Vault access analytics

A vault inventory tells you what exists. It does not tell you what is being read. Unused keys linger, and a sudden spike in reads is easy to miss if activity lives in a separate audit export. The secrets vault now shows access activity trends so teams can spot unusual key usage next to the inventory.

This is the longer note behind the July 23 changelog entry.

How it works

Vault already holds three related things for an environment: API keys your backend uses to call Authdog, secrets your workloads read, and KMS keys that wrap encrypted material.

The Analytics tab (?tab=analytics) charts access events over selectable time ranges. It shows which keys and secrets in this environment are being exercised, how often, and when each was last seen. Activity volume sits next to the key and secret inventory, so you do not have to leave Vault to compare "what we stored" with "what was used."

A key with no recent activity is a candidate for revocation. A secret that is read on every request will show a steady series; a quiet secret that suddenly moves is the pattern you came for.

List responses on the Vault API still redact value. A single-secret read returns plaintext and records a READ access-log entry. Analytics is the console view of that access trail, not a second store.

Set it up

Nothing to provision beyond Vault itself.

1. Open Secrets > Vault in the Authdog console for the environment you care about.
2. Switch to the Analytics tab.
3. Pick a time range and compare charts with the API Keys and Secrets inventories.
4. Follow up on keys with no recent activity, or on spikes you cannot explain, in Audit.

Use a non-production environment first if you are learning the shape of the charts.

Trust boundaries

Analytics is a visibility surface for operators who can already open Vault. It does not grant decrypt rights by itself, but anyone with sufficient console access to read Vault can still receive plaintext on an authorized read. "Encrypted" means protected at rest, not write-only.

Do not treat a quiet chart as proof a secret was never copied. Analytics records access Authdog saw. Offline copies, screenshots, and leaked values from creation dialogs will not appear.

Environment API secrets (adenv_…) authenticate Vault API calls. They are not the same as named vault entries. Keep them out of the secret list, and apply least privilege plus MFA on administrator sessions.

Try it

Open Vault Analytics beside the inventory and change the time range. Secret read/write setup is in Vault and Vault in the console. The original release note is in the changelog.