Querying the Maxi AI Core audit log for site activity

Maxi AI Core records all significant actions in an append-only audit log. Every content mutation, license activation, AI provider key rotation, OAuth token event, email send, and data masking change leaves a permanent entry you can query at any time. Use the audit log to review what agents have done, investigate unexpected behavior, and verify that your security controls are working as expected.

Query the audit log regularly — not just when something goes wrong. Unexpected patterns (content created at unusual times, repeated token validation failures, unrecognized OAuth clients) are easier to catch early.

Querying events

Call maxi/get-audit-events to retrieve audit log entries. You can filter by category, specific event name, or a timestamp to narrow results. Parameters:

Parameter	Type	Description
`category`	string	Filter by event category (see categories below)
`event`	string	Filter by specific event name
`since`	string	Return only events after this timestamp (`Y-m-d H:i:s`)

Example: all content mutations

{
  "category": "content"
}

Example: license events only

{
  "category": "license"
}

Example: events since a specific time

{
  "category": "oauth",
  "since": "2025-01-01 00:00:00"
}

Response format

Each audit log entry has the following fields:

Field	Description
`id`	Unique entry ID
`ts`	Timestamp of the event
`category`	Event category (e.g. `content`, `key`, `oauth`)
`event`	Specific event name (e.g. `content_created`, `rotated`)
`actor_id`	WordPress user ID of the user who triggered the event
`subject`	The object the event relates to (e.g. a post ID, a client ID)
`context`	Additional structured data specific to the event type

Example response entry

{
  "id": 1042,
  "ts": "2025-05-10 14:23:07",
  "category": "content",
  "event": "content_created",
  "actor_id": 5,
  "subject": "post:312",
  "context": {
    "post_type": "post"
  }
}

Event categories

content — content mutations

Records every change to posts, pages, and custom post types.

Event	Description	Context fields
`content_created`	New post or page created	`post_type`
`content_updated`	Post or page updated	`updated_fields` (array of changed field keys)
`content_deleted`	Post or page deleted or trashed	`force` (true = permanent delete, false = trash)
`content_duplicated`	Post or page duplicated	`source_id` (original post ID)
`status_changed`	Post status changed	`from`, `to`
`content_scheduled`	Post scheduled for future publication	`date`
`author_changed`	Post author changed	`from`, `to` (user IDs)
`parent_changed`	Post parent changed	`from`, `to` (post IDs)

{ "category": "content" }

key — API key events

Records all AI provider credential activity.

Event	Description
`rotated`	A provider key was successfully rotated
`validation_failed`	A rotation attempt failed the live validation test

Both events include the provider name in context.

{ "category": "key" }

license — license lifecycle

Records license activation and deactivation events.

Event	Description
`activated`	License activated successfully
`activation_failed`	License activation attempt failed
`deactivated`	License deactivated

{ "category": "license" }

oauth — OAuth token lifecycle

Records every stage of the OAuth 2.1 flow — client registration, authorization, token issuance, and revocation.

Event	Description	Context fields
`client_registered`	A new OAuth client registered via DCR	`auth_method`, `redirect_uris_count`, `client_name`, `ip`. Subject: `client_id`
`code_issued`	Authorization code minted	`user_id`, `scopes`, `resource`, `path`
`token_issued`	Access and refresh token pair issued	`user_id`, `grant_type`, `scopes`
`token_refreshed`	Token pair rotated
`token_revoked`	Token invalidated	`token_type_hint`
`token_validation_failed`	Bearer token rejected	`reason`. Subject: masked first-8 chars of token

{ "category": "oauth" }

Token validation failures with reason: unknown_or_expired_or_revoked are worth monitoring — repeated failures may indicate a misconfigured client or a stolen token replay attempt.

notes — notes activity

Records significant note lifecycle events.

{ "category": "notes" }

wp_cli — WP-CLI command execution

Records every WP-CLI command attempted via maxi/run-wp-cli, including rejected commands and the rejection reason.

{ "category": "wp_cli" }

email — email sends

Records every email sent via maxi/send-email. Includes recipient, subject, and from identity. The email body is not logged.

{ "category": "email" }

data_masking — masking list changes

Records additions and removals from the GDPR data masking field list managed via maxi/manage-mask-fields.

{ "category": "data_masking" }

rules — ability rule events

Records rule-related events, including blocked ability calls and rule sync operations.

{ "category": "rules" }

Audit log integrity

The audit log is append-only. Each entry is recorded with a tamper-evident hash incorporating prior entries — modifying historical records breaks the chain from that point forward. Query the log regularly and investigate any unexpected gaps or patterns in the recorded events.

Get Started

Core Concepts

Connect AI Clients

Security

Configuration

Querying the Maxi AI Core audit log for site activity

Querying events

Example: all content mutations

Example: license events only

Example: events since a specific time

Response format

Example response entry

Event categories

Audit log integrity

​Querying events

​Example: all content mutations

​Example: license events only

​Example: events since a specific time

​Response format

​Example response entry

​Event categories

​Audit log integrity

Querying events

Example: all content mutations

Example: license events only

Example: events since a specific time

Response format

Example response entry

Event categories

Audit log integrity