ironflow audit

View and query history inspection (audit trail) records for workflow runs and auth decisions. Uses the ConnectRPC API.

ironflow audit <subcommand> [flags]

Subcommands:

Subcommand	Description
trail	View history inspection (audit trail) for a workflow run
auth-trail	View auth decision audit trail

ironflow audit trail

View the audit trail for a specific workflow run with optional filtering.

ironflow audit trail <run-id> [flags]

Arguments:

Argument	Required	Description
run-id	Yes	Workflow run ID to query

Flags:

Flag	Short	Type	Default	Description
--type		string		Filter by event type (e.g., step.completed)
--from		string		Filter events from this date or RFC3339 timestamp (inclusive)
--to		string		Filter events up to this date or RFC3339 timestamp; a bare date means its midnight, so it excludes the named day
--limit		int	50	Maximum events to return
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

TIMESTAMP       EVENT TYPE       STEP ID       PAYLOAD
10:30:15.123    run.created      -             {"functionId":"fn_abc"}
10:30:15.456    step.created     step_001      {"name":"validate-input"}
10:30:16.789    step.completed   step_001      {"name":"validate-input"}

Total: 3 events

Examples:

# View all audit events for a run
ironflow audit trail run_abc123

# Filter by event type
ironflow audit trail run_abc123 --type step.completed

# Filter by time range
ironflow audit trail run_abc123 --from 2026-01-01T00:00:00Z --to 2026-01-02T00:00:00Z

# Limit results and output as JSON
ironflow audit trail run_abc123 --limit 100 --json

ironflow audit auth-trail

View the auth decision audit trail with optional filtering. Shows authentication and authorization decisions made by the platform.

ironflow audit auth-trail [flags]

Flags:

Flag	Short	Type	Default	Description
--org		string		Organization ID (required)
--key		string		Filter by API key ID
--action		string		Filter by action (e.g., functions:invoke)
--from		string		Filter events from this date or RFC3339 timestamp (inclusive)
--to		string		Filter events up to this date or RFC3339 timestamp; a bare date means its midnight, so it excludes the named day
--limit		int	50	Maximum events to return
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

TIMESTAMP       EVENT TYPE       DECISION    PAYLOAD
10:30:15.123    auth.check       allow       {"action":"functions:invoke","key":"ak_abc"}
10:30:16.456    auth.check       deny        {"action":"runs:cancel","key":"ak_def"}

Total: 2 events

Examples:

# View all auth decisions for an organization
ironflow audit auth-trail --org org_default

# Filter by API key
ironflow audit auth-trail --org org_default --key ak_abc123

# Filter by action
ironflow audit auth-trail --org org_default --action functions:invoke

# Filter by time range with JSON output
ironflow audit auth-trail --org org_default --from 2026-01-01T00:00:00Z --json

---