Activity log & audit
Every consequential management action against your account is recorded: who did it, what changed, and when. It is the answer to "why did this stop working?" and to the auditor asking how a given certificate came to exist.
The activity log records what your platform did through the management API — registrations, configuration changes, key rotations. It is not a transaction ledger: settlements and disputes have their own records, and the chain is the authority for anything involving money.
What is recorded
| Area | Events |
|---|---|
| Account | Profile changes, document submissions, verification decisions, promotion to production, password changes |
| Credentials | Management key issuance and rotation — never the key itself, only that it happened |
| Principals | Registration, attestation updates, suspension, closure |
| Agents | Registration, activation, scope and market changes, key rotation, suspension, revocation, transfer |
| Webhooks | Endpoint creation and deletion, URL changes, event-selection changes, secret changes |
Secrets and keys are never written to the log — only the fact that they changed. An audit log that contains credentials is a credential store with worse access control.
What an entry contains
{
"id": "act_7d3c91f4",
"occurred_at": "2026-05-14T09:12:44Z",
"action": "webhook.url_changed",
"actor": {
"type": "admin",
"email": "ops@yourplatform.example"
},
"subject": {
"type": "webhook_endpoint",
"id": "whe_2f81a4"
},
"environment": "production",
"changes": {
"url": { "from": "https://a.example/hooks", "to": "https://b.example/hooks" }
}
}| Field | Notes |
|---|---|
actor | Who acted — a dashboard admin (by email) or the management API (by key prefix). The distinction matters: an API-driven change came from your own systems. |
subject | What was acted on, by type and id. |
changes | Before and after, for fields that changed. Absent for actions that are not edits. |
environment | Sandbox and production entries share the log and are distinguished by this field. |
Reading the log
curl "https://api.nustro.com/v1/platform/activity?subject_type=agent&subject_id=did:aeap:d2146ca7…&limit=50" \
-H "Nustro-Api-Key: nustro_live_••••"Filter by actor, subject, action, environment, or time range. Results are reverse-chronological and paginated.
What is worth watching
Most entries are routine. Four are worth an alert rather than a report.
| Action | Why it matters |
|---|---|
webhook.url_changed | The one change signatures do not protect you from. Signing proves a delivery came from Nustro; it does nothing about your event stream being pointed somewhere new. Anyone with dashboard access who repoints an endpoint receives your settlement and dispute events. |
api_key.rotated | Immediate revocation with no overlap. An unexpected rotation is either a deployment nobody announced or someone locking you out. |
agent.key_rotated | The agent’s previous key stops working at once. If it was not your deployment, an agent is about to fail in production. |
principal.suspended | Cascades to every agent under it. A quiet drop in an agent’s traffic often traces back here. |
If you build one alert from this log, make it webhook URL changes in production. It is cheap, it is rare enough not to be noisy, and it is the difference between noticing a redirected event stream and not.
Using it in support and audit
| Situation | What the log gives you |
|---|---|
| “My agent stopped working” | Filter by the agent DID. Key rotation, scope change, suspension, or a principal-level cascade will be there, with a timestamp. |
| “We never changed that” | The actor field distinguishes a dashboard admin from an API call. One of those is a person; the other is your own code. |
| An auditor asks how a certificate exists | The registration and activation entries, plus your own verification records and the attestation_id you kept. |
| A dispute escalates | Configuration history around the transaction date — what the scope and dispute window were when it settled. |
Nustro holds management actions and protocol state. Your platform holds the principal relationship, the verification evidence, and the commercial context — and the chain holds the money. A complete audit trail is all three, which is why propagating a correlation ID from your onboarding through to Nustro calls is worth the small effort.