From 3dba00de7033b5600b6814f9f21f10272c4ab5ca Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 11:26:40 +0200
Subject: [PATCH 01/16] feat(audit): filter the audit log by resource, and by
 resource + action

Adds `resource` and `resource_action` materialized search columns (each with
a `set` skip index) to `audit_trail_events`, exposes them as repeated
`resources` / `actions` query params on GET /api/v1/audit-trail, and wires two
selectors into the dashboard audit log.

An action is only meaningful attached to a resource, so the Action selector
stays disabled until exactly one resource is picked, and the endpoint rejects
`actions` sent without `resources`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/audit/lib/audit.ts                   | 12 ++-
 .../audit/lib/migrate.integration.test.ts     | 19 ++++-
 ...0001_add_resource_action_search_columns.ts | 23 ++++++
 packages/audit/lib/store.integration.test.ts  | 74 ++++++++++++++++++-
 packages/audit/lib/store.ts                   | 16 +++-
 .../getAuditTrail.integration.test.ts         | 44 +++++++++--
 .../v1/audit-trail/getAuditTrail.ts           | 23 +++++-
 packages/types/lib/audit-trail/api.ts         |  8 +-
 .../components/patterns/FilterMultiSelect.tsx |  8 +-
 packages/webapp/src/hooks/useAudit.tsx        | 19 ++++-
 packages/webapp/src/pages/Audit/Show.tsx      | 35 ++++++++-
 packages/webapp/src/pages/Audit/constants.ts  | 59 +++++++++++++++
 12 files changed, 310 insertions(+), 30 deletions(-)
 create mode 100644 packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
 create mode 100644 packages/webapp/src/pages/Audit/constants.ts

diff --git a/packages/audit/lib/audit.ts b/packages/audit/lib/audit.ts
index e848558497..f3ab38fe2c 100644
--- a/packages/audit/lib/audit.ts
+++ b/packages/audit/lib/audit.ts
@@ -66,21 +66,25 @@ export class AuditClient {
 
     /**
      * Account-scoped, most-recent-first. `cursor` is the opaque `nextCursor` of a previous page;
-     * `from`/`to` optionally bound the window and combine with the cursor. Empty when audit isn't wired
-     * to a backend.
+     * `from`/`to` and the resource filters optionally narrow the set and combine with the cursor. Empty
+     * when audit isn't wired to a backend.
      */
     async listAuditTrailEvents({
         accountId,
         limit,
         cursor,
         from,
-        to
+        to,
+        resources,
+        actions
     }: {
         accountId: number;
         limit: number;
         cursor?: string | undefined;
         from?: string | undefined;
         to?: string | undefined;
+        resources?: string[] | undefined;
+        actions?: string[] | undefined;
     }): Promise<Result<{ events: ApiAuditTrailEvent[]; nextCursor: string | null }>> {
         let before: AuditTrailCursor | undefined;
         if (cursor) {
@@ -91,7 +95,7 @@ export class AuditClient {
             before = decoded;
         }
 
-        return (await this.reader.list({ accountId, limit, before, from, to })).map((page) => ({
+        return (await this.reader.list({ accountId, limit, before, from, to, resources, actions })).map((page) => ({
             events: page.events,
             nextCursor: page.nextCursor ? encodeCursor(page.nextCursor) : null
         }));
diff --git a/packages/audit/lib/migrate.integration.test.ts b/packages/audit/lib/migrate.integration.test.ts
index e864bcfcc6..9f899514f0 100644
--- a/packages/audit/lib/migrate.integration.test.ts
+++ b/packages/audit/lib/migrate.integration.test.ts
@@ -41,7 +41,10 @@ describe('audit migrate', () => {
 
         // Exact match: audit runs its own migration set, so none of the usage tables may appear here.
         expect(await tables()).toEqual(['audit_trail_events', 'migrations']);
-        expect(await appliedMigrations()).toEqual([expect.stringMatching(/^20260729000001_create_audit_trail_events\.[jt]s$/)]);
+        expect(await appliedMigrations()).toEqual([
+            expect.stringMatching(/^20260729000001_create_audit_trail_events\.[jt]s$/),
+            expect.stringMatching(/^20260731000001_add_resource_action_search_columns\.[jt]s$/)
+        ]);
     });
 
     it('does not re-apply an already-applied migration', async () => {
@@ -49,7 +52,19 @@ describe('audit migrate', () => {
 
         // Deliberately no FINAL: re-applying inserts a second row for the same name, which FINAL would hide.
         const res = await admin.query({ query: `SELECT count() AS count FROM ${database}.migrations`, format: 'JSONEachRow' });
-        expect(Number((await res.json<{ count: string }>())[0]!.count)).toBe(1);
+        expect(Number((await res.json<{ count: string }>())[0]!.count)).toBe(2);
+    });
+
+    it('creates a set index for each of the resource search columns', async () => {
+        const res = await admin.query({
+            query: `SELECT name, type_full AS type FROM system.data_skipping_indices WHERE database = {db:String} AND table = 'audit_trail_events' ORDER BY name`,
+            format: 'JSONEachRow',
+            query_params: { db: database }
+        });
+        expect(await res.json<{ name: string; type: string }>()).toEqual([
+            { name: 'idx_resource', type: 'set(0)' },
+            { name: 'idx_resource_action', type: 'set(0)' }
+        ]);
     });
 
     it('rejects an event whose accountId is missing, malformed or not a real account id', async () => {
diff --git a/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
new file mode 100644
index 0000000000..24fba4fa75
--- /dev/null
+++ b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
@@ -0,0 +1,23 @@
+// Non-throwing extracts, unlike the ORDER BY keys: a blob these can't read is still a storable event,
+// so it must not be rejected at insert.
+//
+// `resource_action` is a separate column because two `set` indexes AND-ed prune per column, not per
+// pair — a granule holding `connection.created` and `api_key.deleted` passes both `resource='connection'`
+// and `action='deleted'` while containing no `connection.deleted`. There is no standalone `action`
+// column: filtering by action alone isn't offered, so it would index nothing anyone queries.
+//
+// ALTER only fills new parts; older ones evaluate the expression on read (correct, just unpruned) and
+// pick up the column when they next merge. No MATERIALIZE step: the table is empty at this migration,
+// and on a large one it would be a blocking mutation at metering boot.
+export const sql = [
+    `
+    ALTER TABLE {database:Identifier}.audit_trail_events
+        ADD COLUMN IF NOT EXISTS resource        LowCardinality(String) MATERIALIZED JSONExtractString(event, 'resource'),
+        ADD COLUMN IF NOT EXISTS resource_action LowCardinality(String) MATERIALIZED concat(JSONExtractString(event, 'resource'), '.', JSONExtractString(event, 'action'))
+    `,
+    `
+    ALTER TABLE {database:Identifier}.audit_trail_events
+        ADD INDEX IF NOT EXISTS idx_resource        resource        TYPE set(0) GRANULARITY 1,
+        ADD INDEX IF NOT EXISTS idx_resource_action resource_action TYPE set(0) GRANULARITY 1
+    `
+];
diff --git a/packages/audit/lib/store.integration.test.ts b/packages/audit/lib/store.integration.test.ts
index 7658418dc2..79772e1bb4 100644
--- a/packages/audit/lib/store.integration.test.ts
+++ b/packages/audit/lib/store.integration.test.ts
@@ -18,7 +18,19 @@ let client: ClickHouseClient;
 let store: ClickhouseAuditStore;
 
 // Known ids so the read assertions below are deterministic.
-async function insertEvent({ id, accountId, occurredAt }: { id: string; accountId: number; occurredAt: string }) {
+async function insertEvent({
+    id,
+    accountId,
+    occurredAt,
+    resource = 'connection',
+    action = 'deleted'
+}: {
+    id: string;
+    accountId: number;
+    occurredAt: string;
+    resource?: string;
+    action?: string;
+}) {
     const event = {
         id,
         version: '2026-07-16',
@@ -26,8 +38,8 @@ async function insertEvent({ id, accountId, occurredAt }: { id: string; accountI
         accountId,
         environment: null,
         actor: { type: 'user', id: '5', display: 'a@b.co' },
-        resource: 'connection',
-        action: 'deleted',
+        resource,
+        action,
         targets: [{ type: 'connection', id: '10' }],
         context: {},
         outcome: 'success'
@@ -55,6 +67,12 @@ beforeAll(async () => {
     await insertEvent({ id: '22222222-2222-2222-2222-222222222222', accountId: 1, occurredAt: at(1000) });
     await insertEvent({ id: '33333333-3333-3333-3333-333333333333', accountId: 1, occurredAt: at(2000) });
     await insertEvent({ id: '99999999-9999-9999-9999-999999999999', accountId: 2, occurredAt: at(1500) });
+
+    // account 3: one event per resource/action pair the filter tests select on
+    await insertEvent({ id: 'aaaaaaaa-0000-0000-0000-000000000001', accountId: 3, occurredAt: at(0), resource: 'connection', action: 'deleted' });
+    await insertEvent({ id: 'aaaaaaaa-0000-0000-0000-000000000002', accountId: 3, occurredAt: at(1000), resource: 'connection', action: 'updated' });
+    await insertEvent({ id: 'aaaaaaaa-0000-0000-0000-000000000003', accountId: 3, occurredAt: at(2000), resource: 'api_key', action: 'deleted' });
+    await insertEvent({ id: 'aaaaaaaa-0000-0000-0000-000000000004', accountId: 3, occurredAt: at(3000), resource: 'sync', action: 'enabled' });
 });
 
 afterAll(async () => {
@@ -94,6 +112,56 @@ describe('ClickhouseAuditStore.list', () => {
     });
 });
 
