Add audit log feature for recording all actions

Adds audit logging that records all authorized actions performed by users and API keys. The audit log is automatically populated whenever the authorizer approves an action, and is queryable via GraphQL, MCP, and CLI interfaces. Permission checks are excluded via a dry-run flag to avoid phantom entries on page loads. Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2026-03-20 15:42:11 +01:00
parent 000347b1f9
commit 7b320916af
34 changed files with 2546 additions and 13 deletions
--- a/pkg/server/api/authz/authorization.go
+++ b/pkg/server/api/authz/authorization.go
@@ -41,7 +41,13 @@ func WithAttr(key, value string) AuthorizeFuncOption {
 // Example: on the viewer memberships page, we're accessing several organization names, but the viewer isn't assuming one yet.
 func WithSkipAssumptionCheck() AuthorizeFuncOption {
 	return func(params *iam.AuthorizeParams) {
-		params.Session = nil
+		params.SkipAssumptionCheck = true
+	}
+}
+
+func WithDryRun() AuthorizeFuncOption {
+	return func(params *iam.AuthorizeParams) {
+		params.DryRun = true
 	}
 }

--- a/pkg/server/api/connect/v1/resolver.go
+++ b/pkg/server/api/connect/v1/resolver.go
@@ -65,7 +65,7 @@ func NewMux(logger *log.Logger, svc *iam.Service, cookieConfig securecookie.Conf
 }

 func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) {
-	return r.authorize(ctx, obj.GetID(), action) == nil, nil
+	return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil
 }

 func (r *Resolver) SSOLoginURL(samlConfigID gid.GID) string {
--- a/pkg/server/api/connect/v1/schema.graphql
+++ b/pkg/server/api/connect/v1/schema.graphql
@@ -243,6 +243,15 @@ type Organization implements Node {

  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)

+  auditLogEntries(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: AuditLogEntryOrder
+    filter: AuditLogEntryFilter
+  ): AuditLogEntryConnection! @goField(forceResolver: true)
+
  viewer: Profile @goField(forceResolver: true)

  permission(action: String!): Boolean!
@@ -602,6 +611,79 @@ type SCIMEventEdge {
  cursor: CursorKey!
 }

+enum AuditLogActorType
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.AuditLogActorType"
+  ) {
+  USER
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeUser"
+    )
+  API_KEY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeAPIKey"
+    )
+  SYSTEM
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeSystem"
+    )
+}
+
+enum AuditLogEntryOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderField"
+  ) {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderFieldCreatedAt"
+    )
+}
+
+input AuditLogEntryOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.AuditLogEntryOrderBy"
+  ) {
+  field: AuditLogEntryOrderField!
+  direction: OrderDirection!
+}
+
+input AuditLogEntryFilter {
+  action: String
+  actorId: ID
+  resourceType: String
+  resourceId: ID
+}
+
+type AuditLogEntry implements Node {
+  id: ID!
+  organization: Organization @goField(forceResolver: true)
+  actorId: ID!
+  actorType: AuditLogActorType!
+  action: String!
+  resourceType: String!
+  resourceId: ID!
+  metadata: String
+  createdAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type AuditLogEntryConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.AuditLogEntryConnection"
+  ) {
+  edges: [AuditLogEntryEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int! @goField(forceResolver: true)
+}
+
+type AuditLogEntryEdge {
+  cursor: CursorKey!
+  node: AuditLogEntry!
+}
+
 type PageInfo {
  hasNextPage: Boolean!
  hasPreviousPage: Boolean!
--- a/pkg/server/api/connect/v1/types/audit_log_entry.go
+++ b/pkg/server/api/connect/v1/types/audit_log_entry.go
@@ -0,0 +1,85 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	AuditLogEntryOrderBy OrderBy[coredata.AuditLogEntryOrderField]
+
+	AuditLogEntryConnection struct {
+		TotalCount int
+		Edges      []*AuditLogEntryEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+		Filter   *coredata.AuditLogEntryFilter
+	}
+)
+
+func NewAuditLogEntryConnection(
+	p *page.Page[*coredata.AuditLogEntry, coredata.AuditLogEntryOrderField],
+	resolver any,
+	parentID gid.GID,
+	filter *coredata.AuditLogEntryFilter,
+) *AuditLogEntryConnection {
+	edges := make([]*AuditLogEntryEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewAuditLogEntryEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &AuditLogEntryConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: resolver,
+		ParentID: parentID,
+		Filter:   filter,
+	}
+}
+
+func NewAuditLogEntryEdge(e *coredata.AuditLogEntry, orderBy coredata.AuditLogEntryOrderField) *AuditLogEntryEdge {
+	return &AuditLogEntryEdge{
+		Cursor: e.CursorKey(orderBy),
+		Node:   NewAuditLogEntry(e),
+	}
+}
+
+func NewAuditLogEntry(e *coredata.AuditLogEntry) *AuditLogEntry {
+	var metadata *string
+	if len(e.Metadata) > 0 {
+		metadata = new(string(e.Metadata))
+	}
+
+	return &AuditLogEntry{
+		ID: e.ID,
+		Organization: &Organization{
+			ID: e.OrganizationID,
+		},
+		ActorID:      e.ActorID,
+		ActorType:    e.ActorType,
+		Action:       e.Action,
+		ResourceType: e.ResourceType,
+		ResourceID:   e.ResourceID,
+		Metadata:     metadata,
+		CreatedAt:    e.CreatedAt,
+	}
+}
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -27,6 +27,32 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )

