Audit and administration

tv admin audit list is the single retrieval surface across every audit domain in Thalix Vault: identity, device/token authentication, Root Folder/metadata changes, user-owned groups (creation, roles, invitations, ownership transfer, and administrator oversight), files, access grants, search, cross-domain authorization denials, and exceptional administrator content access. Every domain is projected to one common envelope so an administrator never needs to know which underlying table an event came from. For definitions of audit event, correlation ID, audit domain, append-only, audit details, redaction allowlist, and admin override, see Glossary.

Retrieving events

tv admin audit list --actor person@example.com --after 2026-08-01 --limit 50
tv admin audit list --action file. --result denied
tv admin audit list --target-type file --target-id <file-id>
tv admin audit list --correlation <correlation-id>
tv admin audit list --target-type group --target-id <group-id>

Every filter is optional, and every supplied filter composes with the others (all apply together, never OR'd): --actor <email>, --action <prefix>, --target-type <type>, --target-id <id>, --result success|denied, --correlation <id>, and --after/--before <iso>. --limit <n> accepts 1-100 (default 25); the response's nextCursor is an opaque keyset token — pass it back as --cursor to page forward. Each event carries id, occurredAt, actorUserId, organizationId, action, targetType, targetId, result, correlationId, and safe structured details (schemaVersion: 1, command: "admin audit list").

Administrator content access: unrestricted, always audited

tv file info <file-id>
tv file get <file-id> --output ./evidence.pdf
tv file get <file-id> --admin-reason "Compliance review" --output ./evidence.pdf

An administrator (admin/global_admin) may list, inspect, and download every folder and file in their own organization -- not just their own or granted files -- with no direct or inherited grant required (issue #55). --admin-reason <reason> is still accepted on tv file info/tv file get and, when supplied, is recorded verbatim on the audit event; it is never required and never blocks the request when omitted or left blank. Every exceptional access (whether or not a reason was given) writes its own audit event carrying an explicit adminOverride: true indicator, so it is always discoverable later with tv admin audit list --target-type file --target-id <file-id> -- unrestricted access is still explicit and accountable in the audit trail, never silent. This access never mutates ownership and never creates an implicit access-grant row, and it remains bound to the administrator's own organization -- an administrator can never see or act on another organization's content this way. tv folder list <folder-id> gives an administrator that same unconditional, audited override one folder at a time (browsing its immediate children with no grant needed), and tv admin folder list shows every Root Folder in the organization as a flat, deactivated- inclusive catalog; see Root Folder catalog and metadata definitions. tv file find --within <folder-id> (issue #57) extends the identical override to a whole subtree search: an administrator without standing on the start folder still matches every file beneath it organization-wide, and exactly one admin.content.access event is recorded for the call -- never one per matched file -- but only when the override actually fired; an administrator who already owns or was granted the start folder searches it through their own ordinary standing and triggers no override event at all. The pre-existing file.searched audit event also gains a withinFolderId detail on every search, scoped or not, so the exact subtree (or its absence) behind any search is always reconstructible from tv admin audit list --correlation <id>.

Immutability

Audit events are append-only: nothing in tv (no command, no administrator override) can edit or remove one. The database itself enforces this with triggers, not just application convention — see Trust boundaries.

A worked investigation example

See Incident investigation for a full worked example reconstructing one operation end-to-end from its correlation ID using tv admin audit list.

Continue with Users, roles, and groups or Audit and observability for the underlying record contract and secret-exclusion rules.