+describe('ClickhouseAuditStore.list resource filters', () => {
+    const resourceActionOf = (events: { resource: string; action: string }[]) => events.map((e) => `${e.resource}.${e.action}`).sort();
+
+    it('filters by resource', async () => {
+        const { events } = (await store.list({ accountId: 3, limit: 10, resources: ['connection'] })).unwrap();
+        expect(resourceActionOf(events)).toEqual(['connection.deleted', 'connection.updated']);
+        expect(events.every((e) => e.accountId === 3)).toBe(true);
+    });
+
+    it('filters by several resources at once', async () => {
+        const { events } = (await store.list({ accountId: 3, limit: 10, resources: ['api_key', 'sync'] })).unwrap();
+        expect(resourceActionOf(events)).toEqual(['api_key.deleted', 'sync.enabled']);
+    });
+
+    it('narrows a resource to a single action', async () => {
+        const { events } = (await store.list({ accountId: 3, limit: 10, resources: ['connection'], actions: ['deleted'] })).unwrap();
+        expect(resourceActionOf(events)).toEqual(['connection.deleted']);
+    });
+
+    // The pairs are the cross product, so an action belonging to another resource must not widen the match.
+    it('matches actions against their own resource only', async () => {
+        const onSync = (await store.list({ accountId: 3, limit: 10, resources: ['sync'], actions: ['enabled'] })).unwrap();
+        expect(resourceActionOf(onSync.events)).toEqual(['sync.enabled']);
+
+        // Same action, a resource that never records it: the pair matches nothing rather than falling
+        // back to either half.
+        const onConnection = (await store.list({ accountId: 3, limit: 10, resources: ['connection'], actions: ['enabled'] })).unwrap();
+        expect(onConnection.events).toHaveLength(0);
+    });
+
+    it('ignores actions given without a resource, since a pair needs both halves', async () => {
+        const { events } = (await store.list({ accountId: 3, limit: 10, actions: ['deleted'] })).unwrap();
+        expect(resourceActionOf(events)).toEqual(['api_key.deleted', 'connection.deleted', 'connection.updated', 'sync.enabled']);
+    });
+
+    it('combines with the date window and paginates', async () => {
+        const page1 = (await store.list({ accountId: 3, limit: 1, resources: ['connection'], from: at(0), to: at(1000) })).unwrap();
+        expect(resourceActionOf(page1.events)).toEqual(['connection.updated']);
+        expect(page1.nextCursor).not.toBeNull();
+
+        const page2 = (await store.list({ accountId: 3, limit: 1, resources: ['connection'], from: at(0), to: at(1000), before: page1.nextCursor! })).unwrap();
+        expect(resourceActionOf(page2.events)).toEqual(['connection.deleted']);
+    });
+
+    it('returns nothing for a resource that was never recorded', async () => {
+        const { events } = (await store.list({ accountId: 3, limit: 10, resources: ['team'] })).unwrap();
+        expect(events).toHaveLength(0);
+    });
+});
+
 describe('AuditClient.record through ClickhouseAuditStore', () => {
     it('writes an emitted event that reads back with the id + version stamped at emit', async () => {
         const event: AuditEvent = {
diff --git a/packages/audit/lib/store.ts b/packages/audit/lib/store.ts
index a4f28adc15..91b54253c3 100644
--- a/packages/audit/lib/store.ts
+++ b/packages/audit/lib/store.ts
@@ -24,6 +24,9 @@ export interface ListAuditTrailEventsParams {
     before?: AuditTrailCursor | undefined;
     from?: string | undefined;
     to?: string | undefined;
+    resources?: string[] | undefined;
+    /** Narrows `resources`; ignored on its own, since a match needs both halves of `resource.action`. */
+    actions?: string[] | undefined;
 }
 
 export interface AuditTrailPage {
@@ -94,9 +97,20 @@ export class ClickhouseAuditStore implements AuditWriter, AuditBatchWriter, Audi
         }
     }
 
-    async list({ accountId, limit, before, from, to }: ListAuditTrailEventsParams): Promise<Result<AuditTrailPage>> {
+    async list({ accountId, limit, before, from, to, resources, actions }: ListAuditTrailEventsParams): Promise<Result<AuditTrailPage>> {
         const params: Record<string, unknown> = { account_id: accountId, limit: limit + 1 };
         const conditions = ['account_id = {account_id:Int64}'];
+        if (resources?.length) {
+            if (actions?.length) {
+                // Every requested pair, matched against the materialized concatenation. Two separate
+                // conditions would prune per column and let a granule through on a pair it doesn't hold.
+                conditions.push('resource_action IN {resource_actions:Array(String)}');
+                params['resource_actions'] = resources.flatMap((resource) => actions.map((action) => `${resource}.${action}`));
+            } else {
+                conditions.push('resource IN {resources:Array(String)}');
+                params['resources'] = resources;
+            }
+        }
         if (from) {
             conditions.push('occurred_at >= parseDateTime64BestEffortOrNull({from:String}, 3)');
             params['from'] = from;
diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
index f806994443..b308b0a69a 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
@@ -5,7 +5,7 @@ import { seeders } from '@nangohq/shared';
 
 import { authenticateUser, isSuccess, runServer } from '../../../utils/tests.js';
 
-import type { AuditEvent } from '@nangohq/audit';
+import type { AuditEvent, AuditResourceAction } from '@nangohq/audit';
 
 let api: Awaited<ReturnType<typeof runServer>>;
 let auditClient: ReturnType<typeof auditClickhouseClient>;
@@ -18,17 +18,16 @@ async function authAdmin() {
     return { session, account, env };
 }
 
-function auditEvent(accountId: number, occurredAt: string): AuditEvent {
+function auditEvent(accountId: number, occurredAt: string, resourceAction: AuditResourceAction = { resource: 'connection', action: 'deleted' }): AuditEvent {
     return {
         occurredAt,
         accountId,
         environment: null,
         actor: { type: 'user', id: '5', display: 'a@b.co' },
-        resource: 'connection',
-        action: 'deleted',
         targets: [{ type: 'connection', id: '10' }],
         context: {},
-        outcome: 'success'
+        outcome: 'success',
+        ...resourceAction
     };
 }
 
@@ -111,6 +110,41 @@ describe('GET /api/v1/audit-trail', () => {
         expect(event.action).toBe('deleted');
     });
 
+    it('rejects `actions` sent without `resources` with 400', async () => {
+        const { session } = await authAdmin();
+        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { actions: ['deleted'] } });
+        expect(res.res.status).toBe(400);
+    });
+
+    it('filters by resource, and by a resource narrowed to an action', async () => {
+        const { session, account } = await authAdmin();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:00.000Z', { resource: 'connection', action: 'deleted' }))).unwrap();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:01.000Z', { resource: 'connection', action: 'updated' }))).unwrap();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:02.000Z', { resource: 'api_key', action: 'deleted' }))).unwrap();
+
+        const byResource = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection'] } });
+        expect(byResource.res.status).toBe(200);
+        isSuccess(byResource.json);
+        expect(byResource.json.data.map((e) => `${e.resource}.${e.action}`).sort()).toEqual(['connection.deleted', 'connection.updated']);
+
+        const byPair = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection'], actions: ['deleted'] } });
+        expect(byPair.res.status).toBe(200);
+        isSuccess(byPair.json);
+        expect(byPair.json.data.map((e) => `${e.resource}.${e.action}`)).toEqual(['connection.deleted']);
+    });
+
+    it('filters by several resources at once', async () => {
+        const { session, account } = await authAdmin();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:00.000Z', { resource: 'connection', action: 'deleted' }))).unwrap();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:01.000Z', { resource: 'api_key', action: 'deleted' }))).unwrap();
+        (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:02.000Z', { resource: 'team', action: 'updated' }))).unwrap();
+
+        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection', 'api_key'] } });
+        expect(res.res.status).toBe(200);
+        isSuccess(res.json);
+        expect(res.json.data.map((e) => e.resource).sort()).toEqual(['api_key', 'connection']);
+    });
+
     it('paginates via the opaque cursor', async () => {
         const { session, account } = await authAdmin();
         // 26 events one second apart (oldest → newest) — one more than the fixed page size of 25.
diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
index 87d80176e2..e62caf4741 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
@@ -10,15 +10,30 @@ import type { GetAuditTrail } from '@nangohq/types';
 
 const PAGE_SIZE = 25;
 
+// Resources and actions are combined into a cross product downstream, so the two caps multiply.
+const MAX_FILTER_VALUES = 50;
+
+// A repeated query param (`?resources=a&resources=b`), which Express hands over as a string when it
+// appears once. Values aren't checked against the audit vocabulary — it has no runtime form to check
+// against — so an unknown one simply matches nothing.
+const repeatedParam = z
+    .union([z.string().min(1), z.array(z.string().min(1)).max(MAX_FILTER_VALUES)])
+    .transform((value) => (Array.isArray(value) ? value : [value]));
+
 const queryStringValidation = z
     .object({
         cursor: z.string().optional(),
         from: z.iso.datetime().optional(),
-        to: z.iso.datetime().optional()
+        to: z.iso.datetime().optional(),
+        resources: repeatedParam.optional(),
+        actions: repeatedParam.optional()
     })
     // Account-scoped endpoint (no `env`). Not strict: any stray query param is stripped rather than 400'd, so a read never fails over an extra key.
     // Surface an inverted range as a 400 rather than a silently empty result.
-    .refine((q) => !q.from || !q.to || new Date(q.from) <= new Date(q.to), { message: '`from` must be before or equal to `to`', path: ['from'] });
+    .refine((q) => !q.from || !q.to || new Date(q.from) <= new Date(q.to), { message: '`from` must be before or equal to `to`', path: ['from'] })
+    // An action is only meaningful attached to a resource, so reject the pairless form rather than
+    // dropping it and returning a wider result set than the caller asked for.
+    .refine((q) => !q.actions?.length || Boolean(q.resources?.length), { message: '`actions` requires `resources`', path: ['actions'] });
 
 export const getAuditTrail = asyncWrapper<GetAuditTrail>(async (req, res) => {
     const query = queryStringValidation.safeParse(req.query);
@@ -28,9 +43,9 @@ export const getAuditTrail = asyncWrapper<GetAuditTrail>(async (req, res) => {
     }
 
     const { account } = res.locals;
-    const { cursor, from, to } = query.data;
+    const { cursor, from, to, resources, actions } = query.data;
 