+// Organization is the resolver for the organization field.
+func (r *auditLogEntryResolver) Organization(ctx context.Context, obj *types.AuditLogEntry) (*types.Organization, error) {
+	return obj.Organization, nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *auditLogEntryResolver) Permission(ctx context.Context, obj *types.AuditLogEntry, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *auditLogEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditLogEntryConnection) (int, error) {
+	filter := coredata.NewAuditLogEntryFilter()
+	if obj.Filter != nil {
+		filter = obj.Filter
+	}
+
+	count, err := r.iam.OrganizationService.CountAuditLogEntries(ctx, obj.ParentID, filter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot count audit log entries", log.Error(err))
+		return 0, gqlutils.Internal(ctx)
+	}
+
+	return count, nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -1302,6 +1328,50 @@ func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types
 	return types.NewSCIMConfiguration(config), nil
 }

+// AuditLogEntries is the resolver for the auditLogEntries field.
+func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
+		Field:     coredata.AuditLogEntryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.AuditLogEntryOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	c := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	coredataFilter := coredata.NewAuditLogEntryFilter()
+	if filter != nil {
+		if filter.Action != nil {
+			coredataFilter.WithAction(*filter.Action)
+		}
+		if filter.ActorID != nil {
+			coredataFilter.WithActorID(*filter.ActorID)
+		}
+		if filter.ResourceType != nil {
+			coredataFilter.WithResourceType(*filter.ResourceType)
+		}
+		if filter.ResourceID != nil {
+			coredataFilter.WithResourceID(*filter.ResourceID)
+		}
+	}
+
+	p, err := r.iam.OrganizationService.ListAuditLogEntries(ctx, obj.ID, c, coredataFilter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list audit log entries", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewAuditLogEntryConnection(p, r, obj.ID, coredataFilter), nil
+}
+
 // Viewer is the resolver for the viewer field.
 func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
@@ -1909,6 +1979,14 @@ func (r *sessionConnectionResolver) TotalCount(ctx context.Context, obj *types.S
 	return nil, gqlutils.Internal(ctx)
 }

+// AuditLogEntry returns schema.AuditLogEntryResolver implementation.
+func (r *Resolver) AuditLogEntry() schema.AuditLogEntryResolver { return &auditLogEntryResolver{r} }
+
+// AuditLogEntryConnection returns schema.AuditLogEntryConnectionResolver implementation.
+func (r *Resolver) AuditLogEntryConnection() schema.AuditLogEntryConnectionResolver {
+	return &auditLogEntryConnectionResolver{r}
+}
+
 // Connector returns schema.ConnectorResolver implementation.
 func (r *Resolver) Connector() schema.ConnectorResolver { return &connectorResolver{r} }

@@ -1980,6 +2058,8 @@ func (r *Resolver) SessionConnection() schema.SessionConnectionResolver {
 	return &sessionConnectionResolver{r}
 }

+type auditLogEntryResolver struct{ *Resolver }
+type auditLogEntryConnectionResolver struct{ *Resolver }
 type connectorResolver struct{ *Resolver }
 type identityResolver struct{ *Resolver }
 type invitationResolver struct{ *Resolver }
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -203,5 +203,5 @@ func (r *Resolver) ProboService(ctx context.Context, tenantID gid.TenantID) *pro
 }

 func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) {
-	return r.authorize(ctx, obj.GetID(), action) == nil, nil
+	return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil
 }
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -524,6 +524,34 @@ enum WebhookSubscriptionOrderField
        )
 }

