From a69915959370b5bef496911bd30fc03a5df767eb Mon Sep 17 00:00:00 2001
From: Gerrit <tirreg91@googlemail.com>
Date: Tue, 17 Mar 2026 11:31:54 +0100
Subject: [PATCH 1/2] Add audit API definition.

---
 doc/index.html                                | 584 +++++++++++++++
 go/client/client.go                           |  22 +
 .../admin/v2/adminv2connect/audit.connect.go  | 148 ++++
 go/metalstack/admin/v2/audit.pb.go            | 301 ++++++++
 .../api/v2/apiv2connect/audit.connect.go      | 148 ++++
 go/metalstack/api/v2/audit.pb.go              | 704 ++++++++++++++++++
 go/permissions/servicepermissions.go          |  20 +
 go/tests/mock_clients.go                      |  18 +
 go/tests/mocks/client/Adminv2.go              |  46 ++
 go/tests/mocks/client/Apiv2.go                |  46 ++
 .../v2/adminv2connect/AuditServiceClient.go   | 175 +++++
 .../v2/adminv2connect/AuditServiceHandler.go  | 175 +++++
 .../api/v2/apiv2connect/AuditServiceClient.go | 175 +++++
 .../v2/apiv2connect/AuditServiceHandler.go    | 175 +++++
 js/metalstack/admin/v2/audit_pb.d.ts          | 112 +++
 js/metalstack/admin/v2/audit_pb.js            |  37 +
 js/metalstack/admin/v2/audit_pb.ts            | 138 ++++
 js/metalstack/api/v2/audit_pb.d.ts            | 303 ++++++++
 js/metalstack/api/v2/audit_pb.js              |  78 ++
 js/metalstack/api/v2/audit_pb.ts              | 362 +++++++++
 proto/metalstack/admin/v2/audit.proto         |  47 ++
 proto/metalstack/api/v2/audit.proto           | 121 +++
 python/metalstack/admin/v2/audit_connect.py   | 185 +++++
 python/metalstack/admin/v2/audit_pb2.py       |  56 ++
 python/metalstack/admin/v2/audit_pb2.pyi      |  36 +
 python/metalstack/api/v2/audit_connect.py     | 185 +++++
 python/metalstack/api/v2/audit_pb2.py         |  87 +++
 python/metalstack/api/v2/audit_pb2.pyi        | 102 +++
 python/metalstack/client/client.py            |   8 +
 29 files changed, 4594 insertions(+)
 create mode 100644 go/metalstack/admin/v2/adminv2connect/audit.connect.go
 create mode 100644 go/metalstack/admin/v2/audit.pb.go
 create mode 100644 go/metalstack/api/v2/apiv2connect/audit.connect.go
 create mode 100644 go/metalstack/api/v2/audit.pb.go
 create mode 100644 go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceClient.go
 create mode 100644 go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceHandler.go
 create mode 100644 go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceClient.go
 create mode 100644 go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceHandler.go
 create mode 100644 js/metalstack/admin/v2/audit_pb.d.ts
 create mode 100644 js/metalstack/admin/v2/audit_pb.js
 create mode 100644 js/metalstack/admin/v2/audit_pb.ts
 create mode 100644 js/metalstack/api/v2/audit_pb.d.ts
 create mode 100644 js/metalstack/api/v2/audit_pb.js
 create mode 100644 js/metalstack/api/v2/audit_pb.ts
 create mode 100644 proto/metalstack/admin/v2/audit.proto
 create mode 100644 proto/metalstack/api/v2/audit.proto
 create mode 100644 python/metalstack/admin/v2/audit_connect.py
 create mode 100644 python/metalstack/admin/v2/audit_pb2.py
 create mode 100644 python/metalstack/admin/v2/audit_pb2.pyi
 create mode 100644 python/metalstack/api/v2/audit_connect.py
 create mode 100644 python/metalstack/api/v2/audit_pb2.py
 create mode 100644 python/metalstack/api/v2/audit_pb2.pyi

diff --git a/doc/index.html b/doc/index.html
index 1cf20042..f5494335 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -320,6 +320,80 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#metalstack%2fapi%2fv2%2faudit.proto">metalstack/api/v2/audit.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditQuery"><span class="badge">M</span>AuditQuery</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditServiceGetRequest"><span class="badge">M</span>AuditServiceGetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditServiceGetResponse"><span class="badge">M</span>AuditServiceGetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditServiceListRequest"><span class="badge">M</span>AuditServiceListRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditServiceListResponse"><span class="badge">M</span>AuditServiceListResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditTrace"><span class="badge">M</span>AuditTrace</a>
+                </li>
+              
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditPhase"><span class="badge">E</span>AuditPhase</a>
+                </li>
+              
+              
+              
+                <li>
+                  <a href="#metalstack.api.v2.AuditService"><span class="badge">S</span>AuditService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#metalstack%2fadmin%2fv2%2faudit.proto">metalstack/admin/v2/audit.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.AuditServiceGetRequest"><span class="badge">M</span>AuditServiceGetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.AuditServiceGetResponse"><span class="badge">M</span>AuditServiceGetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.AuditServiceListRequest"><span class="badge">M</span>AuditServiceListRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.admin.v2.AuditServiceListResponse"><span class="badge">M</span>AuditServiceListResponse</a>
+                </li>
+              
+              
+              
+              
+                <li>
+                  <a href="#metalstack.admin.v2.AuditService"><span class="badge">S</span>AuditService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#metalstack%2fapi%2fv2%2ftoken.proto">metalstack/api/v2/token.proto</a>
             <ul>
@@ -3246,6 +3320,516 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
       
     
       
+      <div class="file-heading">
+        <h2 id="metalstack/api/v2/audit.proto">metalstack/api/v2/audit.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.api.v2.AuditQuery">AuditQuery</h3>
+        <p>AuditServiceListRequest is the request payload to list audits</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Uuid of the audit trace </p></td>
+                </tr>
+              
+                <tr>
+                  <td>from</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>optional</td>
+                  <td><p>From describes the start of the time window in which to list audit traces. Defaults to the last eight hours </p></td>
+                </tr>
+              
+                <tr>
+                  <td>to</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td>optional</td>
+                  <td><p>To describes the end of the time window in which to list audit traces. Defaults to the time the request was issued </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>User is the user who called the api method </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Project is the project targeted by the api call </p></td>
+                </tr>
+              
+                <tr>
+                  <td>method</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Method is the api method that was called </p></td>
+                </tr>
+              
+                <tr>
+                  <td>source_ip</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Source IP contains the ip address of the caller </p></td>
+                </tr>
+              
+                <tr>
+                  <td>result_code</td>
+                  <td><a href="#int32">int32</a></td>
+                  <td>optional</td>
+                  <td><p>Result Code is a string describing the result of the api call </p></td>
+                </tr>
+              
+                <tr>
+                  <td>body</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Body is a string providing text-search of the body field </p></td>
+                </tr>
+              
+                <tr>
+                  <td>limit</td>
+                  <td><a href="#int32">int32</a></td>
+                  <td>optional</td>
+                  <td><p>Limit is a number limiting the length of the response (min: 1, max: 1000, defaults to 200) </p></td>
+                </tr>
+              
+                <tr>
+                  <td>phase</td>
+                  <td><a href="#metalstack.api.v2.AuditPhase">AuditPhase</a></td>
+                  <td>optional</td>
+                  <td><p>Phase specifies the audit phase </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.AuditServiceGetRequest">AuditServiceGetRequest</h3>
+        <p>AuditServiceGetRequest is the request payload of a audit get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login for this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Uuid of the audit trace </p></td>
+                </tr>
+              
+                <tr>
+                  <td>phase</td>
+                  <td><a href="#metalstack.api.v2.AuditPhase">AuditPhase</a></td>
+                  <td>optional</td>
+                  <td><p>Phase specifies the audit phase. Defaults to request </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.AuditServiceGetResponse">AuditServiceGetResponse</h3>
+        <p>AuditServiceGetResponse is the response payload of a audit get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>trace</td>
+                  <td><a href="#metalstack.api.v2.AuditTrace">AuditTrace</a></td>
+                  <td></td>
+                  <td><p>Trace is the audit trace </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.AuditServiceListRequest">AuditServiceListRequest</h3>
+        <p>AuditServiceListRequest is the request payload for a audit list request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login for this tenant </p></td>
+                </tr>
+              
+                <tr>
+                  <td>query</td>
+                  <td><a href="#metalstack.api.v2.AuditQuery">AuditQuery</a></td>
+                  <td></td>
+                  <td><p>Query for audit traces </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.AuditServiceListResponse">AuditServiceListResponse</h3>
+        <p>AuditServiceListResponse is the response payload of a audit list request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>traces</td>
+                  <td><a href="#metalstack.api.v2.AuditTrace">AuditTrace</a></td>
+                  <td>repeated</td>
+                  <td><p>Traces is a list of audit traces </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.AuditTrace">AuditTrace</h3>
+        <p>AuditTrace is an audit trace</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Uuid of the audit trace </p></td>
+                </tr>
+              
+                <tr>
+                  <td>timestamp</td>
+                  <td><a href="#google.protobuf.Timestamp">google.protobuf.Timestamp</a></td>
+                  <td></td>
+                  <td><p>Timestamp is the timestamp when the request arrived at the api </p></td>
+                </tr>
+              
+                <tr>
+                  <td>user</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>User is the login user who called the api method </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Tenant is the tenant targeted by the api call </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Project is the project targeted by the api call </p></td>
+                </tr>
+              
+                <tr>
+                  <td>method</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Method is the api method that was called </p></td>
+                </tr>
+              
+                <tr>
+                  <td>body</td>
+                  <td><a href="#string">string</a></td>
+                  <td>optional</td>
+                  <td><p>Body is the payload of the api call. In the request phase this contains the payload sent by the client, in the request phase it contains the payload returned by the api server </p></td>
+                </tr>
+              
+                <tr>
+                  <td>source_ip</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Source IP contains the source ip address of the api call </p></td>
+                </tr>
+              
+                <tr>
+                  <td>result_code</td>
+                  <td><a href="#int32">int32</a></td>
+                  <td>optional</td>
+                  <td><p>Result Code is a status code describing the result of the api call. It is set for traces in the response phase and contains official gRPC status codes </p></td>
+                </tr>
+              
+                <tr>
+                  <td>phase</td>
+                  <td><a href="#metalstack.api.v2.AuditPhase">AuditPhase</a></td>
+                  <td></td>
+                  <td><p>Phase represents the phase of the audit trace </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+        <h3 id="metalstack.api.v2.AuditPhase">AuditPhase</h3>
+        <p>AuditPhase specifies phase of an audit trace</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>AUDIT_PHASE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p>AUDIT_PHASE_UNSPECIFIED is not specified</p></td>
+              </tr>
+            
+              <tr>
+                <td>AUDIT_PHASE_REQUEST</td>
+                <td>1</td>
+                <td><p>AUDIT_PHASE_REQUEST defines an audit trace in the request phase</p></td>
+              </tr>
+            
+              <tr>
+                <td>AUDIT_PHASE_RESPONSE</td>
+                <td>2</td>
+                <td><p>AUDIT_PHASE_REQUEST defines an audit trace in the response phase</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="metalstack.api.v2.AuditService">AuditService</h3>
+        <p>AuditService serves audit related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Get</td>
+                <td><a href="#metalstack.api.v2.AuditServiceGetRequest">AuditServiceGetRequest</a></td>
+                <td><a href="#metalstack.api.v2.AuditServiceGetResponse">AuditServiceGetResponse</a></td>
+                <td><p>Get an audit trace</p></td>
+              </tr>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.api.v2.AuditServiceListRequest">AuditServiceListRequest</a></td>
+                <td><a href="#metalstack.api.v2.AuditServiceListResponse">AuditServiceListResponse</a></td>
+                <td><p>List audit traces</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="metalstack/admin/v2/audit.proto">metalstack/admin/v2/audit.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="metalstack.admin.v2.AuditServiceGetRequest">AuditServiceGetRequest</h3>
+        <p>AuditServiceGetRequest is the request payload of a audit get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Uuid of the audit trace </p></td>
+                </tr>
+              
+                <tr>
+                  <td>phase</td>
+                  <td><a href="#metalstack.api.v2.AuditPhase">metalstack.api.v2.AuditPhase</a></td>
+                  <td>optional</td>
+                  <td><p>Phase specifies the audit phase. Defaults to request </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.AuditServiceGetResponse">AuditServiceGetResponse</h3>
+        <p>AuditServiceGetResponse is the response payload of a audit get request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>trace</td>
+                  <td><a href="#metalstack.api.v2.AuditTrace">metalstack.api.v2.AuditTrace</a></td>
+                  <td></td>
+                  <td><p>Trace is the audit trace </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.AuditServiceListRequest">AuditServiceListRequest</h3>
+        <p>AuditServiceListRequest is the request payload to list audits</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>query</td>
+                  <td><a href="#metalstack.api.v2.AuditQuery">metalstack.api.v2.AuditQuery</a></td>
+                  <td></td>
+                  <td><p>Query for audit traces </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.admin.v2.AuditServiceListResponse">AuditServiceListResponse</h3>
+        <p>AuditServiceListResponse is the response payload of a audit list request</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>traces</td>
+                  <td><a href="#metalstack.api.v2.AuditTrace">metalstack.api.v2.AuditTrace</a></td>
+                  <td>repeated</td>
+                  <td><p>Traces is a list of audit traces </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="metalstack.admin.v2.AuditService">AuditService</h3>
+        <p>AuditService serves audit related functions</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>Get</td>
+                <td><a href="#metalstack.admin.v2.AuditServiceGetRequest">AuditServiceGetRequest</a></td>
+                <td><a href="#metalstack.admin.v2.AuditServiceGetResponse">AuditServiceGetResponse</a></td>
+                <td><p>Get an audit trace</p></td>
+              </tr>
+            
+              <tr>
+                <td>List</td>
+                <td><a href="#metalstack.admin.v2.AuditServiceListRequest">AuditServiceListRequest</a></td>
+                <td><a href="#metalstack.admin.v2.AuditServiceListResponse">AuditServiceListResponse</a></td>
+                <td><p>List all audit traces</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
       <div class="file-heading">
         <h2 id="metalstack/api/v2/token.proto">metalstack/api/v2/token.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/go/client/client.go b/go/client/client.go
index d270dd58..9c7577b2 100755
--- a/go/client/client.go
+++ b/go/client/client.go
@@ -26,6 +26,7 @@ type (
 		interceptors []connect.Interceptor
 	}
 	Adminv2 interface {
+		Audit() adminv2connect.AuditServiceClient
 		Component() adminv2connect.ComponentServiceClient
 		Filesystem() adminv2connect.FilesystemServiceClient
 		Image() adminv2connect.ImageServiceClient
@@ -45,6 +46,7 @@ type (
 	}
 