-    const result = await audit.listAuditTrailEvents({ accountId: account.id, limit: PAGE_SIZE, cursor, from, to });
+    const result = await audit.listAuditTrailEvents({ accountId: account.id, limit: PAGE_SIZE, cursor, from, to, resources, actions });
     if (result.isErr()) {
         if (result.error instanceof InvalidAuditCursorError) {
             res.status(400).send({ error: { code: 'invalid_query_params', message: 'Invalid cursor' } });
diff --git a/packages/types/lib/audit-trail/api.ts b/packages/types/lib/audit-trail/api.ts
index bd3566b1bd..662fdc38f1 100644
--- a/packages/types/lib/audit-trail/api.ts
+++ b/packages/types/lib/audit-trail/api.ts
@@ -26,11 +26,15 @@ export type GetAuditTrail = ApiEndpoint<{
     Method: 'GET';
     Path: '/api/v1/audit-trail';
     Querystring: {
-        // Account-scoped endpoint: no `env`. `cursor` encodes position only, not the filter window — resend the
-        // same `from`/`to` on every page or subsequent pages paginate the unfiltered set past the cursor.
+        // Account-scoped endpoint: no `env`. `cursor` encodes position only, not the filter window — resend
+        // every other param on each page or subsequent pages paginate the unfiltered set past the cursor.
         cursor?: string;
         from?: string;
         to?: string;
+        // Repeated params (`?resources=connection&resources=sync`). `actions` narrows `resources` and is
+        // rejected without it: the pair is matched as a single `resource.action` value, which needs both.
+        resources?: AuditResource[];
+        actions?: AuditAction[];
     };
     Success: {
         data: ApiAuditTrailEvent[];
diff --git a/packages/webapp/src/components/patterns/FilterMultiSelect.tsx b/packages/webapp/src/components/patterns/FilterMultiSelect.tsx
index e685ed3aa6..f6810593df 100644
--- a/packages/webapp/src/components/patterns/FilterMultiSelect.tsx
+++ b/packages/webapp/src/components/patterns/FilterMultiSelect.tsx
@@ -26,6 +26,7 @@ interface FilterMultiSelectProps<T extends string = string> {
     width?: string;
     open?: boolean;
     onOpenChange?: (open: boolean) => void;
+    disabled?: boolean;
 }
 
 export function FilterMultiSelect<T extends string = string>({
@@ -40,7 +41,8 @@ export function FilterMultiSelect<T extends string = string>({
     max,
     width = 'w-56',
     open: controlledOpen,
-    onOpenChange: controlledOnOpenChange
+    onOpenChange: controlledOnOpenChange,
+    disabled = false
 }: FilterMultiSelectProps<T>) {
     const [internalOpen, setInternalOpen] = useState(false);
     const [search, setSearch] = useState('');
@@ -48,7 +50,7 @@ export function FilterMultiSelect<T extends string = string>({
     const searchInputRef = useRef<HTMLInputElement>(null);
 
     const isControlled = controlledOpen !== undefined;
-    const open = isControlled ? controlledOpen : internalOpen;
+    const open = (isControlled ? controlledOpen : internalOpen) && !disabled;
 
     const setOpen = useCallback(
         (val: boolean) => {
@@ -179,7 +181,7 @@ export function FilterMultiSelect<T extends string = string>({
     return (
         <Popover open={open} onOpenChange={setOpen}>
             <PopoverTrigger asChild>
-                <Button variant="outline" size="md" className={cn('text-text-muted', isDirty && 'text-text-strong')}>
+                <Button variant="outline" size="md" disabled={disabled} className={cn('text-text-muted', isDirty && 'text-text-strong')}>
                     {label}
                     {isDirty && (
                         <span
diff --git a/packages/webapp/src/hooks/useAudit.tsx b/packages/webapp/src/hooks/useAudit.tsx
index 2ef3f16597..58bef05559 100644
--- a/packages/webapp/src/hooks/useAudit.tsx
+++ b/packages/webapp/src/hooks/useAudit.tsx
@@ -2,12 +2,19 @@ import { useInfiniteQuery } from '@tanstack/react-query';
 
 import { APIError, apiFetch } from '../utils/api';
 
-import type { GetAuditTrail } from '@nangohq/types';
+import type { AuditAction, AuditResource, GetAuditTrail } from '@nangohq/types';
 
-export function useApiGetAuditTrail(filters: { from?: string | undefined; to?: string | undefined }, options?: { enabled?: boolean }) {
+interface AuditTrailFilters {
+    from?: string | undefined;
+    to?: string | undefined;
+    resources?: AuditResource[] | undefined;
+    actions?: AuditAction[] | undefined;
+}
+
+export function useApiGetAuditTrail(filters: AuditTrailFilters, options?: { enabled?: boolean }) {
     return useInfiniteQuery<GetAuditTrail['Success'], APIError, { pages: GetAuditTrail['Success'][] }, unknown[], string | null>({
         enabled: options?.enabled ?? true,
-        queryKey: ['audit-trail:infinite', filters.from ?? null, filters.to ?? null],
+        queryKey: ['audit-trail:infinite', filters.from ?? null, filters.to ?? null, filters.resources ?? null, filters.actions ?? null],
         queryFn: async ({ pageParam, signal }) => {
             const params = new URLSearchParams();
             if (pageParam) {
@@ -19,6 +26,12 @@ export function useApiGetAuditTrail(filters: { from?: string | undefined; to?: s
             if (filters.to) {
                 params.append('to', filters.to);
             }
+            for (const resource of filters.resources ?? []) {
+                params.append('resources', resource);
+            }
+            for (const action of filters.actions ?? []) {
+                params.append('actions', action);
+            }
 
             const qs = params.toString();
             const res = await apiFetch(`/api/v1/audit-trail${qs ? `?${qs}` : ''}`, { method: 'GET', signal });
diff --git a/packages/webapp/src/pages/Audit/Show.tsx b/packages/webapp/src/pages/Audit/Show.tsx
index bed8f1db4f..daa7445331 100644
--- a/packages/webapp/src/pages/Audit/Show.tsx
+++ b/packages/webapp/src/pages/Audit/Show.tsx
@@ -5,6 +5,8 @@ import { Helmet } from 'react-helmet';
 import { permissions } from '@nangohq/authz';
 import { Button } from '@nangohq/design-system';
 
+import { ConditionalTooltip } from '@/components/patterns/ConditionalTooltip';
+import { FilterMultiSelect } from '@/components/patterns/FilterMultiSelect';
 import { PeriodSelector } from '@/components/patterns/PeriodSelector';
 import { Skeleton } from '@/components/ui/Skeleton';
 import { Tag } from '@/components/ui/Tag';
@@ -16,9 +18,11 @@ import DashboardLayout from '@/layout/DashboardLayout';
 import { last14dPreset, logsPresets } from '@/utils/logs';
 import { formatDateToLogFormat } from '@/utils/utils';
 import { AuditEventDrawer } from './components/AuditEventDrawer';
+import { actionOptionsFor, ALL, resourceOptions } from './constants';
 
+import type { ActionFilter, ResourceFilter } from './constants';
 import type { Period } from '@/utils/dates';
-import type { ApiAuditTrailEvent, AuditOutcome } from '@nangohq/types';
+import type { ApiAuditTrailEvent, AuditAction, AuditOutcome, AuditResource } from '@nangohq/types';
 
 const outcomeVariant: Record<AuditOutcome, React.ComponentProps<typeof Tag>['variant']> = {
     success: 'success',
@@ -33,14 +37,26 @@ export const AuditShow: React.FC = () => {
     const { can } = usePermissions();
     const canReadAuditTrail = can(permissions.canReadAuditTrail);
     const [period, setPeriod] = useState<Period | null>(() => last14dPreset.toPeriod());
+    const [resources, setResources] = useState<ResourceFilter[]>([ALL]);
+    const [actions, setActions] = useState<ActionFilter[]>([ALL]);
     const [selected, setSelected] = useState<ApiAuditTrailEvent | null>(null);
 
     const from = period?.from ? period.from.toISOString() : undefined;
     const to = period?.to ? period.to.toISOString() : undefined;
 
+    // Actions are matched as `resource.action` pairs, so they're only offered once the resource half is unambiguous.
+    const singleResource: AuditResource | null = resources.length === 1 && resources[0] !== ALL ? resources[0] : null;
+    const onResourcesChange = (next: ResourceFilter[]) => {
+        setResources(next);
+        setActions([ALL]);
+    };
+
+    const resourceFilter = useMemo(() => resources.filter((resource): resource is AuditResource => resource !== ALL), [resources]);
+    const actionFilter = useMemo(() => (singleResource ? actions.filter((action): action is AuditAction => action !== ALL) : []), [actions, singleResource]);
+
     // Only read audit data once the flag and the caller's permission are confirmed; stays idle otherwise.
     const { data, isLoading, isError, refetch, isFetchingNextPage, hasNextPage, fetchNextPage } = useApiGetAuditTrail(
-        { from, to },
+        { from, to, resources: resourceFilter, actions: actionFilter },
         { enabled: meta?.auditTrail === true && canReadAuditTrail }
     );
     const events = useMemo(() => data?.pages.flatMap((page) => page.data) ?? [], [data]);
@@ -83,9 +99,22 @@ export const AuditShow: React.FC = () => {
 
