks that need it from each bank's Audit Logs tab.
- If your organization doesn't have audit logs yet, book a call or contact your Hindsight representative.