Audit Logs

Introduction

Audit Logs is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.

Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.

What you’ll build

Before you start, make sure you have the following in place:

• A Paycux account with access to the project you are configuring.
• An API key for the environment you are working in. Staging keys start with sk_test_; production keys start with sk_live_.
• Admin access on the system you are connecting, so you can create the application and read its metadata.
• A redirect URI registered in the Paycux dashboard under Developer → Redirects.

Before getting started

Before getting started applies specifically to Audit Logs. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.

If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.

API object definitions

API object definitions is handled by Audit Logs rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Emit an Audit Log Event

Audit log events are append-only and retained for the window configured on the organization. Each event carries an actor, a target, a timestamp and the context the action happened in.

Stream events to a customer's SIEM, or export a date range as JSON or CSV. Exports are generated asynchronously and delivered as a signed URL.

Install the Paycux SDK

Install the SDK with your package manager, then read the API key from the environment rather than hard-coding it.

1npm install @paycux/node

Set secrets

Vault stores secrets encrypted with a key that never leaves the key manager. Your application sends plaintext and receives a ciphertext handle; the plaintext is never written to disk.

Keys can be Paycux-managed or supplied by the customer. Customer-managed keys let a customer revoke access to their own data without involving you.

Get an Organization ID

An organization is the tenant boundary in Paycux. Connections, directories, roles and audit log streams all hang off an organization, and a user reaches your application through a membership in one.

Create an organization per customer, not per environment. The same organization exists in staging and production with separate configuration.