 	adminv2 struct {
+		auditservice               adminv2connect.AuditServiceClient
 		componentservice           adminv2connect.ComponentServiceClient
 		filesystemservice          adminv2connect.FilesystemServiceClient
 		imageservice               adminv2connect.ImageServiceClient
@@ -64,6 +66,7 @@ type (
 	}
 
 	Apiv2 interface {
+		Audit() apiv2connect.AuditServiceClient
 		Filesystem() apiv2connect.FilesystemServiceClient
 		Health() apiv2connect.HealthServiceClient
 		Image() apiv2connect.ImageServiceClient
@@ -83,6 +86,7 @@ type (
 	}
 
 	apiv2 struct {
+		auditservice               apiv2connect.AuditServiceClient
 		filesystemservice          apiv2connect.FilesystemServiceClient
 		healthservice              apiv2connect.HealthServiceClient
 		imageservice               apiv2connect.ImageServiceClient
@@ -149,6 +153,12 @@ func New(config *DialConfig) (Client, error) {
 
 func (c *client) Adminv2() Adminv2 {
 	a := &adminv2{
+		auditservice: adminv2connect.NewAuditServiceClient(
+			c.config.HttpClient(),
+			c.config.BaseURL,
+			connect.WithInterceptors(c.interceptors...),
+			compress.WithAll(compress.LevelBalanced),
+		),
 		componentservice: adminv2connect.NewComponentServiceClient(
 			c.config.HttpClient(),
 			c.config.BaseURL,
@@ -249,6 +259,9 @@ func (c *client) Adminv2() Adminv2 {
 	return a
 }
 
+func (c *adminv2) Audit() adminv2connect.AuditServiceClient {
+	return c.auditservice
+}
 func (c *adminv2) Component() adminv2connect.ComponentServiceClient {
 	return c.componentservice
 }
@@ -300,6 +313,12 @@ func (c *adminv2) VPN() adminv2connect.VPNServiceClient {
 
 func (c *client) Apiv2() Apiv2 {
 	a := &apiv2{
+		auditservice: apiv2connect.NewAuditServiceClient(
+			c.config.HttpClient(),
+			c.config.BaseURL,
+			connect.WithInterceptors(c.interceptors...),
+			compress.WithAll(compress.LevelBalanced),
+		),
 		filesystemservice: apiv2connect.NewFilesystemServiceClient(
 			c.config.HttpClient(),
 			c.config.BaseURL,
@@ -400,6 +419,9 @@ func (c *client) Apiv2() Apiv2 {
 	return a
 }
 