             <div className="flex flex-col gap-3">
                 <div className="flex gap-2 justify-between">
-                    {/* Left side is reserved for search + filters (status, actor, resource, …) added later. */}
+                    {/* Left side is reserved for search + filters (status, actor, …) added later. */}
                     <div className="flex-1 min-w-0" />
                     <div className="flex gap-2">
+                        <FilterMultiSelect label="Resource" options={resourceOptions} selected={resources} defaultSelect={[ALL]} onChange={onResourcesChange} />
+                        <ConditionalTooltip condition={!singleResource} content="Select a single resource to filter by action" asChild>
+                            <span>
+                                <FilterMultiSelect
+                                    label="Action"
+                                    options={singleResource ? actionOptionsFor(singleResource) : []}
+                                    selected={actions}
+                                    defaultSelect={[ALL]}
+                                    onChange={setActions}
+                                    disabled={!singleResource}
+                                />
+                            </span>
+                        </ConditionalTooltip>
                         <PeriodSelector
                             isLive={false}
                             period={period}
diff --git a/packages/webapp/src/pages/Audit/constants.ts b/packages/webapp/src/pages/Audit/constants.ts
new file mode 100644
index 0000000000..719cbaa16a
--- /dev/null
+++ b/packages/webapp/src/pages/Audit/constants.ts
@@ -0,0 +1,59 @@
+import { formatKeyToLabel } from '@/utils/utils';
+
+import type { FilterOption } from '@/components/patterns/FilterMultiSelect';
+import type { AuditAction, AuditResource } from '@nangohq/types';
+
+/**
+ * The actions each resource can be recorded with. Hand-maintained against the emit side's
+ * `AuditResourceAction` union, which lives in a server package the dashboard can't import — so a new
+ * audited event has to be added here too, or it stays unfilterable. `Record<AuditResource, …>` at least
+ * makes a new *resource* a compile error. An empty list means nothing is emitted for that resource yet.
+ */
+const actionsByResource: Record<AuditResource, readonly AuditAction[]> = {
+    connection: ['updated', 'metadata_updated', 'refreshed', 'deleted'],
+    integration: ['updated', 'deleted'],
+    function: ['deleted'],
+    api_key: ['updated', 'deleted'],
+    sync: ['enabled', 'disabled', 'frequency_changed', 'variant_created', 'variant_deleted'],
+    member: ['role_changed', 'removed'],
+    team: ['updated'],
+    user: ['updated'],
+    environment: ['updated', 'variables_changed', 'webhook_urls_changed', 'deleted'],
+    billing: ['plan_changed', 'trial_extended', 'details_changed', 'payment_method_added', 'payment_method_removed'],
+    app_auth: ['password_changed'],
+    mfa: ['enrolled', 'enabled', 'disabled', 'verified', 'recovery_regenerated'],
+    audit_log: []
+};
+
+const resourceLabels: Record<AuditResource, string> = {
+    connection: 'Connection',
+    integration: 'Integration',
+    function: 'Function',
+    api_key: 'API key',
+    sync: 'Sync',
+    member: 'Member',
+    team: 'Team',
+    user: 'User',
+    environment: 'Environment',
+    billing: 'Billing',
+    app_auth: 'Authentication',
+    mfa: 'MFA',
+    audit_log: 'Audit log'
+};
+
+export const ALL = 'all';
+
+export type ResourceFilter = AuditResource | typeof ALL;
+export type ActionFilter = AuditAction | typeof ALL;
+
+// Resources with nothing to record are left out rather than offered as a filter that matches nothing.
+export const resourceOptions: FilterOption<ResourceFilter>[] = [
+    { value: ALL, label: 'All' },
+    ...(Object.keys(actionsByResource) as AuditResource[]).flatMap((resource) =>
+        actionsByResource[resource].length > 0 ? [{ value: resource, label: resourceLabels[resource] }] : []
+    )
+];
+
+export function actionOptionsFor(resource: AuditResource): FilterOption<ActionFilter>[] {
+    return [{ value: ALL, label: 'All' }, ...actionsByResource[resource].map((action) => ({ value: action, label: formatKeyToLabel(action) }))];
+}

From 1472e5f97e7f0df48cce611707a436c3ed181f3f Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:09:38 +0200
Subject: [PATCH 02/16] fix(audit): add the sync actions the filter list was
 missing

The sync command work landed paused, started, triggered and cancelled on
master after this branch was cut. The dashboard's action list is a hand-kept
mirror of the emit-side union, so they were silently unfilterable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/pages/Audit/constants.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/webapp/src/pages/Audit/constants.ts b/packages/webapp/src/pages/Audit/constants.ts
index 719cbaa16a..5c6873235a 100644
--- a/packages/webapp/src/pages/Audit/constants.ts
+++ b/packages/webapp/src/pages/Audit/constants.ts
@@ -14,7 +14,7 @@ const actionsByResource: Record<AuditResource, readonly AuditAction[]> = {
     integration: ['updated', 'deleted'],
     function: ['deleted'],
     api_key: ['updated', 'deleted'],
-    sync: ['enabled', 'disabled', 'frequency_changed', 'variant_created', 'variant_deleted'],
+    sync: ['enabled', 'disabled', 'paused', 'started', 'triggered', 'cancelled', 'frequency_changed', 'variant_created', 'variant_deleted'],
     member: ['role_changed', 'removed'],
     team: ['updated'],
     user: ['updated'],

From 49e7e7c7781f45980f441af48336946053336838 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:23:20 +0200
Subject: [PATCH 03/16] refactor(audit): trim the search-columns migration
 comment

Cut the header to the three facts that stop someone undoing a deliberate
choice; the rationale behind them is in the PR.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ...31000001_add_resource_action_search_columns.ts | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
index 24fba4fa75..dbbf6db8f7 100644
--- a/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
+++ b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
@@ -1,14 +1,7 @@
-// Non-throwing extracts, unlike the ORDER BY keys: a blob these can't read is still a storable event,
-// so it must not be rejected at insert.
-//
-// `resource_action` is a separate column because two `set` indexes AND-ed prune per column, not per
-// pair — a granule holding `connection.created` and `api_key.deleted` passes both `resource='connection'`
-// and `action='deleted'` while containing no `connection.deleted`. There is no standalone `action`
-// column: filtering by action alone isn't offered, so it would index nothing anyone queries.
-//
-// ALTER only fills new parts; older ones evaluate the expression on read (correct, just unpruned) and
-// pick up the column when they next merge. No MATERIALIZE step: the table is empty at this migration,
-// and on a large one it would be a blocking mutation at metering boot.
+// Non-throwing extracts, unlike the ORDER BY keys: a blob these can't read is still a storable event.
+// `resource_action` is its own column because two `set` indexes AND-ed prune per column, not per pair.
+// No MATERIALIZE: old parts evaluate on read and pick the column up when they next merge, and on a
+// large table it would be a blocking mutation at metering boot.
 export const sql = [
     `
     ALTER TABLE {database:Identifier}.audit_trail_events

From 9e4266c84366a99a5f3452220a4654f5a39bde85 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:28:44 +0200
Subject: [PATCH 04/16] refactor(audit): clarify the filter-param comments

The cap comment said "the two caps multiply" when there is one constant
applied twice; say what the resulting bound actually is. Point the repeated
param comment at why these values skip vocabulary validation, which is the
difference from the enum query params elsewhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../lib/controllers/v1/audit-trail/getAuditTrail.ts      | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
index e62caf4741..428663b62c 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
@@ -10,12 +10,13 @@ import type { GetAuditTrail } from '@nangohq/types';
 
 const PAGE_SIZE = 25;
 
-// Resources and actions are combined into a cross product downstream, so the two caps multiply.
+// Caps `resources` and `actions` separately. The store pairs them off, so the query sees at most
+// this squared.
 const MAX_FILTER_VALUES = 50;
 
-// A repeated query param (`?resources=a&resources=b`), which Express hands over as a string when it
-// appears once. Values aren't checked against the audit vocabulary — it has no runtime form to check
-// against — so an unknown one simply matches nothing.
+// Repeated param (`?resources=a&resources=b`); Express hands over a bare string when it appears once.
+// Unlike the enum-valued query params elsewhere these aren't checked against a vocabulary — the audit
+// one has no runtime form — so an unknown value simply matches nothing.
 const repeatedParam = z
     .union([z.string().min(1), z.array(z.string().min(1)).max(MAX_FILTER_VALUES)])
     .transform((value) => (Array.isArray(value) ? value : [value]));

From d99e8946ce5e7638d5c5e9df6979c1b536b62522 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:38:54 +0200
Subject: [PATCH 05/16] refactor(audit): encode the filter params as CSV
 instead of repeated

Comma-separated is the more common encoding for multi-value query params in
this codebase, and both vocabularies are snake_case identifiers so splitting
on a comma is safe.

