---
sidebar_position: 12.7
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lium.io/llms.txt
> Use this file to discover all available pages before exploring further.

# `lium audit`

:::note Since lium 0.0.37 — backend still to ship
`lium audit` and `Lium.events()` shipped in lium 0.0.37. The command needs a backend that serves `GET /users/me/events`
to API keys (lium-platform#208, not released): against today's API a run with an API key exits `3` with the hint below.
:::

Show who did what to the account's pods, and when.

```bash
lium audit [OPTIONS]   # since 0.0.37
```

Every rent, reboot, edit and delete names the session or API key that requested it; entries the platform wrote by
itself (a validator reply, a balance stop, a TTL) say `platform`. The log is the account's event log
(`GET /users/me/events`); there is no dashboard screen for it yet — see
[Who did what on the account](../../../pod-users/api-keys.md#who-did-what-on-the-account).

## Options

| Flag | Effect |
|------|--------|
| `--pod POD` | Only this pod: id, huid, name or index from the last `lium ps`; a deleted pod's history is reachable by its full id |
| `--since WHEN` | Only events after this: a duration (`24h`, `30m`, `7d`) or an ISO-8601 timestamp (read as UTC unless it carries an offset or `Z`); anything else exits `2` with the accepted forms |
| `--key API_KEY_ID` | Only actions made with this API key id — the full id (`lium audit --json` shows it as `actor.api_key_id`); the eight characters the **By** column prints exit `2` locally |
| `--limit N` | Newest events to fetch, `1`–`1000` (default `200`); out of range exits `2` locally, before any request |
| `--json` | Print the events as the API returns them (newest first) |

## Output

The table has four columns — **When (UTC)**, **Pod**, **What**, **By** — oldest first, so the log reads top-down.

- **What** is a short phrase per event type: `rent requested`, `created`, `delete requested`, `reboot failed`,
  `API key created`, …; lifecycle entries read `→ <status> (<reason>)`, with the recorded detail or error appended when
  there is one.
- **By** is `key <name> (<first 8 chars of the id>)` for an API key, `session` for the browser, `platform` when no actor
  made the request.

## Examples

```bash
lium audit                        # last 200 events, oldest first
lium audit --since 24h            # what happened today
lium audit --pod my-pod           # one pod's history, also after it was deleted (full id then)
lium audit --key 3f2a...          # everything one API key did
lium audit --json | jq '.[] | select(.actor.api_key_name == "ci")'
```

## Exit codes

| Code | When |
|------|------|
| `0` | Events printed (an empty log prints a one-line message) |
| `2` | `--since` is neither a duration nor an ISO timestamp; `--limit` outside `1`–`1000`; `--key` is not a full key id |
| `3` | The API refused or failed the call (401, 404, 429, 5xx) — the same code every command uses. On a 401: if the same key works for `lium ps`, the backend predates API-key access to `/users/me/events` — the hint says so, and with `--json` the envelope is `{"error": {"code": "auth_error", "message": …}, "ok": false}` |
| `5` | `--pod` names no listed pod (for a deleted pod give its full id) |

## See also

- [`lium ps`](./ps.md) — the pods the log is about
- [`lium describe`](./describe.md) — one pod in full
- [API keys](/pod-users/api-keys) — the keys the **By** column names
- The SDK: [`Lium.events()`](../../sdk.md#the-account-event-log-since-0037)