+func (c *apiv2) Audit() apiv2connect.AuditServiceClient {
+	return c.auditservice
+}
 func (c *apiv2) Filesystem() apiv2connect.FilesystemServiceClient {
 	return c.filesystemservice
 }
diff --git a/go/metalstack/admin/v2/adminv2connect/audit.connect.go b/go/metalstack/admin/v2/adminv2connect/audit.connect.go
new file mode 100644
index 00000000..e844179d
--- /dev/null
+++ b/go/metalstack/admin/v2/adminv2connect/audit.connect.go
@@ -0,0 +1,148 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: metalstack/admin/v2/audit.proto
+
+package adminv2connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v2 "github.com/metal-stack/api/go/metalstack/admin/v2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AuditServiceName is the fully-qualified name of the AuditService service.
+	AuditServiceName = "metalstack.admin.v2.AuditService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AuditServiceGetProcedure is the fully-qualified name of the AuditService's Get RPC.
+	AuditServiceGetProcedure = "/metalstack.admin.v2.AuditService/Get"
+	// AuditServiceListProcedure is the fully-qualified name of the AuditService's List RPC.
+	AuditServiceListProcedure = "/metalstack.admin.v2.AuditService/List"
+)
+
+// AuditServiceClient is a client for the metalstack.admin.v2.AuditService service.
+type AuditServiceClient interface {
+	// Get an audit trace
+	Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error)
+	// List all audit traces
+	List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error)
+}
+
+// NewAuditServiceClient constructs a client for the metalstack.admin.v2.AuditService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAuditServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AuditServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	auditServiceMethods := v2.File_metalstack_admin_v2_audit_proto.Services().ByName("AuditService").Methods()
+	return &auditServiceClient{
+		get: connect.NewClient[v2.AuditServiceGetRequest, v2.AuditServiceGetResponse](
+			httpClient,
+			baseURL+AuditServiceGetProcedure,
+			connect.WithSchema(auditServiceMethods.ByName("Get")),
+			connect.WithClientOptions(opts...),
+		),
+		list: connect.NewClient[v2.AuditServiceListRequest, v2.AuditServiceListResponse](
+			httpClient,
+			baseURL+AuditServiceListProcedure,
+			connect.WithSchema(auditServiceMethods.ByName("List")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// auditServiceClient implements AuditServiceClient.
+type auditServiceClient struct {
+	get  *connect.Client[v2.AuditServiceGetRequest, v2.AuditServiceGetResponse]
+	list *connect.Client[v2.AuditServiceListRequest, v2.AuditServiceListResponse]
+}
+
+// Get calls metalstack.admin.v2.AuditService.Get.
+func (c *auditServiceClient) Get(ctx context.Context, req *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error) {
+	response, err := c.get.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// List calls metalstack.admin.v2.AuditService.List.
+func (c *auditServiceClient) List(ctx context.Context, req *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error) {
+	response, err := c.list.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// AuditServiceHandler is an implementation of the metalstack.admin.v2.AuditService service.
+type AuditServiceHandler interface {
+	// Get an audit trace
+	Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error)
+	// List all audit traces
+	List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error)
+}
+
+// NewAuditServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAuditServiceHandler(svc AuditServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	auditServiceMethods := v2.File_metalstack_admin_v2_audit_proto.Services().ByName("AuditService").Methods()
+	auditServiceGetHandler := connect.NewUnaryHandlerSimple(
+		AuditServiceGetProcedure,
+		svc.Get,
+		connect.WithSchema(auditServiceMethods.ByName("Get")),
+		connect.WithHandlerOptions(opts...),
+	)
+	auditServiceListHandler := connect.NewUnaryHandlerSimple(
+		AuditServiceListProcedure,
+		svc.List,
+		connect.WithSchema(auditServiceMethods.ByName("List")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/metalstack.admin.v2.AuditService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AuditServiceGetProcedure:
+			auditServiceGetHandler.ServeHTTP(w, r)
+		case AuditServiceListProcedure:
+			auditServiceListHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAuditServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAuditServiceHandler struct{}
+
+func (UnimplementedAuditServiceHandler) Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.AuditService.Get is not implemented"))
+}
+
+func (UnimplementedAuditServiceHandler) List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.admin.v2.AuditService.List is not implemented"))
+}
diff --git a/go/metalstack/admin/v2/audit.pb.go b/go/metalstack/admin/v2/audit.pb.go
new file mode 100644
index 00000000..0d77fa62
--- /dev/null
+++ b/go/metalstack/admin/v2/audit.pb.go
@@ -0,0 +1,301 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: metalstack/admin/v2/audit.proto
+
+package adminv2
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AuditServiceListRequest is the request payload to list audits
+type AuditServiceListRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Query for audit traces
+	Query         *v2.AuditQuery `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceListRequest) Reset() {
+	*x = AuditServiceListRequest{}
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceListRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceListRequest) ProtoMessage() {}
+
+func (x *AuditServiceListRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceListRequest.ProtoReflect.Descriptor instead.
+func (*AuditServiceListRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_audit_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuditServiceListRequest) GetQuery() *v2.AuditQuery {
+	if x != nil {
+		return x.Query
+	}
+	return nil
+}
+
+// AuditServiceListResponse is the response payload of a audit list request
+type AuditServiceListResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Traces is a list of audit traces
+	Traces        []*v2.AuditTrace `protobuf:"bytes,1,rep,name=traces,proto3" json:"traces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceListResponse) Reset() {
+	*x = AuditServiceListResponse{}
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceListResponse) ProtoMessage() {}
+
+func (x *AuditServiceListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceListResponse.ProtoReflect.Descriptor instead.
+func (*AuditServiceListResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_audit_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AuditServiceListResponse) GetTraces() []*v2.AuditTrace {
+	if x != nil {
+		return x.Traces
+	}
+	return nil
+}
+
+// AuditServiceGetRequest is the request payload of a audit get request
+type AuditServiceGetRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Uuid of the audit trace
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Phase specifies the audit phase. Defaults to request
+	Phase         *v2.AuditPhase `protobuf:"varint,2,opt,name=phase,proto3,enum=metalstack.api.v2.AuditPhase,oneof" json:"phase,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceGetRequest) Reset() {
+	*x = AuditServiceGetRequest{}
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceGetRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceGetRequest) ProtoMessage() {}
+
+func (x *AuditServiceGetRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceGetRequest.ProtoReflect.Descriptor instead.
+func (*AuditServiceGetRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_audit_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *AuditServiceGetRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *AuditServiceGetRequest) GetPhase() v2.AuditPhase {
+	if x != nil && x.Phase != nil {
+		return *x.Phase
+	}
+	return v2.AuditPhase(0)
+}
+
+// AuditServiceGetResponse is the response payload of a audit get request
+type AuditServiceGetResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Trace is the audit trace
+	Trace         *v2.AuditTrace `protobuf:"bytes,1,opt,name=trace,proto3" json:"trace,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceGetResponse) Reset() {
+	*x = AuditServiceGetResponse{}
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceGetResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceGetResponse) ProtoMessage() {}
+
+func (x *AuditServiceGetResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_admin_v2_audit_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceGetResponse.ProtoReflect.Descriptor instead.
+func (*AuditServiceGetResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_admin_v2_audit_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *AuditServiceGetResponse) GetTrace() *v2.AuditTrace {
+	if x != nil {
+		return x.Trace
+	}
+	return nil
+}
+
+var File_metalstack_admin_v2_audit_proto protoreflect.FileDescriptor
+
+const file_metalstack_admin_v2_audit_proto_rawDesc = "" +
+	"\n" +
+	"\x1fmetalstack/admin/v2/audit.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1dmetalstack/api/v2/audit.proto\x1a\x1emetalstack/api/v2/common.proto\"N\n" +
+	"\x17AuditServiceListRequest\x123\n" +
+	"\x05query\x18\x01 \x01(\v2\x1d.metalstack.api.v2.AuditQueryR\x05query\"Q\n" +
+	"\x18AuditServiceListResponse\x125\n" +
+	"\x06traces\x18\x01 \x03(\v2\x1d.metalstack.api.v2.AuditTraceR\x06traces\"\x84\x01\n" +
+	"\x16AuditServiceGetRequest\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12B\n" +
+	"\x05phase\x18\x02 \x01(\x0e2\x1d.metalstack.api.v2.AuditPhaseB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x05phase\x88\x01\x01B\b\n" +
+	"\x06_phase\"N\n" +
+	"\x17AuditServiceGetResponse\x123\n" +
+	"\x05trace\x18\x01 \x01(\v2\x1d.metalstack.api.v2.AuditTraceR\x05trace2\xe5\x01\n" +
+	"\fAuditService\x12h\n" +
+	"\x03Get\x12+.metalstack.admin.v2.AuditServiceGetRequest\x1a,.metalstack.admin.v2.AuditServiceGetResponse\"\x06\xd2\xf3\x18\x02\x01\x02\x12k\n" +
+	"\x04List\x12,.metalstack.admin.v2.AuditServiceListRequest\x1a-.metalstack.admin.v2.AuditServiceListResponse\"\x06\xd2\xf3\x18\x02\x01\x02B\xce\x01\n" +
+	"\x17com.metalstack.admin.v2B\n" +
+	"AuditProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3"
+
+var (
+	file_metalstack_admin_v2_audit_proto_rawDescOnce sync.Once
+	file_metalstack_admin_v2_audit_proto_rawDescData []byte
+)
+
+func file_metalstack_admin_v2_audit_proto_rawDescGZIP() []byte {
+	file_metalstack_admin_v2_audit_proto_rawDescOnce.Do(func() {
+		file_metalstack_admin_v2_audit_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_audit_proto_rawDesc), len(file_metalstack_admin_v2_audit_proto_rawDesc)))
+	})
+	return file_metalstack_admin_v2_audit_proto_rawDescData
+}
+
+var file_metalstack_admin_v2_audit_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_metalstack_admin_v2_audit_proto_goTypes = []any{
+	(*AuditServiceListRequest)(nil),  // 0: metalstack.admin.v2.AuditServiceListRequest
+	(*AuditServiceListResponse)(nil), // 1: metalstack.admin.v2.AuditServiceListResponse
+	(*AuditServiceGetRequest)(nil),   // 2: metalstack.admin.v2.AuditServiceGetRequest
+	(*AuditServiceGetResponse)(nil),  // 3: metalstack.admin.v2.AuditServiceGetResponse
+	(*v2.AuditQuery)(nil),            // 4: metalstack.api.v2.AuditQuery
+	(*v2.AuditTrace)(nil),            // 5: metalstack.api.v2.AuditTrace
+	(v2.AuditPhase)(0),               // 6: metalstack.api.v2.AuditPhase
+}
+var file_metalstack_admin_v2_audit_proto_depIdxs = []int32{
+	4, // 0: metalstack.admin.v2.AuditServiceListRequest.query:type_name -> metalstack.api.v2.AuditQuery
+	5, // 1: metalstack.admin.v2.AuditServiceListResponse.traces:type_name -> metalstack.api.v2.AuditTrace
+	6, // 2: metalstack.admin.v2.AuditServiceGetRequest.phase:type_name -> metalstack.api.v2.AuditPhase
+	5, // 3: metalstack.admin.v2.AuditServiceGetResponse.trace:type_name -> metalstack.api.v2.AuditTrace
+	2, // 4: metalstack.admin.v2.AuditService.Get:input_type -> metalstack.admin.v2.AuditServiceGetRequest
+	0, // 5: metalstack.admin.v2.AuditService.List:input_type -> metalstack.admin.v2.AuditServiceListRequest
+	3, // 6: metalstack.admin.v2.AuditService.Get:output_type -> metalstack.admin.v2.AuditServiceGetResponse
+	1, // 7: metalstack.admin.v2.AuditService.List:output_type -> metalstack.admin.v2.AuditServiceListResponse
+	6, // [6:8] is the sub-list for method output_type
+	4, // [4:6] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_metalstack_admin_v2_audit_proto_init() }
+func file_metalstack_admin_v2_audit_proto_init() {
+	if File_metalstack_admin_v2_audit_proto != nil {
+		return
+	}
+	file_metalstack_admin_v2_audit_proto_msgTypes[2].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_admin_v2_audit_proto_rawDesc), len(file_metalstack_admin_v2_audit_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_metalstack_admin_v2_audit_proto_goTypes,
+		DependencyIndexes: file_metalstack_admin_v2_audit_proto_depIdxs,
+		MessageInfos:      file_metalstack_admin_v2_audit_proto_msgTypes,
+	}.Build()
+	File_metalstack_admin_v2_audit_proto = out.File
+	file_metalstack_admin_v2_audit_proto_goTypes = nil
+	file_metalstack_admin_v2_audit_proto_depIdxs = nil
+}
diff --git a/go/metalstack/api/v2/apiv2connect/audit.connect.go b/go/metalstack/api/v2/apiv2connect/audit.connect.go
new file mode 100644
index 00000000..ec0a7592
--- /dev/null
+++ b/go/metalstack/api/v2/apiv2connect/audit.connect.go
@@ -0,0 +1,148 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: metalstack/api/v2/audit.proto
+
+package apiv2connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AuditServiceName is the fully-qualified name of the AuditService service.
+	AuditServiceName = "metalstack.api.v2.AuditService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AuditServiceGetProcedure is the fully-qualified name of the AuditService's Get RPC.
+	AuditServiceGetProcedure = "/metalstack.api.v2.AuditService/Get"
+	// AuditServiceListProcedure is the fully-qualified name of the AuditService's List RPC.
+	AuditServiceListProcedure = "/metalstack.api.v2.AuditService/List"
+)
+
+// AuditServiceClient is a client for the metalstack.api.v2.AuditService service.
+type AuditServiceClient interface {
+	// Get an audit trace
+	Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error)
+	// List audit traces
+	List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error)
+}
+
+// NewAuditServiceClient constructs a client for the metalstack.api.v2.AuditService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAuditServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AuditServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	auditServiceMethods := v2.File_metalstack_api_v2_audit_proto.Services().ByName("AuditService").Methods()
+	return &auditServiceClient{
+		get: connect.NewClient[v2.AuditServiceGetRequest, v2.AuditServiceGetResponse](
+			httpClient,
+			baseURL+AuditServiceGetProcedure,
+			connect.WithSchema(auditServiceMethods.ByName("Get")),
+			connect.WithClientOptions(opts...),
+		),
+		list: connect.NewClient[v2.AuditServiceListRequest, v2.AuditServiceListResponse](
+			httpClient,
+			baseURL+AuditServiceListProcedure,
+			connect.WithSchema(auditServiceMethods.ByName("List")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// auditServiceClient implements AuditServiceClient.
+type auditServiceClient struct {
+	get  *connect.Client[v2.AuditServiceGetRequest, v2.AuditServiceGetResponse]
+	list *connect.Client[v2.AuditServiceListRequest, v2.AuditServiceListResponse]
+}
+
+// Get calls metalstack.api.v2.AuditService.Get.
+func (c *auditServiceClient) Get(ctx context.Context, req *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error) {
+	response, err := c.get.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// List calls metalstack.api.v2.AuditService.List.
+func (c *auditServiceClient) List(ctx context.Context, req *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error) {
+	response, err := c.list.CallUnary(ctx, connect.NewRequest(req))
+	if response != nil {
+		return response.Msg, err
+	}
+	return nil, err
+}
+
+// AuditServiceHandler is an implementation of the metalstack.api.v2.AuditService service.
+type AuditServiceHandler interface {
+	// Get an audit trace
+	Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error)
+	// List audit traces
+	List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error)
+}
+
+// NewAuditServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAuditServiceHandler(svc AuditServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	auditServiceMethods := v2.File_metalstack_api_v2_audit_proto.Services().ByName("AuditService").Methods()
+	auditServiceGetHandler := connect.NewUnaryHandlerSimple(
+		AuditServiceGetProcedure,
+		svc.Get,
+		connect.WithSchema(auditServiceMethods.ByName("Get")),
+		connect.WithHandlerOptions(opts...),
+	)
+	auditServiceListHandler := connect.NewUnaryHandlerSimple(
+		AuditServiceListProcedure,
+		svc.List,
+		connect.WithSchema(auditServiceMethods.ByName("List")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/metalstack.api.v2.AuditService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AuditServiceGetProcedure:
+			auditServiceGetHandler.ServeHTTP(w, r)
+		case AuditServiceListProcedure:
+			auditServiceListHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAuditServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAuditServiceHandler struct{}
+
+func (UnimplementedAuditServiceHandler) Get(context.Context, *v2.AuditServiceGetRequest) (*v2.AuditServiceGetResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.api.v2.AuditService.Get is not implemented"))
+}
+
+func (UnimplementedAuditServiceHandler) List(context.Context, *v2.AuditServiceListRequest) (*v2.AuditServiceListResponse, error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("metalstack.api.v2.AuditService.List is not implemented"))
+}
diff --git a/go/metalstack/api/v2/audit.pb.go b/go/metalstack/api/v2/audit.pb.go
new file mode 100644
index 00000000..f2cbb681
--- /dev/null
+++ b/go/metalstack/api/v2/audit.pb.go
@@ -0,0 +1,704 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: metalstack/api/v2/audit.proto
+
+package apiv2
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AuditPhase specifies phase of an audit trace
+type AuditPhase int32
+
+const (
+	// AUDIT_PHASE_UNSPECIFIED is not specified
+	AuditPhase_AUDIT_PHASE_UNSPECIFIED AuditPhase = 0
+	// AUDIT_PHASE_REQUEST defines an audit trace in the request phase
+	AuditPhase_AUDIT_PHASE_REQUEST AuditPhase = 1
+	// AUDIT_PHASE_REQUEST defines an audit trace in the response phase
+	AuditPhase_AUDIT_PHASE_RESPONSE AuditPhase = 2
+)
+
+// Enum value maps for AuditPhase.
+var (
+	AuditPhase_name = map[int32]string{
+		0: "AUDIT_PHASE_UNSPECIFIED",
+		1: "AUDIT_PHASE_REQUEST",
+		2: "AUDIT_PHASE_RESPONSE",
+	}
+	AuditPhase_value = map[string]int32{
+		"AUDIT_PHASE_UNSPECIFIED": 0,
+		"AUDIT_PHASE_REQUEST":     1,
+		"AUDIT_PHASE_RESPONSE":    2,
+	}
+)
+
+func (x AuditPhase) Enum() *AuditPhase {
+	p := new(AuditPhase)
+	*p = x
+	return p
+}
+
+func (x AuditPhase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AuditPhase) Descriptor() protoreflect.EnumDescriptor {
