PlanetScale Audit Logs

The PlanetScale source polls your organization’s audit logs every 60 seconds using a service token. Audit logs capture administrative actions such as database creation and deletion, branch operations, user access changes, and password management.

On the first poll RunReveal will ingest the most recent page of audit events (up to 200). Subsequent polls will continuously fetch any new events that have occurred since the last check.

Setup

Step 1: Create a PlanetScale Service Token

Service tokens are the recommended way to grant RunReveal API access without tying credentials to a specific user account.

1. Sign in to your PlanetScale dashboard.
2. Navigate to your organization settings.
3. Select Service tokens from the left-hand navigation.
4. Click New service token.
5. Give the token a descriptive name such as RunReveal.
6. After the token is created, copy both the Token ID and the Token secret — the secret is only shown once.

Step 2: Grant the Required Permission

Once the token is created you need to grant it access to read audit logs.

1. From the Service tokens page, find your newly created token and click on it.
2. Under Organization permissions, click Add permission.
3. Enable the audit_logs_read permission.
4. Save your changes.

Step 3: Add the Source in RunReveal

1. Navigate to Sources in RunReveal.
2. Find the PlanetScale tile and click it.
3. Fill in the following fields:

4. Click Create to save the source.

Verify It’s Working

Once added, logs should begin flowing within a minute. You can validate data is arriving by running:

SELECT * FROM runreveal.planetscale_logs LIMIT 10

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• PlanetScale Audit Log API Reference - Full API documentation for the audit log endpoint
• PlanetScale Service Tokens - How to create and manage service tokens