Signal exposes different records for different operational questions.
Use audit logs for meaningful customer actions, API-key usage for requests made with one credential, and email timelines for delivery state.
Evidence map
Audit logs
The Logs page is an organization-wide customer audit trail available to owner and administrator roles.
It is not a raw record of every Email API request.
Filter by text, date, module, action, resource, or status.
A detail can include actor and role context, resource identity, timestamp, action status, customer-visible security and request context, a change summary, related activity, and technical identifiers.
Customer-visible modules include email, webhook, API key, settings, notification, and export activity.
Actions include create, update, delete, deliver, trigger, retry, fail, and export.
API-key usage
A key record exposes its masked value, permissions, status, total requests, last-used time, creation time, and expiry.
The raw secret is never returned after creation.
With usage:read, the API can list recent requests for one key with a maximum page size of 500 and before/after ISO 8601 filters.
It can export the full selected range as CSV or JSON.
The dashboard usage view includes request status code and duration when available.
Rotation evidence
- Create and deploy the replacement key.
- Confirm its last-used time and usage records advance.
- Confirm the old key stops receiving the expected requests.
- Delete the old key.
- Inspect audit logs for the key lifecycle actions.
Audit and usage output can contain customer and infrastructure context.
Restrict access and redact it before copying evidence into public tickets.
