Retrieve audit logs and organization activity

chainctl events manages CloudEvents subscriptions, not stored audit queries. There is no self-serve audit-log export or query API today.

Supported pattern: subscribe to CloudEvents and store them yourself

Organization activity is emitted as CloudEvents. Subscribe and forward events to a webhook sink you own (for example S3, Splunk, or a SIEM), where you control retention:

chainctl events subscriptions create --parent <org-or-folder> https://<your-webhook-url>
chainctl events subscriptions list
chainctl events subscriptions delete <subscription-id>

Retention and export

There is no customer self-service audit-log viewer, export, or API today; the supported self-serve mechanism is CloudEvents subscriptions to a sink you own, where you control retention. Separately, access-token creation and token-exchange events are recorded with 90-day retention. Chainguard Support can provide these events on request through a manual process that includes a Security review and approval.