Types the querystring as the string that actually goes on the wire rather
than the array it denotes, so the contract can't drift from the encoding the
way the existing CSV params have.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../getAuditTrail.integration.test.ts           |  8 ++++----
 .../controllers/v1/audit-trail/getAuditTrail.ts | 17 +++++++++--------
 packages/types/lib/audit-trail/api.ts           | 10 ++++++----
 packages/webapp/src/hooks/useAudit.tsx          |  9 +++++----
 4 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
index b308b0a69a..4af01a5833 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
@@ -112,7 +112,7 @@ describe('GET /api/v1/audit-trail', () => {
 
     it('rejects `actions` sent without `resources` with 400', async () => {
         const { session } = await authAdmin();
-        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { actions: ['deleted'] } });
+        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { actions: 'deleted' } });
         expect(res.res.status).toBe(400);
     });
 
@@ -122,12 +122,12 @@ describe('GET /api/v1/audit-trail', () => {
         (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:01.000Z', { resource: 'connection', action: 'updated' }))).unwrap();
         (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:02.000Z', { resource: 'api_key', action: 'deleted' }))).unwrap();
 
-        const byResource = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection'] } });
+        const byResource = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: 'connection' } });
         expect(byResource.res.status).toBe(200);
         isSuccess(byResource.json);
         expect(byResource.json.data.map((e) => `${e.resource}.${e.action}`).sort()).toEqual(['connection.deleted', 'connection.updated']);
 
-        const byPair = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection'], actions: ['deleted'] } });
+        const byPair = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: 'connection', actions: 'deleted' } });
         expect(byPair.res.status).toBe(200);
         isSuccess(byPair.json);
         expect(byPair.json.data.map((e) => `${e.resource}.${e.action}`)).toEqual(['connection.deleted']);
@@ -139,7 +139,7 @@ describe('GET /api/v1/audit-trail', () => {
         (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:01.000Z', { resource: 'api_key', action: 'deleted' }))).unwrap();
         (await emitter.record(auditEvent(account.id, '2026-07-16T10:00:02.000Z', { resource: 'team', action: 'updated' }))).unwrap();
 
-        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: ['connection', 'api_key'] } });
+        const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: 'connection,api_key' } });
         expect(res.res.status).toBe(200);
         isSuccess(res.json);
         expect(res.json.data.map((e) => e.resource).sort()).toEqual(['api_key', 'connection']);
diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
index 428663b62c..d148e8c3e7 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
@@ -14,20 +14,21 @@ const PAGE_SIZE = 25;
 // this squared.
 const MAX_FILTER_VALUES = 50;
 
-// Repeated param (`?resources=a&resources=b`); Express hands over a bare string when it appears once.
-// Unlike the enum-valued query params elsewhere these aren't checked against a vocabulary — the audit
-// one has no runtime form — so an unknown value simply matches nothing.
-const repeatedParam = z
-    .union([z.string().min(1), z.array(z.string().min(1)).max(MAX_FILTER_VALUES)])
-    .transform((value) => (Array.isArray(value) ? value : [value]));
+// Comma-separated list (`?resources=a,b`). Safe to split on a comma because both vocabularies are
+// snake_case identifiers. Unlike the enum-valued query params elsewhere the values aren't checked
+// against a vocabulary — the audit one has no runtime form — so an unknown value matches nothing.
+const csvParam = z
+    .string()
+    .transform((value) => value.split(','))
+    .pipe(z.array(z.string().min(1)).max(MAX_FILTER_VALUES));
 
 const queryStringValidation = z
     .object({
         cursor: z.string().optional(),
         from: z.iso.datetime().optional(),
         to: z.iso.datetime().optional(),
-        resources: repeatedParam.optional(),
-        actions: repeatedParam.optional()
+        resources: csvParam.optional(),
+        actions: csvParam.optional()
     })
     // Account-scoped endpoint (no `env`). Not strict: any stray query param is stripped rather than 400'd, so a read never fails over an extra key.
     // Surface an inverted range as a 400 rather than a silently empty result.
diff --git a/packages/types/lib/audit-trail/api.ts b/packages/types/lib/audit-trail/api.ts
index 662fdc38f1..b8e9178477 100644
--- a/packages/types/lib/audit-trail/api.ts
+++ b/packages/types/lib/audit-trail/api.ts
@@ -31,10 +31,12 @@ export type GetAuditTrail = ApiEndpoint<{
         cursor?: string;
         from?: string;
         to?: string;
-        // Repeated params (`?resources=connection&resources=sync`). `actions` narrows `resources` and is
-        // rejected without it: the pair is matched as a single `resource.action` value, which needs both.
-        resources?: AuditResource[];
-        actions?: AuditAction[];
+        // Comma-separated `AuditResource` / `AuditAction` values (`?resources=connection,sync`). Typed as
+        // the string that goes on the wire rather than the array it denotes, so the contract can't drift
+        // from the encoding. `actions` narrows `resources` and is rejected without it: the pair is matched
+        // as a single `resource.action` value, which needs both halves.
+        resources?: string;
+        actions?: string;
     };
     Success: {
         data: ApiAuditTrailEvent[];
diff --git a/packages/webapp/src/hooks/useAudit.tsx b/packages/webapp/src/hooks/useAudit.tsx
index 58bef05559..940731bd31 100644
--- a/packages/webapp/src/hooks/useAudit.tsx
+++ b/packages/webapp/src/hooks/useAudit.tsx
@@ -26,11 +26,12 @@ export function useApiGetAuditTrail(filters: AuditTrailFilters, options?: { enab
             if (filters.to) {
                 params.append('to', filters.to);
             }
-            for (const resource of filters.resources ?? []) {
-                params.append('resources', resource);
+            // Typed vocabulary in, comma-separated on the wire.
+            if (filters.resources?.length) {
+                params.append('resources', filters.resources.join(','));
             }
-            for (const action of filters.actions ?? []) {
-                params.append('actions', action);
+            if (filters.actions?.length) {
+                params.append('actions', filters.actions.join(','));
             }
 
             const qs = params.toString();

From 960466d855b2c9e8c676b4bb196c72a81ad35179 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:50:07 +0200
Subject: [PATCH 06/16] test(audit): pin the filter value cap, drop a redundant
 comment

The cap bounds the cross product the store builds, so it has to count values
rather than characters; assert both sides of the boundary. Verified red with
the cap removed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../v1/audit-trail/getAuditTrail.integration.test.ts | 12 ++++++++++++
 packages/webapp/src/hooks/useAudit.tsx               |  1 -
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
index 4af01a5833..ff6716be7d 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
@@ -110,6 +110,18 @@ describe('GET /api/v1/audit-trail', () => {
         expect(event.action).toBe('deleted');
     });
 
+    // The cap bounds the cross product the store builds, so it has to count values rather than characters.
+    it('caps how many values one filter param can carry', async () => {
+        const { session } = await authAdmin();
+        const values = (n: number) => Array.from({ length: n }, (_, i) => `resource_${i}`).join(',');
+
+        const atCap = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: values(50) } });
+        expect(atCap.res.status).toBe(200);
+
+        const overCap = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { resources: values(51) } });
+        expect(overCap.res.status).toBe(400);
+    });
+
     it('rejects `actions` sent without `resources` with 400', async () => {
         const { session } = await authAdmin();
         const res = await api.fetch('/api/v1/audit-trail', { method: 'GET', session, query: { actions: 'deleted' } });
diff --git a/packages/webapp/src/hooks/useAudit.tsx b/packages/webapp/src/hooks/useAudit.tsx
index 940731bd31..bc266dae10 100644
--- a/packages/webapp/src/hooks/useAudit.tsx
+++ b/packages/webapp/src/hooks/useAudit.tsx
@@ -26,7 +26,6 @@ export function useApiGetAuditTrail(filters: AuditTrailFilters, options?: { enab
             if (filters.to) {
                 params.append('to', filters.to);
             }
-            // Typed vocabulary in, comma-separated on the wire.
             if (filters.resources?.length) {
                 params.append('resources', filters.resources.join(','));
             }

From d8c2e7ea88f6914a6c0a0751b424330040c11e99 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 12:57:55 +0200
Subject: [PATCH 07/16] test(audit): drop a misleading comment on the cap test

The cap is the number of values in one param; the cross product is why 50 is
the ceiling, not what the cap measures. The test name already says it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../controllers/v1/audit-trail/getAuditTrail.integration.test.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
index ff6716be7d..5e9038c385 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.integration.test.ts
@@ -110,7 +110,6 @@ describe('GET /api/v1/audit-trail', () => {
         expect(event.action).toBe('deleted');
     });
 
-    // The cap bounds the cross product the store builds, so it has to count values rather than characters.
     it('caps how many values one filter param can carry', async () => {
         const { session } = await authAdmin();
         const values = (n: number) => Array.from({ length: n }, (_, i) => `resource_${i}`).join(',');

From 77043b6c4a66ca7fcaa6b75406b00df384aa1de2 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 13:02:23 +0200
Subject: [PATCH 08/16] refactor(audit): drop the comment justifying the filter
 value cap

Bounding a query param is the standing rule, so the cap needs no rationale.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
index d148e8c3e7..6e838540c1 100644
--- a/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
+++ b/packages/server/lib/controllers/v1/audit-trail/getAuditTrail.ts
@@ -10,8 +10,6 @@ import type { GetAuditTrail } from '@nangohq/types';
 
 const PAGE_SIZE = 25;
 
-// Caps `resources` and `actions` separately. The store pairs them off, so the query sees at most
-// this squared.
 const MAX_FILTER_VALUES = 50;
 
 // Comma-separated list (`?resources=a,b`). Safe to split on a comma because both vocabularies are

From 76e201a48460ed999b494b9739d928f8da76389e Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 13:12:31 +0200
Subject: [PATCH 09/16] refactor(audit): drop the contradictory MATERIALIZE
 comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It read "No MATERIALIZE" directly above two columns declared MATERIALIZED —
a different keyword the comment never distinguished — and justified the
omission with a large-table cost the empty table doesn't have.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../20260731000001_add_resource_action_search_columns.ts        | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
index dbbf6db8f7..d481d5e053 100644
--- a/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
+++ b/packages/audit/lib/migrations/20260731000001_add_resource_action_search_columns.ts
@@ -1,7 +1,5 @@
 // Non-throwing extracts, unlike the ORDER BY keys: a blob these can't read is still a storable event.
 // `resource_action` is its own column because two `set` indexes AND-ed prune per column, not per pair.
-// No MATERIALIZE: old parts evaluate on read and pick the column up when they next merge, and on a
-// large table it would be a blocking mutation at metering boot.
 export const sql = [
     `
     ALTER TABLE {database:Identifier}.audit_trail_events

