# Audit Logging

> Ensure every critical action is logged (vital for UAG/Trust Room).

- Skill: `diegosouzapw/audit-logging` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add diegosouzapw/audit-logging`
- Raw SKILL.md: https://api.skillmd.com/api/skills/diegosouzapw/audit-logging/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: diegosouzapw (https://skillmd.com/u/diegosouzapw)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/diegosouzapw/audit-logging

---


# Audit Logging Protocol

## 1. Principles
- **No Invisible Actions**: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
- **Traceability**: Logs must include `userId`, `action`, `resourceId`, and `metadata`.

## 2. Implementation Standards
- **Backend (API)**:
    - Use the project's standard Logger service (e.g., `src/services/logger.ts` or similar).
    - Example:
      ```typescript
      await Logger.info({
        event: 'POST_CREATED',
        userId: user.id,
        metadata: { postId: newPost.id }
      });
      ```
- **Database (Supabase)**:
    - Ensure tables have `created_at`, `updated_at`, and `created_by` columns.
    - Check if specific Audit Table inserts are required (e.g. `audit_logs` table).

## 3. Verification Checklist
- [ ] Does the new API endpoint call `Logger`?
- [ ] Are logs visible in Supabase/Dashboards?
- [ ] Is the log level appropriate (Info vs Error)?
- [ ] Does the log contain enough context to debug issues later?