+	return file_metalstack_api_v2_audit_proto_enumTypes[0].Descriptor()
+}
+
+func (AuditPhase) Type() protoreflect.EnumType {
+	return &file_metalstack_api_v2_audit_proto_enumTypes[0]
+}
+
+func (x AuditPhase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AuditPhase.Descriptor instead.
+func (AuditPhase) EnumDescriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{0}
+}
+
+// AuditTrace is an audit trace
+type AuditTrace struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Uuid of the audit trace
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Timestamp is the timestamp when the request arrived at the api
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// User is the login user who called the api method
+	User string `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
+	// Tenant is the tenant targeted by the api call
+	Tenant string `protobuf:"bytes,4,opt,name=tenant,proto3" json:"tenant,omitempty"`
+	// Project is the project targeted by the api call
+	Project *string `protobuf:"bytes,5,opt,name=project,proto3,oneof" json:"project,omitempty"`
+	// Method is the api method that was called
+	Method string `protobuf:"bytes,6,opt,name=method,proto3" json:"method,omitempty"`
+	// Body is the payload of the api call. In the request phase this contains the payload sent by the client, in the request phase it contains the payload returned by the api server
+	Body *string `protobuf:"bytes,7,opt,name=body,proto3,oneof" json:"body,omitempty"`
+	// Source IP contains the source ip address of the api call
+	SourceIp string `protobuf:"bytes,8,opt,name=source_ip,json=sourceIp,proto3" json:"source_ip,omitempty"`
+	// Result Code is a status code describing the result of the api call. It is set for traces in the response phase and contains official gRPC status codes
+	ResultCode *int32 `protobuf:"varint,9,opt,name=result_code,json=resultCode,proto3,oneof" json:"result_code,omitempty"`
+	// Phase represents the phase of the audit trace
+	Phase         AuditPhase `protobuf:"varint,10,opt,name=phase,proto3,enum=metalstack.api.v2.AuditPhase" json:"phase,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditTrace) Reset() {
+	*x = AuditTrace{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditTrace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditTrace) ProtoMessage() {}
+
+func (x *AuditTrace) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditTrace.ProtoReflect.Descriptor instead.
+func (*AuditTrace) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuditTrace) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *AuditTrace) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetTenant() string {
+	if x != nil {
+		return x.Tenant
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetProject() string {
+	if x != nil && x.Project != nil {
+		return *x.Project
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetBody() string {
+	if x != nil && x.Body != nil {
+		return *x.Body
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetSourceIp() string {
+	if x != nil {
+		return x.SourceIp
+	}
+	return ""
+}
+
+func (x *AuditTrace) GetResultCode() int32 {
+	if x != nil && x.ResultCode != nil {
+		return *x.ResultCode
+	}
+	return 0
+}
+
+func (x *AuditTrace) GetPhase() AuditPhase {
+	if x != nil {
+		return x.Phase
+	}
+	return AuditPhase_AUDIT_PHASE_UNSPECIFIED
+}
+
+// AuditServiceListRequest is the request payload to list audits
+type AuditQuery struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Uuid of the audit trace
+	Uuid *string `protobuf:"bytes,2,opt,name=uuid,proto3,oneof" json:"uuid,omitempty"`
+	// From describes the start of the time window in which to list audit traces. Defaults to the last eight hours
+	From *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=from,proto3,oneof" json:"from,omitempty"`
+	// To describes the end of the time window in which to list audit traces. Defaults to the time the request was issued
+	To *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=to,proto3,oneof" json:"to,omitempty"`
+	// User is the user who called the api method
+	User *string `protobuf:"bytes,5,opt,name=user,proto3,oneof" json:"user,omitempty"`
+	// Project is the project targeted by the api call
+	Project *string `protobuf:"bytes,6,opt,name=project,proto3,oneof" json:"project,omitempty"`
+	// Method is the api method that was called
+	Method *string `protobuf:"bytes,7,opt,name=method,proto3,oneof" json:"method,omitempty"`
+	// Source IP contains the ip address of the caller
+	SourceIp *string `protobuf:"bytes,8,opt,name=source_ip,json=sourceIp,proto3,oneof" json:"source_ip,omitempty"`
+	// Result Code is a string describing the result of the api call
+	ResultCode *int32 `protobuf:"varint,9,opt,name=result_code,json=resultCode,proto3,oneof" json:"result_code,omitempty"`
+	// Body is a string providing text-search of the body field
+	Body *string `protobuf:"bytes,10,opt,name=body,proto3,oneof" json:"body,omitempty"`
+	// Limit is a number limiting the length of the response (min: 1, max: 1000, defaults to 200)
+	Limit *int32 `protobuf:"varint,11,opt,name=limit,proto3,oneof" json:"limit,omitempty"`
+	// Phase specifies the audit phase
+	Phase         *AuditPhase `protobuf:"varint,12,opt,name=phase,proto3,enum=metalstack.api.v2.AuditPhase,oneof" json:"phase,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditQuery) Reset() {
+	*x = AuditQuery{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditQuery) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditQuery) ProtoMessage() {}
+
+func (x *AuditQuery) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditQuery.ProtoReflect.Descriptor instead.
+func (*AuditQuery) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AuditQuery) GetUuid() string {
+	if x != nil && x.Uuid != nil {
+		return *x.Uuid
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetFrom() *timestamppb.Timestamp {
+	if x != nil {
+		return x.From
+	}
+	return nil
+}
+
+func (x *AuditQuery) GetTo() *timestamppb.Timestamp {
+	if x != nil {
+		return x.To
+	}
+	return nil
+}
+
+func (x *AuditQuery) GetUser() string {
+	if x != nil && x.User != nil {
+		return *x.User
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetProject() string {
+	if x != nil && x.Project != nil {
+		return *x.Project
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetMethod() string {
+	if x != nil && x.Method != nil {
+		return *x.Method
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetSourceIp() string {
+	if x != nil && x.SourceIp != nil {
+		return *x.SourceIp
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetResultCode() int32 {
+	if x != nil && x.ResultCode != nil {
+		return *x.ResultCode
+	}
+	return 0
+}
+
+func (x *AuditQuery) GetBody() string {
+	if x != nil && x.Body != nil {
+		return *x.Body
+	}
+	return ""
+}
+
+func (x *AuditQuery) GetLimit() int32 {
+	if x != nil && x.Limit != nil {
+		return *x.Limit
+	}
+	return 0
+}
+
+func (x *AuditQuery) GetPhase() AuditPhase {
+	if x != nil && x.Phase != nil {
+		return *x.Phase
+	}
+	return AuditPhase_AUDIT_PHASE_UNSPECIFIED
+}
+
+// AuditServiceListRequest is the request payload for a audit list request
+type AuditServiceListRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login for this tenant
+	Login string `protobuf:"bytes,1,opt,name=login,proto3" json:"login,omitempty"`
+	// Query for audit traces
+	Query         *AuditQuery `protobuf:"bytes,2,opt,name=query,proto3" json:"query,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceListRequest) Reset() {
+	*x = AuditServiceListRequest{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceListRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceListRequest) ProtoMessage() {}
+
+func (x *AuditServiceListRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceListRequest.ProtoReflect.Descriptor instead.
+func (*AuditServiceListRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *AuditServiceListRequest) GetLogin() string {
+	if x != nil {
+		return x.Login
+	}
+	return ""
+}
+
+func (x *AuditServiceListRequest) GetQuery() *AuditQuery {
+	if x != nil {
+		return x.Query
+	}
+	return nil
+}
+
+// AuditServiceListResponse is the response payload of a audit list request
+type AuditServiceListResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Traces is a list of audit traces
+	Traces        []*AuditTrace `protobuf:"bytes,1,rep,name=traces,proto3" json:"traces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceListResponse) Reset() {
+	*x = AuditServiceListResponse{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceListResponse) ProtoMessage() {}
+
+func (x *AuditServiceListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceListResponse.ProtoReflect.Descriptor instead.
+func (*AuditServiceListResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *AuditServiceListResponse) GetTraces() []*AuditTrace {
+	if x != nil {
+		return x.Traces
+	}
+	return nil
+}
+
+// AuditServiceGetRequest is the request payload of a audit get request
+type AuditServiceGetRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login for this tenant
+	Login string `protobuf:"bytes,1,opt,name=login,proto3" json:"login,omitempty"`
+	// Uuid of the audit trace
+	Uuid string `protobuf:"bytes,2,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Phase specifies the audit phase. Defaults to request
+	Phase         *AuditPhase `protobuf:"varint,3,opt,name=phase,proto3,enum=metalstack.api.v2.AuditPhase,oneof" json:"phase,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceGetRequest) Reset() {
+	*x = AuditServiceGetRequest{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceGetRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceGetRequest) ProtoMessage() {}
+
+func (x *AuditServiceGetRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceGetRequest.ProtoReflect.Descriptor instead.
+func (*AuditServiceGetRequest) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *AuditServiceGetRequest) GetLogin() string {
+	if x != nil {
+		return x.Login
+	}
+	return ""
+}
+
+func (x *AuditServiceGetRequest) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *AuditServiceGetRequest) GetPhase() AuditPhase {
+	if x != nil && x.Phase != nil {
+		return *x.Phase
+	}
+	return AuditPhase_AUDIT_PHASE_UNSPECIFIED
+}
+
+// AuditServiceGetResponse is the response payload of a audit get request
+type AuditServiceGetResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Trace is the audit trace
+	Trace         *AuditTrace `protobuf:"bytes,1,opt,name=trace,proto3" json:"trace,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditServiceGetResponse) Reset() {
+	*x = AuditServiceGetResponse{}
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditServiceGetResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditServiceGetResponse) ProtoMessage() {}
+
+func (x *AuditServiceGetResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_audit_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditServiceGetResponse.ProtoReflect.Descriptor instead.
+func (*AuditServiceGetResponse) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_audit_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *AuditServiceGetResponse) GetTrace() *AuditTrace {
+	if x != nil {
+		return x.Trace
+	}
+	return nil
+}
+
+var File_metalstack_api_v2_audit_proto protoreflect.FileDescriptor
+
+const file_metalstack_api_v2_audit_proto_rawDesc = "" +
+	"\n" +
+	"\x1dmetalstack/api/v2/audit.proto\x12\x11metalstack.api.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xfd\x02\n" +
+	"\n" +
+	"AuditTrace\x12\x1c\n" +
+	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x128\n" +
+	"\ttimestamp\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12\x12\n" +
+	"\x04user\x18\x03 \x01(\tR\x04user\x12\x16\n" +
+	"\x06tenant\x18\x04 \x01(\tR\x06tenant\x12\x1d\n" +
+	"\aproject\x18\x05 \x01(\tH\x00R\aproject\x88\x01\x01\x12\x16\n" +
+	"\x06method\x18\x06 \x01(\tR\x06method\x12\x17\n" +
+	"\x04body\x18\a \x01(\tH\x01R\x04body\x88\x01\x01\x12\x1b\n" +
+	"\tsource_ip\x18\b \x01(\tR\bsourceIp\x12$\n" +
+	"\vresult_code\x18\t \x01(\x05H\x02R\n" +
+	"resultCode\x88\x01\x01\x123\n" +
+	"\x05phase\x18\n" +
+	" \x01(\x0e2\x1d.metalstack.api.v2.AuditPhaseR\x05phaseB\n" +
+	"\n" +
+	"\b_projectB\a\n" +
+	"\x05_bodyB\x0e\n" +
+	"\f_result_code\"\xeb\x04\n" +
+	"\n" +
+	"AuditQuery\x12!\n" +
+	"\x04uuid\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x123\n" +
+	"\x04from\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampH\x01R\x04from\x88\x01\x01\x12/\n" +
+	"\x02to\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampH\x02R\x02to\x88\x01\x01\x12$\n" +
+	"\x04user\x18\x05 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01H\x03R\x04user\x88\x01\x01\x12'\n" +
+	"\aproject\x18\x06 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x04R\aproject\x88\x01\x01\x12'\n" +
+	"\x06method\x18\a \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x02H\x05R\x06method\x88\x01\x01\x12)\n" +
+	"\tsource_ip\x18\b \x01(\tB\a\xbaH\x04r\x02p\x01H\x06R\bsourceIp\x88\x01\x01\x12-\n" +
+	"\vresult_code\x18\t \x01(\x05B\a\xbaH\x04\x1a\x02(\x00H\aR\n" +
+	"resultCode\x88\x01\x01\x12#\n" +
+	"\x04body\x18\n" +
+	" \x01(\tB\n" +
+	"\xbaH\ar\x05\x10\x02\x18\x80\x02H\bR\x04body\x88\x01\x01\x12%\n" +
+	"\x05limit\x18\v \x01(\x05B\n" +
+	"\xbaH\a\x1a\x05\x18\xe8\a \x00H\tR\x05limit\x88\x01\x01\x12B\n" +
+	"\x05phase\x18\f \x01(\x0e2\x1d.metalstack.api.v2.AuditPhaseB\b\xbaH\x05\x82\x01\x02\x10\x01H\n" +
+	"R\x05phase\x88\x01\x01B\a\n" +
+	"\x05_uuidB\a\n" +
+	"\x05_fromB\x05\n" +
+	"\x03_toB\a\n" +
+	"\x05_userB\n" +
+	"\n" +
+	"\b_projectB\t\n" +
+	"\a_methodB\f\n" +
+	"\n" +
+	"_source_ipB\x0e\n" +
+	"\f_result_codeB\a\n" +
+	"\x05_bodyB\b\n" +
+	"\x06_limitB\b\n" +
+	"\x06_phase\"q\n" +
+	"\x17AuditServiceListRequest\x12!\n" +
+	"\x05login\x18\x01 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01R\x05login\x123\n" +
+	"\x05query\x18\x02 \x01(\v2\x1d.metalstack.api.v2.AuditQueryR\x05query\"Q\n" +
+	"\x18AuditServiceListResponse\x125\n" +
+	"\x06traces\x18\x01 \x03(\v2\x1d.metalstack.api.v2.AuditTraceR\x06traces\"\xa7\x01\n" +
+	"\x16AuditServiceGetRequest\x12!\n" +
+	"\x05login\x18\x01 \x01(\tB\v\xbaH\br\x06\xc0\xb3\xae\xb1\x02\x01R\x05login\x12\x1c\n" +
+	"\x04uuid\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12B\n" +
+	"\x05phase\x18\x03 \x01(\x0e2\x1d.metalstack.api.v2.AuditPhaseB\b\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x05phase\x88\x01\x01B\b\n" +
+	"\x06_phase\"N\n" +
+	"\x17AuditServiceGetResponse\x123\n" +
+	"\x05trace\x18\x01 \x01(\v2\x1d.metalstack.api.v2.AuditTraceR\x05trace*\\\n" +
+	"\n" +
+	"AuditPhase\x12\x1b\n" +
+	"\x17AUDIT_PHASE_UNSPECIFIED\x10\x00\x12\x17\n" +
+	"\x13AUDIT_PHASE_REQUEST\x10\x01\x12\x18\n" +
+	"\x14AUDIT_PHASE_RESPONSE\x10\x022\xe3\x01\n" +
+	"\fAuditService\x12g\n" +
+	"\x03Get\x12).metalstack.api.v2.AuditServiceGetRequest\x1a*.metalstack.api.v2.AuditServiceGetResponse\"\t\xc2\xf3\x18\x01\x01\xe0\xf3\x18\x02\x12j\n" +
+	"\x04List\x12*.metalstack.api.v2.AuditServiceListRequest\x1a+.metalstack.api.v2.AuditServiceListResponse\"\t\xc2\xf3\x18\x01\x01\xe0\xf3\x18\x02B\xc0\x01\n" +
+	"\x15com.metalstack.api.v2B\n" +
+	"AuditProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3"
+
+var (
+	file_metalstack_api_v2_audit_proto_rawDescOnce sync.Once
+	file_metalstack_api_v2_audit_proto_rawDescData []byte
+)
+
+func file_metalstack_api_v2_audit_proto_rawDescGZIP() []byte {
+	file_metalstack_api_v2_audit_proto_rawDescOnce.Do(func() {
+		file_metalstack_api_v2_audit_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_audit_proto_rawDesc), len(file_metalstack_api_v2_audit_proto_rawDesc)))
+	})
+	return file_metalstack_api_v2_audit_proto_rawDescData
+}
+
+var file_metalstack_api_v2_audit_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_metalstack_api_v2_audit_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_metalstack_api_v2_audit_proto_goTypes = []any{
+	(AuditPhase)(0),                  // 0: metalstack.api.v2.AuditPhase
+	(*AuditTrace)(nil),               // 1: metalstack.api.v2.AuditTrace
+	(*AuditQuery)(nil),               // 2: metalstack.api.v2.AuditQuery
+	(*AuditServiceListRequest)(nil),  // 3: metalstack.api.v2.AuditServiceListRequest
+	(*AuditServiceListResponse)(nil), // 4: metalstack.api.v2.AuditServiceListResponse
+	(*AuditServiceGetRequest)(nil),   // 5: metalstack.api.v2.AuditServiceGetRequest
+	(*AuditServiceGetResponse)(nil),  // 6: metalstack.api.v2.AuditServiceGetResponse
+	(*timestamppb.Timestamp)(nil),    // 7: google.protobuf.Timestamp
+}
+var file_metalstack_api_v2_audit_proto_depIdxs = []int32{
+	7,  // 0: metalstack.api.v2.AuditTrace.timestamp:type_name -> google.protobuf.Timestamp
+	0,  // 1: metalstack.api.v2.AuditTrace.phase:type_name -> metalstack.api.v2.AuditPhase
+	7,  // 2: metalstack.api.v2.AuditQuery.from:type_name -> google.protobuf.Timestamp
+	7,  // 3: metalstack.api.v2.AuditQuery.to:type_name -> google.protobuf.Timestamp
+	0,  // 4: metalstack.api.v2.AuditQuery.phase:type_name -> metalstack.api.v2.AuditPhase
+	2,  // 5: metalstack.api.v2.AuditServiceListRequest.query:type_name -> metalstack.api.v2.AuditQuery
+	1,  // 6: metalstack.api.v2.AuditServiceListResponse.traces:type_name -> metalstack.api.v2.AuditTrace
+	0,  // 7: metalstack.api.v2.AuditServiceGetRequest.phase:type_name -> metalstack.api.v2.AuditPhase
+	1,  // 8: metalstack.api.v2.AuditServiceGetResponse.trace:type_name -> metalstack.api.v2.AuditTrace
+	5,  // 9: metalstack.api.v2.AuditService.Get:input_type -> metalstack.api.v2.AuditServiceGetRequest
+	3,  // 10: metalstack.api.v2.AuditService.List:input_type -> metalstack.api.v2.AuditServiceListRequest
+	6,  // 11: metalstack.api.v2.AuditService.Get:output_type -> metalstack.api.v2.AuditServiceGetResponse
+	4,  // 12: metalstack.api.v2.AuditService.List:output_type -> metalstack.api.v2.AuditServiceListResponse
+	11, // [11:13] is the sub-list for method output_type
+	9,  // [9:11] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
+}
+
+func init() { file_metalstack_api_v2_audit_proto_init() }
+func file_metalstack_api_v2_audit_proto_init() {
+	if File_metalstack_api_v2_audit_proto != nil {
+		return
+	}
+	file_metalstack_api_v2_common_proto_init()
+	file_metalstack_api_v2_predefined_rules_proto_init()
+	file_metalstack_api_v2_audit_proto_msgTypes[0].OneofWrappers = []any{}
+	file_metalstack_api_v2_audit_proto_msgTypes[1].OneofWrappers = []any{}
+	file_metalstack_api_v2_audit_proto_msgTypes[4].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_audit_proto_rawDesc), len(file_metalstack_api_v2_audit_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_metalstack_api_v2_audit_proto_goTypes,
+		DependencyIndexes: file_metalstack_api_v2_audit_proto_depIdxs,
+		EnumInfos:         file_metalstack_api_v2_audit_proto_enumTypes,
+		MessageInfos:      file_metalstack_api_v2_audit_proto_msgTypes,
+	}.Build()
+	File_metalstack_api_v2_audit_proto = out.File
+	file_metalstack_api_v2_audit_proto_goTypes = nil
+	file_metalstack_api_v2_audit_proto_depIdxs = nil
+}
diff --git a/go/permissions/servicepermissions.go b/go/permissions/servicepermissions.go
index d1d34e8f..9ce95b39 100755
--- a/go/permissions/servicepermissions.go
+++ b/go/permissions/servicepermissions.go
@@ -7,6 +7,7 @@ import (
 