From b7d0959fbe08eed26f32a910382255574caa04f4 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 13:15:52 +0200
Subject: [PATCH 10/16] refactor(audit): trim the filter params contract
 comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keep what a caller needs — the encoding, the vocabulary and the
actions-requires-resources constraint — and drop the defence of the typing
choice, which the endpoint tests already enforce.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/types/lib/audit-trail/api.ts | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/packages/types/lib/audit-trail/api.ts b/packages/types/lib/audit-trail/api.ts
index b8e9178477..9068176b7a 100644
--- a/packages/types/lib/audit-trail/api.ts
+++ b/packages/types/lib/audit-trail/api.ts
@@ -31,10 +31,8 @@ export type GetAuditTrail = ApiEndpoint<{
         cursor?: string;
         from?: string;
         to?: string;
-        // Comma-separated `AuditResource` / `AuditAction` values (`?resources=connection,sync`). Typed as
-        // the string that goes on the wire rather than the array it denotes, so the contract can't drift
-        // from the encoding. `actions` narrows `resources` and is rejected without it: the pair is matched
-        // as a single `resource.action` value, which needs both halves.
+        // Comma-separated `AuditResource` / `AuditAction` values (`?resources=connection,sync`).
+        // `actions` requires `resources`: the pair is matched as one `resource.action` value.
         resources?: string;
         actions?: string;
     };

From 5d2cc78fde1c4bc7ee5ea61c66bf53469c4644da Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 15:07:15 +0200
Subject: [PATCH 11/16] refactor(audit): derive the audit event vocabulary from
 one table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`AuditResource` and `AuditAction` were two independently hand-listed unions,
so nothing tied a resource to the actions it actually records. They are now
derived from a single table of recorded events, which also yields
`AuditEventKey` (`resource.action`) for consumers that need to enumerate the
vocabulary — the dashboard's filter list restates it today.

Three places name an event and each is now checked against that table: an
endpoint's `AuditPolicy` constrains its action by its resource, and two
assertions tie the emit-side metadata union to the vocabulary in both
directions. Follows the `apiKeyScopes` pattern in @nangohq/utils.

Drops `audit_log`, `exported` and `reauthorized`, which no event emits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/audit/lib/event.ts             | 11 +++-
 packages/types/lib/audit-trail/event.ts | 77 +++++++------------------
 2 files changed, 32 insertions(+), 56 deletions(-)

diff --git a/packages/audit/lib/event.ts b/packages/audit/lib/event.ts
index c477deee9a..387b1aeecd 100644
--- a/packages/audit/lib/event.ts
+++ b/packages/audit/lib/event.ts
@@ -1,11 +1,12 @@
 // `id` and `version` are stamped at the emit boundary, not by the caller.
 
-import type { AuditActor, AuditContext, AuditOutcome, AuditTarget, AuditTrailVersion } from '@nangohq/types';
+import type { AuditActor, AuditContext, AuditEventKey, AuditOutcome, AuditTarget, AuditTrailVersion } from '@nangohq/types';
 
 export type {
     AuditActor,
     AuditActorType,
     AuditContext,
+    AuditEventKey,
     AuditOutcome,
     AuditTarget,
     AuditTargetType,
@@ -152,6 +153,14 @@ export type AuditResourceAction =
     | { resource: 'mfa'; action: 'enrolled' | 'enabled' | 'disabled' | 'recovery_regenerated' }
     | { resource: 'mfa'; action: 'verified'; metadata?: MfaVerifiedMetadata };
 
+type EmittedKey<T extends { resource: string; action: string }> = T extends unknown ? `${T['resource']}.${T['action']}` : never;
+
+type EmittedButNotInVocabulary = Exclude<EmittedKey<AuditResourceAction>, AuditEventKey>;
+type InVocabularyButNotEmitted = Exclude<AuditEventKey, EmittedKey<AuditResourceAction>>;
+
+true satisfies [EmittedButNotInVocabulary] extends [never] ? true : never;
+true satisfies [InVocabularyButNotEmitted] extends [never] ? true : never;
+
 export type AuditEvent = AuditEventCommon & AuditResourceAction;
 
 export type StoredAuditEvent = AuditEvent & { id: string; version: AuditTrailVersion };
diff --git a/packages/types/lib/audit-trail/event.ts b/packages/types/lib/audit-trail/event.ts
index 74dee1d03e..d4cd4d1a7f 100644
--- a/packages/types/lib/audit-trail/event.ts
+++ b/packages/types/lib/audit-trail/event.ts
@@ -4,61 +4,28 @@ export type AuditTrailVersion = '2026-07-16';
 export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
 export type AuditOutcome = 'success' | 'failure' | 'denied';
 
-export type AuditResource =
-    | 'connection'
-    | 'sync'
-    | 'function'
-    | 'integration'
-    | 'api_key'
-    | 'member'
-    | 'team'
-    | 'user'
-    | 'environment'
-    | 'app_auth'
-    | 'mfa'
-    | 'billing'
-    | 'audit_log';
+// Not exported: this package emits no JavaScript, so a const here is unusable at runtime. Code needing
+// the list at runtime keeps a twin checked against `AuditEventKey`, as `apiKeyScopes` does for scopes.
+const AUDIT_EVENTS = {
+    connection: ['created', 'updated', 'metadata_updated', 'refreshed', 'deleted'],
+    sync: ['enabled', 'disabled', 'paused', 'started', 'triggered', 'cancelled', 'frequency_changed', 'variant_created', 'variant_deleted'],
+    function: ['deployed', 'upgraded', 'deleted'],
+    integration: ['created', 'updated', 'deleted'],
+    api_key: ['created', 'updated', 'deleted'],
+    member: ['invited', 'invite_accepted', 'invite_declined', 'invite_revoked', 'role_changed', 'removed'],
+    team: ['updated'],
+    user: ['updated'],
+    environment: ['created', 'updated', 'variables_changed', 'webhook_urls_changed', 'deleted'],
+    app_auth: ['login', 'logout', 'signup', 'password_changed', 'password_reset'],
+    mfa: ['enrolled', 'enabled', 'disabled', 'verified', 'recovery_regenerated'],
+    billing: ['plan_changed', 'trial_extended', 'details_changed', 'payment_method_added', 'payment_method_removed']
+} as const;
 
-export type AuditAction =
-    | 'created'
-    | 'reauthorized'
-    | 'refreshed'
-    | 'updated'
-    | 'metadata_updated'
-    | 'deleted'
-    | 'paused'
-    | 'started'
-    | 'cancelled'
-    | 'enabled'
-    | 'disabled'
-    | 'frequency_changed'
-    | 'triggered'
-    | 'variant_created'
-    | 'variant_deleted'
-    | 'upgraded'
-    | 'deployed'
-    | 'invited'
-    | 'invite_accepted'
-    | 'invite_declined'
-    | 'invite_revoked'
-    | 'removed'
-    | 'role_changed'
-    | 'variables_changed'
-    | 'webhook_urls_changed'
-    | 'login'
-    | 'logout'
-    | 'signup'
-    | 'password_changed'
-    | 'password_reset'
-    | 'enrolled'
-    | 'recovery_regenerated'
-    | 'verified'
-    | 'plan_changed'
-    | 'trial_extended'
-    | 'details_changed'
-    | 'payment_method_added'
-    | 'payment_method_removed'
-    | 'exported';
+export type AuditResource = keyof typeof AUDIT_EVENTS;
+export type AuditAction = (typeof AUDIT_EVENTS)[AuditResource][number];
+export type AuditActionOf<R extends AuditResource> = (typeof AUDIT_EVENTS)[R][number];
+
+export type AuditEventKey = { [R in AuditResource]: `${R}.${(typeof AUDIT_EVENTS)[R][number]}` }[AuditResource];
 
 export type AuditScope = 'account' | 'environment';
 
@@ -86,7 +53,7 @@ export interface AuditContext {
 // decision — a customer endpoint cannot be added without consciously opting in or out. The policy's
 // resource/action/scope are captured as type parameters so the endpoint's declaration and the
 // middleware spec that services it are checked against each other by the compiler.
-export interface AuditPolicy<R extends AuditResource = AuditResource, A extends AuditAction = AuditAction, S extends AuditScope = AuditScope> {
+export interface AuditPolicy<R extends AuditResource = AuditResource, A extends AuditActionOf<R> = AuditActionOf<R>, S extends AuditScope = AuditScope> {
     kind: 'audit';
     resource: R;
     action: A;

From 7a29d5108c9614b789bd0839f951607f5a14f423 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 15:42:29 +0200
Subject: [PATCH 12/16] refactor(audit): constrain the policy builder's action
 by its resource
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`Audit.auditable` took its action parameter independently of its resource, so
it accepted a pair no event can emit and only failed later, where the spec is
checked against the endpoint's declaration — reporting an assignability
mismatch rather than the invalid pair. It now fails on the argument itself.

