Audit project changes through automation
PreviewRead the shipped project audit feed while preserving privacy and attribution boundaries.
The preview Management API exposes project-scoped audit events with management:audit:read. Use it to
synchronize control-plane changes or drive review workflows, not as a runtime-event export.
For interactive organisation-wide investigation, use the console Activity surface.
Discover organisations and projects through Management reads and retain the stable project ID. Do not derive project identity from a console slug that can change.
After a project transfer, current discovery follows the destination. Historical events retain their recorded source-organisation attribution.
Audit pagination is one-based and uses page and limit:
curl \
"https://api.featuregate.dev/v1/projects/$FEATUREGATE_PROJECT_ID/audit-events?page=1&limit=50" \
-H "Authorization: Bearer $FEATUREGATE_MANAGEMENT_KEY"The response includes auditEvents, page, pageCount, pageSize, and totalCount. limit can be
at most 100 under the current contract.
Do not implement cursor logic against this endpoint. Advance pages according to response metadata and the generated reference.
For periodic collection:
Do not rely only on timestamps. Events can share a timestamp and clock formatting can change during downstream processing.
Events can describe flag identity and configuration, targeting changes, key lifecycle, project operations, and other project-scoped control-plane actions.
Actor and resource metadata are designed for safe audit use. Key events expose metadata and prefix, not the raw one-time secret.
The endpoint is project-scoped. It does not provide the complete organisation feed for billing, membership, account security, or unrelated projects.
The audit feed does not expose:
Do not attempt to reconstruct exposure analytics from audit events. They record management actions, not every hosted request or local SDK evaluation.
Store only fields needed by the receiving audit system. Apply access controls and retention matching the source organisation's policy.
Keep the management key in a secret manager. Rotate it separately from runtime keys and remove it from logs, traces, queue payloads, and dead-letter records.
401: rotate the invalid or revoked management key.403: check management:audit:read, project visibility, and organisation lifecycle.429: respect retry information and reduce collection pressure.5xx: retry page reads with bounded backoff and de-duplication.Related pages: Activity and audit history, Management API overview, and the generated audit endpoint reference.