 func GetServices() []string {
 	return []string{
+		"metalstack.admin.v2.AuditService",
 		"metalstack.admin.v2.ComponentService",
 		"metalstack.admin.v2.FilesystemService",
 		"metalstack.admin.v2.IPService",
@@ -23,6 +24,7 @@ func GetServices() []string {
 		"metalstack.admin.v2.TenantService",
 		"metalstack.admin.v2.TokenService",
 		"metalstack.admin.v2.VPNService",
+		"metalstack.api.v2.AuditService",
 		"metalstack.api.v2.FilesystemService",
 		"metalstack.api.v2.HealthService",
 		"metalstack.api.v2.IPService",
@@ -52,6 +54,8 @@ func GetServicePermissions() *ServicePermissions {
 		Roles: Roles{
 			Admin: Admin{
 				"ADMIN_ROLE_EDITOR": []string{
+					"/metalstack.admin.v2.AuditService/Get",
+					"/metalstack.admin.v2.AuditService/List",
 					"/metalstack.admin.v2.ComponentService/Get",
 					"/metalstack.admin.v2.ComponentService/Delete",
 					"/metalstack.admin.v2.ComponentService/List",
@@ -111,6 +115,8 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.admin.v2.VPNService/ListNodes",
 				},
 				"ADMIN_ROLE_VIEWER": []string{
+					"/metalstack.admin.v2.AuditService/Get",
+					"/metalstack.admin.v2.AuditService/List",
 					"/metalstack.admin.v2.ComponentService/Get",
 					"/metalstack.admin.v2.ComponentService/List",
 					"/metalstack.admin.v2.ImageService/Usage",
@@ -174,6 +180,8 @@ func GetServicePermissions() *ServicePermissions {
 					"/metalstack.api.v2.TenantService/Get",
 				},
 				"TENANT_ROLE_OWNER": []string{
+					"/metalstack.api.v2.AuditService/Get",
+					"/metalstack.api.v2.AuditService/List",
 					"/metalstack.api.v2.ProjectService/Create",
 					"/metalstack.api.v2.TenantService/Get",
 					"/metalstack.api.v2.TenantService/Update",
@@ -262,6 +270,8 @@ func GetServicePermissions() *ServicePermissions {
 		Methods: map[string]bool{
 			"/grpc.reflection.v1.ServerReflection/ServerReflectionInfo":      true,
 			"/grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo": true,
+			"/metalstack.admin.v2.AuditService/Get":                          true,
+			"/metalstack.admin.v2.AuditService/List":                         true,
 			"/metalstack.admin.v2.ComponentService/Delete":                   true,
 			"/metalstack.admin.v2.ComponentService/Get":                      true,
 			"/metalstack.admin.v2.ComponentService/List":                     true,
@@ -319,6 +329,8 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TokenService/Revoke":                       true,
 			"/metalstack.admin.v2.VPNService/AuthKey":                        true,
 			"/metalstack.admin.v2.VPNService/ListNodes":                      true,
+			"/metalstack.api.v2.AuditService/Get":                            true,
+			"/metalstack.api.v2.AuditService/List":                           true,
 			"/metalstack.api.v2.FilesystemService/Get":                       true,
 			"/metalstack.api.v2.FilesystemService/List":                      true,
 			"/metalstack.api.v2.FilesystemService/Match":                     true,
@@ -439,6 +451,8 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.api.v2.UserService/Get":                true,
 			},
 			Admin: map[string]bool{
+				"/metalstack.admin.v2.AuditService/Get":                  true,
+				"/metalstack.admin.v2.AuditService/List":                 true,
 				"/metalstack.admin.v2.ComponentService/Delete":           true,
 				"/metalstack.admin.v2.ComponentService/Get":              true,
 				"/metalstack.admin.v2.ComponentService/List":             true,
@@ -516,6 +530,8 @@ func GetServicePermissions() *ServicePermissions {
 				"/metalstack.infra.v2.BootService/Wait":                  true,
 			},
 			Tenant: map[string]bool{
+				"/metalstack.api.v2.AuditService/Get":           true,
+				"/metalstack.api.v2.AuditService/List":          true,
 				"/metalstack.api.v2.ProjectService/Create":      true,
 				"/metalstack.api.v2.TenantService/Delete":       true,
 				"/metalstack.api.v2.TenantService/Get":          true,
@@ -560,6 +576,8 @@ func GetServicePermissions() *ServicePermissions {
 			},
 		},
 		Auditable: map[string]bool{
+			"/metalstack.admin.v2.AuditService/Get":                  true,
+			"/metalstack.admin.v2.AuditService/List":                 true,
 			"/metalstack.admin.v2.ComponentService/Delete":           true,
 			"/metalstack.admin.v2.ComponentService/Get":              false,
 			"/metalstack.admin.v2.ComponentService/List":             false,
@@ -617,6 +635,8 @@ func GetServicePermissions() *ServicePermissions {
 			"/metalstack.admin.v2.TokenService/Revoke":               true,
 			"/metalstack.admin.v2.VPNService/AuthKey":                true,
 			"/metalstack.admin.v2.VPNService/ListNodes":              true,
+			"/metalstack.api.v2.AuditService/Get":                    false,
+			"/metalstack.api.v2.AuditService/List":                   false,
 			"/metalstack.api.v2.FilesystemService/Get":               false,
 			"/metalstack.api.v2.FilesystemService/List":              false,
 			"/metalstack.api.v2.FilesystemService/Match":             false,
diff --git a/go/tests/mock_clients.go b/go/tests/mock_clients.go
index 2d014cc1..e4b59e2e 100755
--- a/go/tests/mock_clients.go
+++ b/go/tests/mock_clients.go
@@ -33,6 +33,7 @@ type (
 		t *testing.T
 	}
 	adminv2 struct {
+		auditservice               *adminv2mocks.AuditServiceClient
 		componentservice           *adminv2mocks.ComponentServiceClient
 		filesystemservice          *adminv2mocks.FilesystemServiceClient
 		imageservice               *adminv2mocks.ImageServiceClient
@@ -52,6 +53,7 @@ type (
 	}
 