Also derives `AuditAction` from `AuditActionOf` rather than repeating the
indexed access, so the table is read in one place.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/server/lib/middleware/audit.middleware.ts | 8 ++++++--
 packages/types/lib/audit-trail/event.ts            | 8 ++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/packages/server/lib/middleware/audit.middleware.ts b/packages/server/lib/middleware/audit.middleware.ts
index 7f00dcf9ed..0639e882cb 100644
--- a/packages/server/lib/middleware/audit.middleware.ts
+++ b/packages/server/lib/middleware/audit.middleware.ts
@@ -9,7 +9,7 @@ import type { RequestLocals } from '../utils/express.js';
 import type { AuditActor, AuditContext, AuditEvent, AuditOutcome, AuditTarget, AuditTargetType, MfaVerifiedMetadata } from '@nangohq/audit';
 import type {
     AcceptInvite,
-    AuditAction,
+    AuditActionOf,
     AuditPolicy,
     AuditResource,
     AuditScope,
@@ -80,7 +80,11 @@ type AuditRequest<TEndpoint extends Endpoint<any>> = Request<TEndpoint['Params']
 type AuditableEndpoint = Endpoint<any> & { Audit: AuditPolicy };
 
 const Audit = {
-    auditable: <R extends AuditResource, A extends AuditAction, S extends AuditScope>(policy: { resource: R; action: A; scope: S }): AuditPolicy<R, A, S> => ({
+    auditable: <R extends AuditResource, A extends AuditActionOf<R>, S extends AuditScope>(policy: {
+        resource: R;
+        action: A;
+        scope: S;
+    }): AuditPolicy<R, A, S> => ({
         kind: 'audit',
         ...policy
     })
diff --git a/packages/types/lib/audit-trail/event.ts b/packages/types/lib/audit-trail/event.ts
index d4cd4d1a7f..c4a036c723 100644
--- a/packages/types/lib/audit-trail/event.ts
+++ b/packages/types/lib/audit-trail/event.ts
@@ -4,8 +4,8 @@ export type AuditTrailVersion = '2026-07-16';
 export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
 export type AuditOutcome = 'success' | 'failure' | 'denied';
 
-// Not exported: this package emits no JavaScript, so a const here is unusable at runtime. Code needing
-// the list at runtime keeps a twin checked against `AuditEventKey`, as `apiKeyScopes` does for scopes.
+// Not exported: this package emits no JavaScript, so a const here is unusable at runtime — code needing
+// the list keeps a twin checked against `AuditEventKey`, as `apiKeyScopes` does for scopes.
 const AUDIT_EVENTS = {
     connection: ['created', 'updated', 'metadata_updated', 'refreshed', 'deleted'],
     sync: ['enabled', 'disabled', 'paused', 'started', 'triggered', 'cancelled', 'frequency_changed', 'variant_created', 'variant_deleted'],
@@ -22,10 +22,10 @@ const AUDIT_EVENTS = {
 } as const;
 
 export type AuditResource = keyof typeof AUDIT_EVENTS;
-export type AuditAction = (typeof AUDIT_EVENTS)[AuditResource][number];
 export type AuditActionOf<R extends AuditResource> = (typeof AUDIT_EVENTS)[R][number];
+export type AuditAction = AuditActionOf<AuditResource>;
 
-export type AuditEventKey = { [R in AuditResource]: `${R}.${(typeof AUDIT_EVENTS)[R][number]}` }[AuditResource];
+export type AuditEventKey = { [R in AuditResource]: `${R}.${AuditActionOf<R>}` }[AuditResource];
 
 export type AuditScope = 'account' | 'environment';
 

From b077849f6f589244db4126fc24f1752745a54795 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 15:43:30 +0200
Subject: [PATCH 13/16] refactor(audit): check the filter list against the
 vocabulary table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the hand-maintained list with a runtime twin of the vocabulary
introduced on the base branch. @nangohq/types emits no JavaScript, so the
table can't cross the package boundary as a value; two compile-time checks
keep the twin in step, as apiKeyScopes does in @nangohq/utils.

Fills in the 14 recorded pairs the hand-kept list was missing — every
lifecycle and authentication event from the coverage PRs that merged after
this branch was cut.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/pages/Audit/constants.ts | 45 +++++++++-----------
 1 file changed, 21 insertions(+), 24 deletions(-)

diff --git a/packages/webapp/src/pages/Audit/constants.ts b/packages/webapp/src/pages/Audit/constants.ts
index 5c6873235a..0812fad7cd 100644
--- a/packages/webapp/src/pages/Audit/constants.ts
+++ b/packages/webapp/src/pages/Audit/constants.ts
@@ -1,44 +1,44 @@
 import { formatKeyToLabel } from '@/utils/utils';
 
 import type { FilterOption } from '@/components/patterns/FilterMultiSelect';
-import type { AuditAction, AuditResource } from '@nangohq/types';
+import type { AuditAction, AuditActionOf, AuditEventKey, AuditResource } from '@nangohq/types';
 
 /**
- * The actions each resource can be recorded with. Hand-maintained against the emit side's
- * `AuditResourceAction` union, which lives in a server package the dashboard can't import — so a new
- * audited event has to be added here too, or it stays unfilterable. `Record<AuditResource, …>` at least
- * makes a new *resource* a compile error. An empty list means nothing is emitted for that resource yet.
+ * Runtime twin of the audit event vocabulary: `@nangohq/types` emits no JavaScript, so the table can't
+ * cross the package boundary as a value. Kept in step by the checks below, as `apiKeyScopes` does in
+ * `@nangohq/utils`.
  */
-const actionsByResource: Record<AuditResource, readonly AuditAction[]> = {
-    connection: ['updated', 'metadata_updated', 'refreshed', 'deleted'],
-    integration: ['updated', 'deleted'],
-    function: ['deleted'],
-    api_key: ['updated', 'deleted'],
+const actionsByResource = {
+    connection: ['created', 'updated', 'metadata_updated', 'refreshed', 'deleted'],
     sync: ['enabled', 'disabled', 'paused', 'started', 'triggered', 'cancelled', 'frequency_changed', 'variant_created', 'variant_deleted'],
-    member: ['role_changed', 'removed'],
+    function: ['deployed', 'upgraded', 'deleted'],
+    integration: ['created', 'updated', 'deleted'],
+    api_key: ['created', 'updated', 'deleted'],
+    member: ['invited', 'invite_accepted', 'invite_declined', 'invite_revoked', 'role_changed', 'removed'],
     team: ['updated'],
     user: ['updated'],
-    environment: ['updated', 'variables_changed', 'webhook_urls_changed', 'deleted'],
-    billing: ['plan_changed', 'trial_extended', 'details_changed', 'payment_method_added', 'payment_method_removed'],
-    app_auth: ['password_changed'],
+    environment: ['created', 'updated', 'variables_changed', 'webhook_urls_changed', 'deleted'],
+    app_auth: ['login', 'logout', 'signup', 'password_changed', 'password_reset'],
     mfa: ['enrolled', 'enabled', 'disabled', 'verified', 'recovery_regenerated'],
-    audit_log: []
-};
+    billing: ['plan_changed', 'trial_extended', 'details_changed', 'payment_method_added', 'payment_method_removed']
+} as const satisfies { [R in AuditResource]: readonly AuditActionOf<R>[] };
+
+type ListedEvent = { [R in AuditResource]: `${R}.${(typeof actionsByResource)[R][number]}` }[AuditResource];
+true satisfies [Exclude<AuditEventKey, ListedEvent>] extends [never] ? true : never;
 
 const resourceLabels: Record<AuditResource, string> = {
     connection: 'Connection',
-    integration: 'Integration',
+    sync: 'Sync',
     function: 'Function',
+    integration: 'Integration',
     api_key: 'API key',
-    sync: 'Sync',
     member: 'Member',
     team: 'Team',
     user: 'User',
     environment: 'Environment',
-    billing: 'Billing',
     app_auth: 'Authentication',
     mfa: 'MFA',
-    audit_log: 'Audit log'
+    billing: 'Billing'
 };
 
 export const ALL = 'all';
@@ -46,12 +46,9 @@ export const ALL = 'all';
 export type ResourceFilter = AuditResource | typeof ALL;
 export type ActionFilter = AuditAction | typeof ALL;
 
-// Resources with nothing to record are left out rather than offered as a filter that matches nothing.
 export const resourceOptions: FilterOption<ResourceFilter>[] = [
     { value: ALL, label: 'All' },
-    ...(Object.keys(actionsByResource) as AuditResource[]).flatMap((resource) =>
-        actionsByResource[resource].length > 0 ? [{ value: resource, label: resourceLabels[resource] }] : []
-    )
+    ...(Object.keys(actionsByResource) as AuditResource[]).map((resource) => ({ value: resource, label: resourceLabels[resource] }))
 ];
 
 export function actionOptionsFor(resource: AuditResource): FilterOption<ActionFilter>[] {

From 3fb4d1aa40edf1018571c762b8a086fd2a047cf3 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 17:58:41 +0200
Subject: [PATCH 14/16] feat(audit): call the dashboard page Audit trail

