# Audit trail and permissions

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
Trust comes from accountability: the credentials vault (Zugangsdaten-Tresor) logs every action with who, when and why, without ever storing a secret in plaintext. This page covers what exactly is logged, where to find the log and what each role may do.
</Lead>

## What gets logged

Each of these actions creates a log entry:

- **Creating, editing and deleting** an entry
- **Revealing** a secret, including the stated reason for entries on the sensitive level
- **Sharing** with the team, plus creating and revoking **external links**, including the mandatory reason
- **Importing** entries from CSV
- **Setting up and deactivating vault 2FA**
- **Saving the team policies**
- **Filling a staff-logins template**

Only metadata is stored: which person, which entry, which action, when, and the reason if one was given. **Plaintext secrets never appear in the log.** The reveal dialog says exactly that: **Jeder Zugriff wird protokolliert (Wer, Wann, Warum).** (every access is logged: who, when, why).

## Where to find the log

The vault has no audit view of its own. All entries land in the **central audit log of your workspace** under **Settings > Aktivität** (activity, `/settings/activity`), together with the activity of every other tool. That view is reserved for owners and admins.

## Webhook events

If you want to forward vault events into your own systems, you can subscribe to them per endpoint under **Settings > Webhooks** (`/settings/webhooks`). The vault emits these events:

| Event | Meaning |
|---|---|
| `credential.created` | A new credentials entry was created. |
| `credential.updated` | A credentials entry was changed. |
| `credential.deleted` | A credentials entry was removed. |
| `credential.shared` | An entry was shared with team members. |
| `credential.external_shared` | An entry was shared via an external link. |
| `credential.revealed` | A secret was revealed in plaintext. |
| `credential.imported` | Credentials were imported. |
| `credential.template_provisioned` | A staff-logins template was filled. |

Webhook payloads also contain metadata only, never the secret itself.

## Roles and permissions

The platform knows the roles **owner (Inhaber:in)**, **admin**, **member (Mitglied)** and **viewer (Beobachter:in)**. In the table below they appear as Owner, Admin, Employee (= member) and External Viewer (= viewer). The owner always holds every right. "Scoped" means: only for entries you created or manage yourself.

<PermissionTable
  caption="Default permissions in the credentials vault"
  roles="tenant_owner,tenant_admin,employee,external_viewer"
>
  <Permission
    action="tools.use.credentials"
    label="Open the vault"
    description="See the tool and use the entry list."
    allow="yes,yes,yes,no"
  />
  <Permission
    action="credentials.read.all"
    label="See all shared entries"
    description="Members otherwise only see their own entries plus what was shared with them."
    allow="yes,yes,scoped,no"
  />
  <Permission
    action="credentials.create"
    label="Create and import entries"
    description="Create new entries, use the CSV import, fill staff-logins templates."
    allow="yes,yes,yes,no"
  />
  <Permission
    action="credentials.update"
    label="Edit entries"
    description="Members edit their own entries through the permanent creator grant."
    allow="yes,yes,scoped,no"
  />
  <Permission
    action="credentials.delete"
    label="Delete entries (trash)"
    allow="yes,yes,no,no"
  />
  <Permission
    action="credentials.share"
    label="Share (internally and externally)"
    description="Applies only to entries you manage yourself."
    allow="yes,yes,scoped,no"
  />
  <Permission
    action="credentials.manage_groups"
    label="Manage groups"
    allow="yes,yes,no,no"
  />
  <Permission
    action="credentials.admin"
    label="Save vault policies"
    allow="yes,yes,no,no"
  />
</PermissionTable>

<Info title="Personal entries stay personal">
Even the right to see all entries only covers shared entries. Entries with visibility **Persönlich** (personal) are visible solely to the person who created them; the only technical exception is the workspace owner. Details: [Sharing](/tools/zugangsdaten-tresor/teilen#personal-or-shared).
</Info>

## Further reading

How shares and external links work day to day is shown in [Sharing](/tools/zugangsdaten-tresor/teilen). The mandatory reason when revealing sensitive entries is explained in [Security](/tools/zugangsdaten-tresor/sicherheit). Back to the overview: [Credentials vault](/tools/zugangsdaten-tresor).