+enum AuditLogActorType
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.AuditLogActorType"
+    ) {
+    USER
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeUser"
+        )
+    API_KEY
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeAPIKey"
+        )
+    SYSTEM
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditLogActorTypeSystem"
+        )
+}
+
+enum AuditLogEntryOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderField"
+    ) {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditLogEntryOrderFieldCreatedAt"
+        )
+}
+
 enum RiskOrderField
    @goModel(model: "go.probo.inc/probo/pkg/coredata.RiskOrderField") {
    CREATED_AT
@@ -2018,6 +2046,15 @@ type Organization implements Node {
        orderBy: WebhookSubscriptionOrder
    ): WebhookSubscriptionConnection! @goField(forceResolver: true)

+    auditLogEntries(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: AuditLogEntryOrder
+        filter: AuditLogEntryFilter
+    ): AuditLogEntryConnection! @goField(forceResolver: true)
+
    createdAt: Datetime!
    updatedAt: Datetime!

@@ -5956,3 +5993,48 @@ type ElectronicSignatureEvent {
    occurredAt: Datetime!
    createdAt: Datetime!
 }
+
+# Audit Log
+
+input AuditLogEntryOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.AuditLogEntryOrderBy"
+    ) {
+    field: AuditLogEntryOrderField!
+    direction: OrderDirection!
+}
+
+input AuditLogEntryFilter {
+    action: String
+    actorId: ID
+    resourceType: String
+    resourceId: ID
+}
+
+type AuditLogEntry implements Node {
+    id: ID!
+    organization: Organization @goField(forceResolver: true)
+    actorId: ID!
+    actorType: AuditLogActorType!
+    action: String!
+    resourceType: String!
+    resourceId: ID!
+    metadata: String
+    createdAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type AuditLogEntryConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.AuditLogEntryConnection"
+    ) {
+    edges: [AuditLogEntryEdge!]!
+    pageInfo: PageInfo!
+    totalCount: Int! @goField(forceResolver: true)
+}
+
+type AuditLogEntryEdge {
+    cursor: CursorKey!
+    node: AuditLogEntry!
+}
--- a/pkg/server/api/console/v1/types/audit_log_entry.go
+++ b/pkg/server/api/console/v1/types/audit_log_entry.go
@@ -0,0 +1,85 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	AuditLogEntryOrderBy OrderBy[coredata.AuditLogEntryOrderField]
+
+	AuditLogEntryConnection struct {
+		TotalCount int
+		Edges      []*AuditLogEntryEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+		Filter   *coredata.AuditLogEntryFilter
+	}
+)
+
+func NewAuditLogEntryConnection(
+	p *page.Page[*coredata.AuditLogEntry, coredata.AuditLogEntryOrderField],
+	parentType any,
+	parentID gid.GID,
+	filter *coredata.AuditLogEntryFilter,
+) *AuditLogEntryConnection {
+	edges := make([]*AuditLogEntryEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewAuditLogEntryEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &AuditLogEntryConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+		Filter:   filter,
+	}
+}
+
+func NewAuditLogEntryEdge(e *coredata.AuditLogEntry, orderBy coredata.AuditLogEntryOrderField) *AuditLogEntryEdge {
+	return &AuditLogEntryEdge{
+		Cursor: e.CursorKey(orderBy),
+		Node:   NewAuditLogEntry(e),
+	}
+}
+
+func NewAuditLogEntry(e *coredata.AuditLogEntry) *AuditLogEntry {
+	var metadata *string
+	if len(e.Metadata) > 0 {
+		metadata = new(string(e.Metadata))
+	}
+
+	return &AuditLogEntry{
+		ID: e.ID,
+		Organization: &Organization{
+			ID: e.OrganizationID,
+		},
+		ActorID:      e.ActorID,
+		ActorType:    e.ActorType,
+		Action:       e.Action,
+		ResourceType: e.ResourceType,
+		ResourceID:   e.ResourceID,
+		Metadata:     metadata,
+		CreatedAt:    e.CreatedAt,
+	}
+}
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -407,6 +407,32 @@ func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.Aud
 	}
 }

+// Organization is the resolver for the organization field.
+func (r *auditLogEntryResolver) Organization(ctx context.Context, obj *types.AuditLogEntry) (*types.Organization, error) {
+	return obj.Organization, nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *auditLogEntryResolver) Permission(ctx context.Context, obj *types.AuditLogEntry, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *auditLogEntryConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditLogEntryConnection) (int, error) {
+	filter := coredata.NewAuditLogEntryFilter()
+	if obj.Filter != nil {
+		filter = obj.Filter
+	}
+
+	count, err := r.iam.OrganizationService.CountAuditLogEntries(ctx, obj.ParentID, filter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot count audit log entries", log.Error(err))
+		return 0, gqlutils.Internal(ctx)
+	}
+
+	return count, nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *complianceExternalURLResolver) Permission(ctx context.Context, obj *types.ComplianceExternalURL, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -7246,6 +7272,50 @@ func (r *organizationResolver) WebhookSubscriptions(ctx context.Context, obj *ty
 	return types.NewWebhookSubscriptionConnection(page, r, obj.ID), nil
 }

