Auditing your Redox platform

Last updated: Oct 29, 2026

PRODUCT OWNER

HCO

HEALTH TECH VENDOR

New release coming soon

This feature is getting some upgrades. You might see details based on the next release, so some of these changes might not exist in production just yet. Stay tuned for the release!

For any organization handling confidential data, maintaining a clear and comprehensive audit trail is not just a best practice—it’s often a requirement for security compliance (like HIPAA and SOC 2). Our audit events provide a complete record of all significant actions taken within your Redox organization.

Why use auditing

Answer “who did what, and when?”: Securely log all user activity, from viewing a log containing PHI to changing a user’s permissions.
Monitor for security risks: Proactively track events like failed login attempts or unauthorized access to confidential data.
Troubleshoot issues: See a step-by-step history of configuration changes to understand how and when a problem occurred.
Automate compliance: Use the Redox Platform API to programmatically pull audit events into your own security and compliance monitoring tools. Review the Get audit events spec.

Who can use auditing

Auditing is an advanced feature. Once you’ve upgraded your plan to include this advanced feature, auditing is available to Redox organization owners.

What events can you audit

Our auditing feature tracks two major categories of events:

Principal activity: An action a principal (i.e., user or service account) takes that could affect your organization’s configuration or assets.
Principal access: An action a principal (i.e., user or service account) takes related to user accounts and permissions.

Confidential data in audit events

Keep in mind that audit events may contain confidential data like personal health information (PHI), especially when viewing log payloads.

Principal activity events

For example, you can track when a principal:

creates, updates, or deletes any connectivity settings (e.g., OAuth API keys, sources, or destinations);
views or modifies any data operations (e.g., translation sets, filters, config modifiers); and
views or searches logs, as well as runs log inspector.

Technical descriptions of principal activity events

Review each available audit event and what they mean.

Audit event	Description
organization-operation	A principal updated any Redox organization settings, including enabling or disabling AI feature toggles. Learn how to enable AI features.
log-payload-viewed	A principal viewed the given logs at the specified time. Learn about logs.
log-search	A principal searched the given logs, including metadata and payloads. Learn how to search logs.
log-retried	A principal re-sent a log, whether successful or failed. Learn how to retry a log.
log-inspected	A principal ran log inspector to test or troubleshoot a log. Learn about log inspector.
log-summary-operation	A principal generated a log or payload summary with one of our AI assistants. Learn about logs.
oauth2-api-key-operation	A principal created, updated, or deleted an OAuth API key. Learn about authenticating Redox APIs.
oauth-authorization-operation	A principal created, updated, or deleted the OAuth API key for a service account. Learn how to authenticate service accounts.
source-operation	A principal created, updated, or deleted a source. For legacy API key users: This audit event also applies to actions taken on legacy API keys. This is because there’s a 1:1 relationship between sources and legacy API keys. Learn about authenticating and sending data via Redox.
destination-operation	A principal created, updated, or deleted a destination configured to receive data within a Redox organization. Learn about receiving data from Redox.
auth-credential-viewed	A user viewed a given auth credential at the specified time. Learn about auth credentials.
auth-credential-operation	A principal created, updated, or deleted an auth credential in a Redox organization. Learn about auth credentials.
customer-filter-viewed	A principal viewed a given filter at the specified time. Learn about filters.
customer-filter-operation	A principal created, updated, or deleted a filter for a subscription in a Redox organization. Learn about filters.
customer-filter-restore-version	A principal restored a filter version to a previously used one. Learn how to restore assets.
customer-filter-link-viewed	A principal viewed a given filter link at the specified time. Learn how to manage filters and links.
customer-filter-link-operation	A principal created, updated, or deleted a filter link within a Redox organization. Learn how to manage filters and links.
redox-filter-operation	A Redoxer created, updated, or deleted a Redox filter used in your subscription. Learn about operations for data processing.
translation-set-viewed	A user viewed a given translation set at the specified time. Learn about translation sets.
translation-set-operation	A principal created, updated, or deleted a translation set within a Redox organization. Learn about translation sets.
translation-set-restore-version	A principal restored a translation set version to a previously used one. Learn how to restore assets.
translation-set-link-viewed	A user viewed which translation set link and when. Learn about translation sets.
translation-set-link-operation	A principal created, updated, or deleted a translation set link within a Redox organization. Learn about translation sets.
value-set-viewed	A principal viewed a given value set at the specified time. Learn about value sets.
value-set-operation	A principal created, updated, or deleted a value set within a Redox organization. Learn about value sets.
configurations-operation	A principal viewed a Redox base config (within log inspector) at the specified time. Learn about Redox base configs.
configuration-modifier-viewed	A principal viewed the given config modifier(s) at the specified time. Learn about config modifiers.
configuration-modifier-operation	A principal created, updated, or deleted a config modifier within a Redox organization. This includes when a principal interacts with Config Modifier Assistant. Learn about config modifiers.
configuration-modifier-restore-version	A principal restored a config modifier version to a previously used one. Learn how to restore assets.
configuration-modifier-link-viewed	A user viewed the given config modifier link(s) at the specified time. Learn about config modifiers.
configuration-modifier-link-operation	A principal created, updated, deleted, or set the processing order of a config modifier link. Learn about config modifiers.
redox-base-config-assignment-operation	A Redoxer assigned a base config to one of your sources or subscriptions. Learn about operations for data processing.
ai-invocation-operation	A principal gave feedback (i.e., thumbs up or thumbs down) on a response from the Config Modifier Assistant. Learn about config modifiers.
ai-invocation-viewed	A Redoxer viewed the details of an AI invocation (i.e., an interaction with any Redox AI tool) in a Redox organization.
mcp-tool-invocation	A Redoxer viewed the details of an MCP invocation (i.e., an interaction with the Redox MCP server) in a Redox organization.
user-script-operation	An automated script ran to interact within a Redox organization.
customer-alert-viewed	A principal viewed a given traffic alert rule at the specified time. Learn about alert rules.
customer-alert-operation	A principal created, updated, or deleted a traffic alert rule within a Redox organization. Learn about alert rules.
customer-alert-link-viewed	A user viewed a given traffic alert rule link(s) at the specified time. Learn about alert rules.
customer-alert-link-operation	A principal created, updated, or deleted a traffic alert rule link within a Redox organization. Learn about alert rules.
processor-operation	A Redoxer created, updated, or deleted a processor within a Redox organization. Learn about processors.
processor-viewed	A user viewed a given processor at the specified time. Learn about processors.
processor-operation-type-viewed	A user viewed a processor type (i.e., a template to build a processor from) at the specified time.
processor-link-viewed	A user viewed the included processor link(s). Learn about processors.
processor-link-operation	A Redoxer created, updated, or deleted a processor link within a Redox organization. Learn about processors.
processor-grant-viewed	A user viewed details about a processor grant offered to another organization.
processor-grant-operation	A Redoxer created, updated, or deleted a processor grant for a subscription.
processor-grant-activation-viewed	A user viewed details about a processor grant being accepted.
processor-grant-activation-operation	A processor grant is activated or used.
processor-run-viewed	A principal viewed a processor run in the dashboard.
processor-run-inspected	A principal ran a processor in the dashboard to test or troubleshoot a log.
service-account-operation	A principal created, edited, disabled, or deleted a service account within a Redox organization. This includes any actions taken on its role assignments and authorization keys. Learn about service accounts.
vpn-operation	A principal set up, edited, or deleted a VPN configuration within a Redox organization.
port-map-operation	A principal set up and configured a port map within a Redox organization.
data-on-demand-operation	A Redoxer set up, updated, or deleted a data on demand repository within a Redox organization. Learn about data on demand.
dev-tools-operation	A principal interacted with one of the Redox test tools. Learn how to use test tools.
transaction-audit-viewed	A user looked at a destination’s network transaction log, which shows query traffic over a clinical network (Carequality by default). It records the time range, the network, and how many results came back.
organization-audit-viewed	A user opened the organization’s audit log. This records the viewed event IDs.
organization-auth-operation	A user changed the single sign-on (SSO) settings. This includes a) turning SSO on or off or b) adding, changing, migrating, or deleting the SAML login method.
connection-operation	A user interacted with a subscription. This includes a) a Redoxer creating, updating, deleting, or pausing/resuming a queue, or b) a principal comparing two subscriptions.
slug-operation	A Redoxer created or edited an organization’s slug (i.e., a routing key that sends messages to a specific destination, along with the environment and data model) or changed the route priority.
onramps-empi-admin-operation	A Redoxer made a change to record locator service (RLS) settings within a Redox organization.