 	Adminv2MockFns struct {
+		Audit               func(m *mock.Mock)
 		Component           func(m *mock.Mock)
 		Filesystem          func(m *mock.Mock)
 		Image               func(m *mock.Mock)
@@ -70,6 +72,7 @@ type (
 		VPN                 func(m *mock.Mock)
 	}
 	apiv2 struct {
+		auditservice               *apiv2mocks.AuditServiceClient
 		filesystemservice          *apiv2mocks.FilesystemServiceClient
 		healthservice              *apiv2mocks.HealthServiceClient
 		imageservice               *apiv2mocks.ImageServiceClient
@@ -89,6 +92,7 @@ type (
 	}
 
 	Apiv2MockFns struct {
+		Audit               func(m *mock.Mock)
 		Filesystem          func(m *mock.Mock)
 		Health              func(m *mock.Mock)
 		Image               func(m *mock.Mock)
@@ -153,6 +157,7 @@ func (w wrapper) Adminv2(fns *Adminv2MockFns) *adminv2 {
 
 func newadminv2(t *testing.T, fns *Adminv2MockFns) *adminv2 {
 	a := &adminv2{
+		auditservice:               adminv2mocks.NewAuditServiceClient(t),
 		componentservice:           adminv2mocks.NewComponentServiceClient(t),
 		filesystemservice:          adminv2mocks.NewFilesystemServiceClient(t),
 		imageservice:               adminv2mocks.NewImageServiceClient(t),
@@ -172,6 +177,9 @@ func newadminv2(t *testing.T, fns *Adminv2MockFns) *adminv2 {
 	}
 
 	if fns != nil {
+		if fns.Audit != nil {
+			fns.Audit(&a.auditservice.Mock)
+		}
 		if fns.Component != nil {
 			fns.Component(&a.componentservice.Mock)
 		}
@@ -226,6 +234,9 @@ func newadminv2(t *testing.T, fns *Adminv2MockFns) *adminv2 {
 	return a
 }
 