+// AuditLogEntries is the resolver for the auditLogEntries field.
+func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
+	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
+		Field:     coredata.AuditLogEntryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.AuditLogEntryOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	coredataFilter := coredata.NewAuditLogEntryFilter()
+	if filter != nil {
+		if filter.Action != nil {
+			coredataFilter.WithAction(*filter.Action)
+		}
+		if filter.ActorID != nil {
+			coredataFilter.WithActorID(*filter.ActorID)
+		}
+		if filter.ResourceType != nil {
+			coredataFilter.WithResourceType(*filter.ResourceType)
+		}
+		if filter.ResourceID != nil {
+			coredataFilter.WithResourceID(*filter.ResourceID)
+		}
+	}
+
+	p, err := r.iam.OrganizationService.ListAuditLogEntries(ctx, obj.ID, cursor, coredataFilter)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list audit log entries", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewAuditLogEntryConnection(p, r, obj.ID, coredataFilter), nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *organizationResolver) Permission(ctx context.Context, obj *types.Organization, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -9752,6 +9822,14 @@ func (r *Resolver) AuditConnection() schema.AuditConnectionResolver {
 	return &auditConnectionResolver{r}
 }

+// AuditLogEntry returns schema.AuditLogEntryResolver implementation.
+func (r *Resolver) AuditLogEntry() schema.AuditLogEntryResolver { return &auditLogEntryResolver{r} }
+
+// AuditLogEntryConnection returns schema.AuditLogEntryConnectionResolver implementation.
+func (r *Resolver) AuditLogEntryConnection() schema.AuditLogEntryConnectionResolver {
+	return &auditLogEntryConnectionResolver{r}
+}
+
 // ComplianceExternalURL returns schema.ComplianceExternalURLResolver implementation.
 func (r *Resolver) ComplianceExternalURL() schema.ComplianceExternalURLResolver {
 	return &complianceExternalURLResolver{r}
@@ -10067,6 +10145,8 @@ type assetResolver struct{ *Resolver }
 type assetConnectionResolver struct{ *Resolver }
 type auditResolver struct{ *Resolver }
 type auditConnectionResolver struct{ *Resolver }
+type auditLogEntryResolver struct{ *Resolver }
+type auditLogEntryConnectionResolver struct{ *Resolver }
 type complianceExternalURLResolver struct{ *Resolver }
 type complianceFrameworkResolver struct{ *Resolver }
 type controlResolver struct{ *Resolver }
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -3312,3 +3312,50 @@ func (r *Resolver) GetAuditReportUrlTool(ctx context.Context, req *mcp.CallToolR
 		URL: *url,
 	}, nil
 }
+
+func (r *Resolver) ListAuditLogEntriesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditLogEntriesInput) (*mcp.CallToolResult, types.ListAuditLogEntriesOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, iam.ActionAuditLogEntryList)
+
+	pageOrderBy := page.OrderBy[coredata.AuditLogEntryOrderField]{
+		Field:     coredata.AuditLogEntryOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
+
+	filter := coredata.NewAuditLogEntryFilter()
+	if input.Filter != nil {
+		if input.Filter.Action != nil {
+			filter.WithAction(*input.Filter.Action)
+		}
+		if input.Filter.ActorID != nil {
+			filter.WithActorID(*input.Filter.ActorID)
+		}
+		if input.Filter.ResourceType != nil {
+			filter.WithResourceType(*input.Filter.ResourceType)
+		}
+		if input.Filter.ResourceID != nil {
+			filter.WithResourceID(*input.Filter.ResourceID)
+		}
+	}
+
+	p, err := r.iamSvc.OrganizationService.ListAuditLogEntries(ctx, input.OrganizationID, cursor, filter)
+	if err != nil {
+		panic(fmt.Errorf("cannot list audit log entries: %w", err))
+	}
+
+	return nil, types.NewListAuditLogEntriesOutput(p), nil
+}
+
+func (r *Resolver) GetAuditLogEntryTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditLogEntryInput) (*mcp.CallToolResult, types.GetAuditLogEntryOutput, error) {
+	r.MustAuthorize(ctx, input.ID, iam.ActionAuditLogEntryGet)
+
+	entry, err := r.iamSvc.OrganizationService.GetAuditLogEntry(ctx, input.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get audit log entry: %w", err))
+	}
+
+	return nil, types.GetAuditLogEntryOutput{
+		AuditLogEntry: types.NewAuditLogEntry(entry),
+	}, nil
+}
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -6428,6 +6428,110 @@ components:
        organization_context:
          $ref: "#/components/schemas/OrganizationContext"