Principal access events

For example, you can track when a principal:

logs in or switches between Redox organizations;
invites a new user to join the organization; and
changes another user’s role assignment.

Technical descriptions of user access events

Review each available audit event and what they mean.

Audit event	Description
organization-loaded	A principal opened (i.e., loaded) a Redox organization. This could be when a user automatically logs in to an organization or when a user switches to a different organization. Essentially, this is when an organization’s details are loaded for any reason, whether in the Redox dashboard or via API.
user-invited	Someone either invited a user to join a Redox organization or deleted a pending invitation. This event also includes an invited user’s assigned roles and groups. Learn how to add a user to an organization.
user-joined	A new user accepted an invitation to join a Redox organization. This also includes when a Redox admin added themselves to a Redox organization.
user-org-role-changed	Someone updated a principal’s role assignments to view or perform tasks within a Redox organization. Depending on the role assignment, a principal’s permissions could be elevated or lowered after this event. Learn about user roles.
user-removed	Someone removed a principal’s organization role. Without an organization role, a principal has zero access, meaning they won’t even see that it exists.
user-env-role-changed	Someone updated a principal’s role assignments to view or perform tasks within a given environment. Depending on the role assignment, a principal’s permissions could be elevated or lowered after this event. Learn about user roles.
user-env-role-removed	Someone removed a principal’s environment role. Without an environment role, a principal has zero access, meaning they won’t even see that it exists. Learn about user roles.
group-operation	A user created, edited, or deleted a Redox group for access control.
group-member-added	Someone added a principal to a Redox group. Learn how to manage roles and groups.
group-member-removed	Someone removed a principal from a Redox group. Learn how to manage roles and groups.
group-role-changed	An organization owner or admin updated a group’s role assignments to perform functions within a given environment. Depending on the role assignment, the group members’ permissions could be elevated or lowered after this event. Learn about user roles.
group-role-removed	A user removed a group’s existing role assignment.

Audit event statuses

When you review audit events, they’ll have an associated status, which could be any of the following:

Audit event status	Description
attempted	A user tried to perform a given action in a Redox organization, but we’re not sure how it turned out yet. This is an interim state, and it could change to any of the other statuses to show the terminal state.
unauthorized	A user was logged in to a Redox organization but didn’t have the correct role assignment to complete the action.
unauthenticated	A user wasn’t logged in to a Redox organization when trying to complete the action.
failed	A user tried to complete an action but wasn’t successful for some reason.
successful	A user tried to complete an action and was successful.

FHIR® is a registered trademark of Health Level Seven International (HL7) and is used with the permission of HL7. Use of this trademark does not constitute an endorsement of products/services by HL7®.