Skip to main content
LightShip records significant authentication, query, and configuration activity in Postgres. Only administrators can read the audit log. Writes are best-effort, so an audit failure is logged without failing the original request.

​
What is recorded

The audit log captures three event categories:
  • Authentication. Successful sign-in, sign-out, and password changes.
  • Queries. Trace searches and trace reads through REST, MCP, or the web UI.
  • Configuration. Schema, optimization, role, user, attribute, and key changes.
When an audited action uses an API key, the entry records that fact. Protocol-only MCP calls such as initialization, ping, and tool listing are not audit events.

​
Where to read it

Audit UI

Admins can open Audit from the left navigation and filter recent entries.

GET /audit

The same events over REST, for exporting to a SIEM or long-term archive.

​
Retention

LightShip prunes audit rows in-process using the LIGHTSHIP_AUDIT_RETENTION_DAYS setting. The default is 90 days; set a longer window if you must retain audit history for compliance. A malformed or non-positive value stops the container at boot.
If you need audit history beyond your retention window, export from GET /audit on a regular schedule.