+    GetAuditLogEntryInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Audit log entry ID
+
+    GetAuditLogEntryOutput:
+      type: object
+      required:
+        - audit_log_entry
+      properties:
+        audit_log_entry:
+          $ref: "#/components/schemas/AuditLogEntry"
+
+    ListAuditLogEntriesInput:
+      type: object
+      required:
+        - organization_id
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        size:
+          type: integer
+          description: Page size
+        cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Page cursor
+        filter:
+          type: object
+          properties:
+            action:
+              type: string
+              description: Filter by action (e.g. "core:vendor:create")
+            actor_id:
+              $ref: "#/components/schemas/GID"
+              description: Filter by actor ID
+            resource_type:
+              type: string
+              description: Filter by resource type (e.g. "Vendor")
+            resource_id:
+              $ref: "#/components/schemas/GID"
+              description: Filter by resource ID
+
+    ListAuditLogEntriesOutput:
+      type: object
+      required:
+        - audit_log_entries
+      properties:
+        next_cursor:
+          $ref: "#/components/schemas/CursorKey"
+          description: Next cursor
+        audit_log_entries:
+          type: array
+          items:
+            $ref: "#/components/schemas/AuditLogEntry"
+
+    AuditLogEntry:
+      type: object
+      required:
+        - id
+        - organization_id
+        - actor_id
+        - actor_type
+        - action
+        - resource_type
+        - resource_id
+        - created_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Audit log entry ID
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        actor_id:
+          $ref: "#/components/schemas/GID"
+          description: ID of the actor who performed the action
+        actor_type:
+          type: string
+          enum: [USER, API_KEY, SYSTEM]
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.AuditLogActorType
+          description: Type of actor
+        action:
+          type: string
+          description: Action performed (e.g. "core:vendor:create")
+        resource_type:
+          type: string
+          description: Type of resource affected (e.g. "Vendor")
+        resource_id:
+          $ref: "#/components/schemas/GID"
+          description: ID of the affected resource
+        metadata:
+          type: object
+          description: Additional metadata about the action
+        created_at:
+          type: string
+          format: date-time
+          go.probo.inc/mcpgen/type: time.Time
+          description: When the action was performed
+
 tools:
  - name: listOrganizations
    description: List all organizations the user has access to
@@ -7572,3 +7676,21 @@ tools:
      $ref: "#/components/schemas/UpdateOrganizationContextInput"
    outputSchema:
      $ref: "#/components/schemas/UpdateOrganizationContextOutput"
+  - name: getAuditLogEntry
+    description: Get an audit log entry by ID
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetAuditLogEntryInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetAuditLogEntryOutput"
+  - name: listAuditLogEntries
+    description: List audit log entries for the organization. Audit log entries record write actions (create, update, delete) performed by users and API keys.
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/ListAuditLogEntriesInput"
+    outputSchema:
+      $ref: "#/components/schemas/ListAuditLogEntriesOutput"
--- a/pkg/server/api/mcp/v1/types/audit_log_entry.go
+++ b/pkg/server/api/mcp/v1/types/audit_log_entry.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewAuditLogEntry(e *coredata.AuditLogEntry) *AuditLogEntry {
+	return &AuditLogEntry{
+		ID:             e.ID,
+		OrganizationID: e.OrganizationID,
+		ActorID:        e.ActorID,
+		ActorType:      AuditLogEntryActorType(e.ActorType),
+		Action:         e.Action,
+		ResourceType:   e.ResourceType,
+		ResourceID:     e.ResourceID,
+		CreatedAt:      e.CreatedAt,
+	}
+}
+
+func NewListAuditLogEntriesOutput(p *page.Page[*coredata.AuditLogEntry, coredata.AuditLogEntryOrderField]) ListAuditLogEntriesOutput {
+	entries := make([]*AuditLogEntry, 0, len(p.Data))
+	for _, e := range p.Data {
+		entries = append(entries, NewAuditLogEntry(e))
+	}
+
+	var nextCursor *page.CursorKey
+	if len(p.Data) > 0 {
+		cursorKey := p.Data[len(p.Data)-1].CursorKey(p.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+
+	return ListAuditLogEntriesOutput{
+		NextCursor:      nextCursor,
+		AuditLogEntries: entries,
+	}
+}