Which token made that call

A production container was restarted at 2:14 AM. Nobody on-call did it.

GET /users/auth/activity with a date filter returns the request-level log of the account's authenticated API use: method, path, status, client IP, user agent, the realm, and the API token the request was made with. The 2:14 entry names a token called ci-deploy-legacy, created fourteen months ago, still valid. Now you know which pipeline to kill.

Credentials are stripped before the row is stored. There is no endpoint to delete your own records; they age out after a year. The trail exists to answer whether something else reached your account, so whatever holds your session can't erase its footprints.

Container starts, permission edits, token creation, snapshot restores: on Hoody they are all HTTP requests to one API, so the log isn't a sample of what happened.

Every control-plane action is a request, and every request leaves a row.