Renames every user-facing occurrence of "Audit log": the page heading, the
profile menu entry, the breadcrumb, the browser tab titles and the
not-enabled and access-denied copy. The route and the query keys keep their
existing paths.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/app/router.tsx             |  2 +-
 .../src/layout/AppSidebar/ProfileDropdown.tsx  |  2 +-
 packages/webapp/src/pages/Audit/Show.tsx       | 18 +++++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/packages/webapp/src/app/router.tsx b/packages/webapp/src/app/router.tsx
index ff65bfa7c3..cdc1c86d87 100644
--- a/packages/webapp/src/app/router.tsx
+++ b/packages/webapp/src/app/router.tsx
@@ -189,7 +189,7 @@ export const router = sentryCreateBrowserRouter([
             {
                 path: '/team/audit',
                 element: <AuditShow />,
-                handle: { breadcrumb: 'Audit log' } as BreadcrumbHandle
+                handle: { breadcrumb: 'Audit trail' } as BreadcrumbHandle
             },
             {
                 path: '/:env',
diff --git a/packages/webapp/src/layout/AppSidebar/ProfileDropdown.tsx b/packages/webapp/src/layout/AppSidebar/ProfileDropdown.tsx
index 288a4de930..1073c332ab 100644
--- a/packages/webapp/src/layout/AppSidebar/ProfileDropdown.tsx
+++ b/packages/webapp/src/layout/AppSidebar/ProfileDropdown.tsx
@@ -60,7 +60,7 @@ export const ProfileDropdown: React.FC = () => {
 
         if (meta?.auditTrail && canReadAuditTrail) {
             list.push({
-                label: 'Audit log',
+                label: 'Audit trail',
                 icon: ScrollText,
                 href: `/team/audit`
             });
diff --git a/packages/webapp/src/pages/Audit/Show.tsx b/packages/webapp/src/pages/Audit/Show.tsx
index daa7445331..a4f4733643 100644
--- a/packages/webapp/src/pages/Audit/Show.tsx
+++ b/packages/webapp/src/pages/Audit/Show.tsx
@@ -65,13 +65,13 @@ export const AuditShow: React.FC = () => {
     // Menu entry + route are gated on the flag and the permission, but guard direct navigation too.
     if (meta && !meta.auditTrail) {
         return (
-            <DashboardLayout fullWidth title="Audit log">
+            <DashboardLayout fullWidth title="Audit trail">
                 <Helmet>
-                    <title>Audit log - Nango</title>
+                    <title>Audit trail - Nango</title>
                 </Helmet>
                 <div className="flex gap-2 flex-col border border-border-muted rounded-md items-center text-text-strong text-center p-10 py-20">
-                    <h2 className="text-xl text-center">Audit log not enabled</h2>
-                    <div className="text-sm text-text-muted">The audit log is not enabled for this account.</div>
+                    <h2 className="text-xl text-center">Audit trail not enabled</h2>
+                    <div className="text-sm text-text-muted">The audit trail is not enabled for this account.</div>
                 </div>
             </DashboardLayout>
         );
@@ -79,22 +79,22 @@ export const AuditShow: React.FC = () => {
 
     if (user && !canReadAuditTrail) {
         return (
-            <DashboardLayout fullWidth title="Audit log">
+            <DashboardLayout fullWidth title="Audit trail">
                 <Helmet>
-                    <title>Audit log - Nango</title>
+                    <title>Audit trail - Nango</title>
                 </Helmet>
                 <div className="flex gap-2 flex-col border border-border-muted rounded-md items-center text-text-strong text-center p-10 py-20">
                     <h2 className="text-xl text-center">Access denied</h2>
-                    <div className="text-sm text-text-muted">Your role does not have access to the audit log.</div>
+                    <div className="text-sm text-text-muted">Your role does not have access to the audit trail.</div>
                 </div>
             </DashboardLayout>
         );
     }
 
     return (
-        <DashboardLayout fullWidth title="Audit log">
+        <DashboardLayout fullWidth title="Audit trail">
             <Helmet>
-                <title>Audit log - Nango</title>
+                <title>Audit trail - Nango</title>
             </Helmet>
 
             <div className="flex flex-col gap-3">

From 4c39dc50e4bf1f2b0b10395bf20fb93c6474bdb4 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 18:30:08 +0200
Subject: [PATCH 15/16] refactor(audit): make the vocabulary table a type,
 collapse the assertions

The table was a const in a package that emits no JavaScript, so it was
discarded at compile time and needed a comment explaining why it couldn't be
exported. As an interface it derives everything the same way with no runtime
artifact and nothing to explain.

Both vocabulary assertions fit in one, checking each direction as a tuple
position.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/audit/lib/event.ts             |  3 +--
 packages/types/lib/audit-trail/event.ts | 36 ++++++++++++-------------
 2 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/packages/audit/lib/event.ts b/packages/audit/lib/event.ts
index 387b1aeecd..82582e9524 100644
--- a/packages/audit/lib/event.ts
+++ b/packages/audit/lib/event.ts
@@ -158,8 +158,7 @@ type EmittedKey<T extends { resource: string; action: string }> = T extends unkn
 type EmittedButNotInVocabulary = Exclude<EmittedKey<AuditResourceAction>, AuditEventKey>;
 type InVocabularyButNotEmitted = Exclude<AuditEventKey, EmittedKey<AuditResourceAction>>;
 
-true satisfies [EmittedButNotInVocabulary] extends [never] ? true : never;
-true satisfies [InVocabularyButNotEmitted] extends [never] ? true : never;
+true satisfies [EmittedButNotInVocabulary, InVocabularyButNotEmitted] extends [never, never] ? true : never;
 
 export type AuditEvent = AuditEventCommon & AuditResourceAction;
 
diff --git a/packages/types/lib/audit-trail/event.ts b/packages/types/lib/audit-trail/event.ts
index c4a036c723..f014dfc5e5 100644
--- a/packages/types/lib/audit-trail/event.ts
+++ b/packages/types/lib/audit-trail/event.ts
@@ -4,28 +4,26 @@ export type AuditTrailVersion = '2026-07-16';
 export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
 export type AuditOutcome = 'success' | 'failure' | 'denied';
 
-// Not exported: this package emits no JavaScript, so a const here is unusable at runtime — code needing
-// the list keeps a twin checked against `AuditEventKey`, as `apiKeyScopes` does for scopes.
-const AUDIT_EVENTS = {
-    connection: ['created', 'updated', 'metadata_updated', 'refreshed', 'deleted'],
-    sync: ['enabled', 'disabled', 'paused', 'started', 'triggered', 'cancelled', 'frequency_changed', 'variant_created', 'variant_deleted'],
-    function: ['deployed', 'upgraded', 'deleted'],
-    integration: ['created', 'updated', 'deleted'],
-    api_key: ['created', 'updated', 'deleted'],
-    member: ['invited', 'invite_accepted', 'invite_declined', 'invite_revoked', 'role_changed', 'removed'],
-    team: ['updated'],
-    user: ['updated'],
-    environment: ['created', 'updated', 'variables_changed', 'webhook_urls_changed', 'deleted'],
-    app_auth: ['login', 'logout', 'signup', 'password_changed', 'password_reset'],
-    mfa: ['enrolled', 'enabled', 'disabled', 'verified', 'recovery_regenerated'],
-    billing: ['plan_changed', 'trial_extended', 'details_changed', 'payment_method_added', 'payment_method_removed']
-} as const;
+interface AuditEventTable {
+    connection: 'created' | 'updated' | 'metadata_updated' | 'refreshed' | 'deleted';
+    sync: 'enabled' | 'disabled' | 'paused' | 'started' | 'triggered' | 'cancelled' | 'frequency_changed' | 'variant_created' | 'variant_deleted';
+    function: 'deployed' | 'upgraded' | 'deleted';
+    integration: 'created' | 'updated' | 'deleted';
+    api_key: 'created' | 'updated' | 'deleted';
+    member: 'invited' | 'invite_accepted' | 'invite_declined' | 'invite_revoked' | 'role_changed' | 'removed';
+    team: 'updated';
+    user: 'updated';
+    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'deleted';
+    app_auth: 'login' | 'logout' | 'signup' | 'password_changed' | 'password_reset';
+    mfa: 'enrolled' | 'enabled' | 'disabled' | 'verified' | 'recovery_regenerated';
+    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed';
+}
 
-export type AuditResource = keyof typeof AUDIT_EVENTS;
-export type AuditActionOf<R extends AuditResource> = (typeof AUDIT_EVENTS)[R][number];
+export type AuditResource = keyof AuditEventTable;
+export type AuditActionOf<R extends AuditResource> = AuditEventTable[R];
 export type AuditAction = AuditActionOf<AuditResource>;
 
-export type AuditEventKey = { [R in AuditResource]: `${R}.${AuditActionOf<R>}` }[AuditResource];
+export type AuditEventKey = { [R in AuditResource]: `${R}.${AuditEventTable[R]}` }[AuditResource];
 
 export type AuditScope = 'account' | 'environment';
 

From 998aff6064a3f039337bcea0d24ac8128d78cd82 Mon Sep 17 00:00:00 2001
From: Pau <pau@nango.dev>
Date: Fri, 31 Jul 2026 18:35:20 +0200
Subject: [PATCH 16/16] refactor(audit): correct the twin's comment for the
 type-only vocabulary

The vocabulary table is a type now, so there is no value to export and the
"emits no JavaScript" reasoning no longer describes why the dashboard keeps
its own copy.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/pages/Audit/constants.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/packages/webapp/src/pages/Audit/constants.ts b/packages/webapp/src/pages/Audit/constants.ts
index 0812fad7cd..35d289eaf0 100644
--- a/packages/webapp/src/pages/Audit/constants.ts
+++ b/packages/webapp/src/pages/Audit/constants.ts
@@ -4,9 +4,8 @@ import type { FilterOption } from '@/components/patterns/FilterMultiSelect';
 import type { AuditAction, AuditActionOf, AuditEventKey, AuditResource } from '@nangohq/types';
 
 /**
- * Runtime twin of the audit event vocabulary: `@nangohq/types` emits no JavaScript, so the table can't
- * cross the package boundary as a value. Kept in step by the checks below, as `apiKeyScopes` does in
- * `@nangohq/utils`.
+ * Runtime twin of the audit event vocabulary, which `@nangohq/types` carries as types only. Kept in
+ * step by the checks below, as `apiKeyScopes` does in `@nangohq/utils`.
  */
 const actionsByResource = {
     connection: ['created', 'updated', 'metadata_updated', 'refreshed', 'deleted'],