+func (c *adminv2) Audit() adminv2connect.AuditServiceClient {
+	return c.auditservice
+}
 func (c *adminv2) Component() adminv2connect.ComponentServiceClient {
 	return c.componentservice
 }
@@ -281,6 +292,7 @@ func (w wrapper) Apiv2(fns *Apiv2MockFns) *apiv2 {
 
 func newapiv2(t *testing.T, fns *Apiv2MockFns) *apiv2 {
 	a := &apiv2{
+		auditservice:               apiv2mocks.NewAuditServiceClient(t),
 		filesystemservice:          apiv2mocks.NewFilesystemServiceClient(t),
 		healthservice:              apiv2mocks.NewHealthServiceClient(t),
 		imageservice:               apiv2mocks.NewImageServiceClient(t),
@@ -300,6 +312,9 @@ func newapiv2(t *testing.T, fns *Apiv2MockFns) *apiv2 {
 	}
 
 	if fns != nil {
+		if fns.Audit != nil {
+			fns.Audit(&a.auditservice.Mock)
+		}
 		if fns.Filesystem != nil {
 			fns.Filesystem(&a.filesystemservice.Mock)
 		}
@@ -354,6 +369,9 @@ func newapiv2(t *testing.T, fns *Apiv2MockFns) *apiv2 {
 	return a
 }
 
+func (c *apiv2) Audit() apiv2connect.AuditServiceClient {
+	return c.auditservice
+}
 func (c *apiv2) Filesystem() apiv2connect.FilesystemServiceClient {
 	return c.filesystemservice
 }
diff --git a/go/tests/mocks/client/Adminv2.go b/go/tests/mocks/client/Adminv2.go
index d15f4251..7738c07e 100644
--- a/go/tests/mocks/client/Adminv2.go
+++ b/go/tests/mocks/client/Adminv2.go
@@ -36,6 +36,52 @@ func (_m *Adminv2) EXPECT() *Adminv2_Expecter {
 	return &Adminv2_Expecter{mock: &_m.Mock}
 }
 
+// Audit provides a mock function for the type Adminv2
+func (_mock *Adminv2) Audit() adminv2connect.AuditServiceClient {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Audit")
+	}
+
+	var r0 adminv2connect.AuditServiceClient
+	if returnFunc, ok := ret.Get(0).(func() adminv2connect.AuditServiceClient); ok {
+		r0 = returnFunc()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(adminv2connect.AuditServiceClient)
+		}
+	}
+	return r0
+}
+
+// Adminv2_Audit_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Audit'
+type Adminv2_Audit_Call struct {
+	*mock.Call
+}
+
+// Audit is a helper method to define mock.On call
+func (_e *Adminv2_Expecter) Audit() *Adminv2_Audit_Call {
+	return &Adminv2_Audit_Call{Call: _e.mock.On("Audit")}
+}
+
+func (_c *Adminv2_Audit_Call) Run(run func()) *Adminv2_Audit_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Adminv2_Audit_Call) Return(auditServiceClient adminv2connect.AuditServiceClient) *Adminv2_Audit_Call {
+	_c.Call.Return(auditServiceClient)
+	return _c
+}
+
+func (_c *Adminv2_Audit_Call) RunAndReturn(run func() adminv2connect.AuditServiceClient) *Adminv2_Audit_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Component provides a mock function for the type Adminv2
 func (_mock *Adminv2) Component() adminv2connect.ComponentServiceClient {
 	ret := _mock.Called()
diff --git a/go/tests/mocks/client/Apiv2.go b/go/tests/mocks/client/Apiv2.go
index 5bb35362..6cbb11cb 100644
--- a/go/tests/mocks/client/Apiv2.go
+++ b/go/tests/mocks/client/Apiv2.go
@@ -36,6 +36,52 @@ func (_m *Apiv2) EXPECT() *Apiv2_Expecter {
 	return &Apiv2_Expecter{mock: &_m.Mock}
 }
 
