---
title: "ADR-017: Audit metadata retention"
manual: "nr-vault"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-vault:adr-017-audit-metadata-retention@1.0"
source: "Developer/Adr/ADR-017-AuditMetadataRetention.rst"
rendered: "2026-09-18T07:37:50+00:00"
---

# ADR-017: Audit metadata retention {#adr-017-audit-metadata-retention-1}

**Table of contents**

-   [Status](https://docs.typo3.org/permalink/netresearch/nr-vault:status@1.0)
-   [Date](https://docs.typo3.org/permalink/netresearch/nr-vault:date@1.0)
-   [Context](https://docs.typo3.org/permalink/netresearch/nr-vault:context@1.0)
-   [Decision](https://docs.typo3.org/permalink/netresearch/nr-vault:decision@1.0)
-   [Consequences](https://docs.typo3.org/permalink/netresearch/nr-vault:consequences@1.0)
-   [Alternatives considered](https://docs.typo3.org/permalink/netresearch/nr-vault:alternatives-considered@1.0)
-   [Related decisions](https://docs.typo3.org/permalink/netresearch/nr-vault:related-decisions@1.0)

## Status {#status}

Accepted

## Date {#date}

2026-01-12

## Context {#context}

We want auditability ("who called what, when, and with what outcome") without:

-   leaking secrets into logs,
-   storing sensitive request/response bodies,
-   or exploding database size and causing operational pain.

Audit is necessary, but must be safe and bounded.

## Decision {#decision}

-   The outbound audit log stores **metadata only**:

    -   serviceId
    -   caller identity
    -   method
    -   path template
    -   status code
    -   duration
    -   bytes in/out
    -   error classification
    -   correlation id
-   It does **not** store:

    -   request/response bodies
    -   Authorization headers
    -   any secret material
-   Retention and/or sampling is supported and should have safe defaults

## Consequences {#consequences}

### Positive {#positive}

-   Useful for compliance, debugging, and incident response
-   Low risk of secret leakage via audit
-   Bounded storage growth

### Negative {#negative}

-   Deep forensic analysis may still require separate application-level tracing
    in exceptional cases

## Alternatives considered {#alternatives-considered}

### Store request/response bodies by default {#store-request-response-bodies-by-default}

Log full request and response bodies for maximum detail.

**Rejected**: high leakage risk and storage blow-up.

### No audit logs {#no-audit-logs}

Do not log outbound requests at all.

**Rejected**: undermines the core governance value proposition.

## Related decisions {#related-decisions}

-   [ADR-006: Audit logging](https://docs.typo3.org/permalink/netresearch/nr-vault:adr-006-audit-logging@1.0) \- Core audit logging model
-   [ADR-010: Secure Outbound inside nr-vault](https://docs.typo3.org/permalink/netresearch/nr-vault:adr-010-secure-outbound@1.0) \- Secure Outbound feature (parent)