+// Audit provides a mock function for the type Apiv2
+func (_mock *Apiv2) Audit() apiv2connect.AuditServiceClient {
+	ret := _mock.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Audit")
+	}
+
+	var r0 apiv2connect.AuditServiceClient
+	if returnFunc, ok := ret.Get(0).(func() apiv2connect.AuditServiceClient); ok {
+		r0 = returnFunc()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(apiv2connect.AuditServiceClient)
+		}
+	}
+	return r0
+}
+
+// Apiv2_Audit_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Audit'
+type Apiv2_Audit_Call struct {
+	*mock.Call
+}
+
+// Audit is a helper method to define mock.On call
+func (_e *Apiv2_Expecter) Audit() *Apiv2_Audit_Call {
+	return &Apiv2_Audit_Call{Call: _e.mock.On("Audit")}
+}
+
+func (_c *Apiv2_Audit_Call) Run(run func()) *Apiv2_Audit_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *Apiv2_Audit_Call) Return(auditServiceClient apiv2connect.AuditServiceClient) *Apiv2_Audit_Call {
+	_c.Call.Return(auditServiceClient)
+	return _c
+}
+
+func (_c *Apiv2_Audit_Call) RunAndReturn(run func() apiv2connect.AuditServiceClient) *Apiv2_Audit_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // Filesystem provides a mock function for the type Apiv2
 func (_mock *Apiv2) Filesystem() apiv2connect.FilesystemServiceClient {
 	ret := _mock.Called()
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceClient.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceClient.go
new file mode 100644
index 00000000..e2afe207
--- /dev/null
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceClient.go
@@ -0,0 +1,175 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package adminv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/admin/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewAuditServiceClient creates a new instance of AuditServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewAuditServiceClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *AuditServiceClient {
+	mock := &AuditServiceClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// AuditServiceClient is an autogenerated mock type for the AuditServiceClient type
+type AuditServiceClient struct {
+	mock.Mock
+}
+
+type AuditServiceClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *AuditServiceClient) EXPECT() *AuditServiceClient_Expecter {
+	return &AuditServiceClient_Expecter{mock: &_m.Mock}
+}
+
+// Get provides a mock function for the type AuditServiceClient
+func (_mock *AuditServiceClient) Get(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error) {
+	ret := _mock.Called(context1, auditServiceGetRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 *adminv2.AuditServiceGetResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error)); ok {
+		return returnFunc(context1, auditServiceGetRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceGetRequest) *adminv2.AuditServiceGetResponse); ok {
+		r0 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.AuditServiceGetResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.AuditServiceGetRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceClient_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type AuditServiceClient_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceGetRequest *adminv2.AuditServiceGetRequest
+func (_e *AuditServiceClient_Expecter) Get(context1 interface{}, auditServiceGetRequest interface{}) *AuditServiceClient_Get_Call {
+	return &AuditServiceClient_Get_Call{Call: _e.mock.On("Get", context1, auditServiceGetRequest)}
+}
+
+func (_c *AuditServiceClient_Get_Call) Run(run func(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest)) *AuditServiceClient_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.AuditServiceGetRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.AuditServiceGetRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceClient_Get_Call) Return(auditServiceGetResponse *adminv2.AuditServiceGetResponse, err error) *AuditServiceClient_Get_Call {
+	_c.Call.Return(auditServiceGetResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceClient_Get_Call) RunAndReturn(run func(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error)) *AuditServiceClient_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// List provides a mock function for the type AuditServiceClient
+func (_mock *AuditServiceClient) List(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error) {
+	ret := _mock.Called(context1, auditServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *adminv2.AuditServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error)); ok {
+		return returnFunc(context1, auditServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceListRequest) *adminv2.AuditServiceListResponse); ok {
+		r0 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.AuditServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.AuditServiceListRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceClient_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type AuditServiceClient_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceListRequest *adminv2.AuditServiceListRequest
+func (_e *AuditServiceClient_Expecter) List(context1 interface{}, auditServiceListRequest interface{}) *AuditServiceClient_List_Call {
+	return &AuditServiceClient_List_Call{Call: _e.mock.On("List", context1, auditServiceListRequest)}
+}
+
+func (_c *AuditServiceClient_List_Call) Run(run func(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest)) *AuditServiceClient_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.AuditServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.AuditServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceClient_List_Call) Return(auditServiceListResponse *adminv2.AuditServiceListResponse, err error) *AuditServiceClient_List_Call {
+	_c.Call.Return(auditServiceListResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceClient_List_Call) RunAndReturn(run func(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error)) *AuditServiceClient_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceHandler.go b/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceHandler.go
new file mode 100644
index 00000000..3af61eee
--- /dev/null
+++ b/go/tests/mocks/metalstack/admin/v2/adminv2connect/AuditServiceHandler.go
@@ -0,0 +1,175 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package adminv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/admin/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewAuditServiceHandler creates a new instance of AuditServiceHandler. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewAuditServiceHandler(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *AuditServiceHandler {
+	mock := &AuditServiceHandler{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// AuditServiceHandler is an autogenerated mock type for the AuditServiceHandler type
+type AuditServiceHandler struct {
+	mock.Mock
+}
+
+type AuditServiceHandler_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *AuditServiceHandler) EXPECT() *AuditServiceHandler_Expecter {
+	return &AuditServiceHandler_Expecter{mock: &_m.Mock}
+}
+
+// Get provides a mock function for the type AuditServiceHandler
+func (_mock *AuditServiceHandler) Get(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error) {
+	ret := _mock.Called(context1, auditServiceGetRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 *adminv2.AuditServiceGetResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error)); ok {
+		return returnFunc(context1, auditServiceGetRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceGetRequest) *adminv2.AuditServiceGetResponse); ok {
+		r0 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.AuditServiceGetResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.AuditServiceGetRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceHandler_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type AuditServiceHandler_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceGetRequest *adminv2.AuditServiceGetRequest
+func (_e *AuditServiceHandler_Expecter) Get(context1 interface{}, auditServiceGetRequest interface{}) *AuditServiceHandler_Get_Call {
+	return &AuditServiceHandler_Get_Call{Call: _e.mock.On("Get", context1, auditServiceGetRequest)}
+}
+
+func (_c *AuditServiceHandler_Get_Call) Run(run func(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest)) *AuditServiceHandler_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.AuditServiceGetRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.AuditServiceGetRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceHandler_Get_Call) Return(auditServiceGetResponse *adminv2.AuditServiceGetResponse, err error) *AuditServiceHandler_Get_Call {
+	_c.Call.Return(auditServiceGetResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceHandler_Get_Call) RunAndReturn(run func(context1 context.Context, auditServiceGetRequest *adminv2.AuditServiceGetRequest) (*adminv2.AuditServiceGetResponse, error)) *AuditServiceHandler_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// List provides a mock function for the type AuditServiceHandler
+func (_mock *AuditServiceHandler) List(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error) {
+	ret := _mock.Called(context1, auditServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *adminv2.AuditServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error)); ok {
+		return returnFunc(context1, auditServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *adminv2.AuditServiceListRequest) *adminv2.AuditServiceListResponse); ok {
+		r0 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*adminv2.AuditServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *adminv2.AuditServiceListRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceHandler_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type AuditServiceHandler_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceListRequest *adminv2.AuditServiceListRequest
+func (_e *AuditServiceHandler_Expecter) List(context1 interface{}, auditServiceListRequest interface{}) *AuditServiceHandler_List_Call {
+	return &AuditServiceHandler_List_Call{Call: _e.mock.On("List", context1, auditServiceListRequest)}
+}
+
+func (_c *AuditServiceHandler_List_Call) Run(run func(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest)) *AuditServiceHandler_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *adminv2.AuditServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*adminv2.AuditServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceHandler_List_Call) Return(auditServiceListResponse *adminv2.AuditServiceListResponse, err error) *AuditServiceHandler_List_Call {
+	_c.Call.Return(auditServiceListResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceHandler_List_Call) RunAndReturn(run func(context1 context.Context, auditServiceListRequest *adminv2.AuditServiceListRequest) (*adminv2.AuditServiceListResponse, error)) *AuditServiceHandler_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceClient.go b/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceClient.go
new file mode 100644
index 00000000..40a6b32f
--- /dev/null
+++ b/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceClient.go
@@ -0,0 +1,175 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package apiv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/api/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewAuditServiceClient creates a new instance of AuditServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewAuditServiceClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *AuditServiceClient {
+	mock := &AuditServiceClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// AuditServiceClient is an autogenerated mock type for the AuditServiceClient type
+type AuditServiceClient struct {
+	mock.Mock
+}
+
+type AuditServiceClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *AuditServiceClient) EXPECT() *AuditServiceClient_Expecter {
+	return &AuditServiceClient_Expecter{mock: &_m.Mock}
+}
+
+// Get provides a mock function for the type AuditServiceClient
+func (_mock *AuditServiceClient) Get(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error) {
+	ret := _mock.Called(context1, auditServiceGetRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 *apiv2.AuditServiceGetResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error)); ok {
+		return returnFunc(context1, auditServiceGetRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceGetRequest) *apiv2.AuditServiceGetResponse); ok {
+		r0 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*apiv2.AuditServiceGetResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *apiv2.AuditServiceGetRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceClient_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type AuditServiceClient_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceGetRequest *apiv2.AuditServiceGetRequest
+func (_e *AuditServiceClient_Expecter) Get(context1 interface{}, auditServiceGetRequest interface{}) *AuditServiceClient_Get_Call {
+	return &AuditServiceClient_Get_Call{Call: _e.mock.On("Get", context1, auditServiceGetRequest)}
+}
+
+func (_c *AuditServiceClient_Get_Call) Run(run func(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest)) *AuditServiceClient_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *apiv2.AuditServiceGetRequest
+		if args[1] != nil {
+			arg1 = args[1].(*apiv2.AuditServiceGetRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceClient_Get_Call) Return(auditServiceGetResponse *apiv2.AuditServiceGetResponse, err error) *AuditServiceClient_Get_Call {
+	_c.Call.Return(auditServiceGetResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceClient_Get_Call) RunAndReturn(run func(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error)) *AuditServiceClient_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// List provides a mock function for the type AuditServiceClient
+func (_mock *AuditServiceClient) List(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error) {
+	ret := _mock.Called(context1, auditServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *apiv2.AuditServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error)); ok {
+		return returnFunc(context1, auditServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceListRequest) *apiv2.AuditServiceListResponse); ok {
+		r0 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*apiv2.AuditServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *apiv2.AuditServiceListRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceClient_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type AuditServiceClient_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceListRequest *apiv2.AuditServiceListRequest
+func (_e *AuditServiceClient_Expecter) List(context1 interface{}, auditServiceListRequest interface{}) *AuditServiceClient_List_Call {
+	return &AuditServiceClient_List_Call{Call: _e.mock.On("List", context1, auditServiceListRequest)}
+}
+
+func (_c *AuditServiceClient_List_Call) Run(run func(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest)) *AuditServiceClient_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *apiv2.AuditServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*apiv2.AuditServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceClient_List_Call) Return(auditServiceListResponse *apiv2.AuditServiceListResponse, err error) *AuditServiceClient_List_Call {
+	_c.Call.Return(auditServiceListResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceClient_List_Call) RunAndReturn(run func(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error)) *AuditServiceClient_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceHandler.go b/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceHandler.go
new file mode 100644
index 00000000..18085455
--- /dev/null
+++ b/go/tests/mocks/metalstack/api/v2/apiv2connect/AuditServiceHandler.go
@@ -0,0 +1,175 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package apiv2connect
+
+import (
+	"context"
+
+	"github.com/metal-stack/api/go/metalstack/api/v2"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewAuditServiceHandler creates a new instance of AuditServiceHandler. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewAuditServiceHandler(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *AuditServiceHandler {
+	mock := &AuditServiceHandler{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// AuditServiceHandler is an autogenerated mock type for the AuditServiceHandler type
+type AuditServiceHandler struct {
+	mock.Mock
+}
+
+type AuditServiceHandler_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *AuditServiceHandler) EXPECT() *AuditServiceHandler_Expecter {
+	return &AuditServiceHandler_Expecter{mock: &_m.Mock}
+}
+
+// Get provides a mock function for the type AuditServiceHandler
+func (_mock *AuditServiceHandler) Get(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error) {
+	ret := _mock.Called(context1, auditServiceGetRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Get")
+	}
+
+	var r0 *apiv2.AuditServiceGetResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error)); ok {
+		return returnFunc(context1, auditServiceGetRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceGetRequest) *apiv2.AuditServiceGetResponse); ok {
+		r0 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*apiv2.AuditServiceGetResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *apiv2.AuditServiceGetRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceGetRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceHandler_Get_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Get'
+type AuditServiceHandler_Get_Call struct {
+	*mock.Call
+}
+
+// Get is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceGetRequest *apiv2.AuditServiceGetRequest
+func (_e *AuditServiceHandler_Expecter) Get(context1 interface{}, auditServiceGetRequest interface{}) *AuditServiceHandler_Get_Call {
+	return &AuditServiceHandler_Get_Call{Call: _e.mock.On("Get", context1, auditServiceGetRequest)}
+}
+
+func (_c *AuditServiceHandler_Get_Call) Run(run func(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest)) *AuditServiceHandler_Get_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *apiv2.AuditServiceGetRequest
+		if args[1] != nil {
+			arg1 = args[1].(*apiv2.AuditServiceGetRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceHandler_Get_Call) Return(auditServiceGetResponse *apiv2.AuditServiceGetResponse, err error) *AuditServiceHandler_Get_Call {
+	_c.Call.Return(auditServiceGetResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceHandler_Get_Call) RunAndReturn(run func(context1 context.Context, auditServiceGetRequest *apiv2.AuditServiceGetRequest) (*apiv2.AuditServiceGetResponse, error)) *AuditServiceHandler_Get_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// List provides a mock function for the type AuditServiceHandler
+func (_mock *AuditServiceHandler) List(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error) {
+	ret := _mock.Called(context1, auditServiceListRequest)
+
+	if len(ret) == 0 {
+		panic("no return value specified for List")
+	}
+
+	var r0 *apiv2.AuditServiceListResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error)); ok {
+		return returnFunc(context1, auditServiceListRequest)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *apiv2.AuditServiceListRequest) *apiv2.AuditServiceListResponse); ok {
+		r0 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*apiv2.AuditServiceListResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *apiv2.AuditServiceListRequest) error); ok {
+		r1 = returnFunc(context1, auditServiceListRequest)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// AuditServiceHandler_List_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'List'
+type AuditServiceHandler_List_Call struct {
+	*mock.Call
+}
+
+// List is a helper method to define mock.On call
+//   - context1 context.Context
+//   - auditServiceListRequest *apiv2.AuditServiceListRequest
+func (_e *AuditServiceHandler_Expecter) List(context1 interface{}, auditServiceListRequest interface{}) *AuditServiceHandler_List_Call {
+	return &AuditServiceHandler_List_Call{Call: _e.mock.On("List", context1, auditServiceListRequest)}
+}
+
+func (_c *AuditServiceHandler_List_Call) Run(run func(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest)) *AuditServiceHandler_List_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *apiv2.AuditServiceListRequest
+		if args[1] != nil {
+			arg1 = args[1].(*apiv2.AuditServiceListRequest)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *AuditServiceHandler_List_Call) Return(auditServiceListResponse *apiv2.AuditServiceListResponse, err error) *AuditServiceHandler_List_Call {
+	_c.Call.Return(auditServiceListResponse, err)
+	return _c
+}
+
+func (_c *AuditServiceHandler_List_Call) RunAndReturn(run func(context1 context.Context, auditServiceListRequest *apiv2.AuditServiceListRequest) (*apiv2.AuditServiceListResponse, error)) *AuditServiceHandler_List_Call {
+	_c.Call.Return(run)
+	return _c
+}
diff --git a/js/metalstack/admin/v2/audit_pb.d.ts b/js/metalstack/admin/v2/audit_pb.d.ts
new file mode 100644
index 00000000..dc15a5f3
--- /dev/null
+++ b/js/metalstack/admin/v2/audit_pb.d.ts
@@ -0,0 +1,112 @@
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { AuditPhase, AuditQuery, AuditTrace } from "../../api/v2/audit_pb";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file metalstack/admin/v2/audit.proto.
+ */
+export declare const file_metalstack_admin_v2_audit: GenFile;
+/**
+ * AuditServiceListRequest is the request payload to list audits
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceListRequest
+ */
+export type AuditServiceListRequest = Message<"metalstack.admin.v2.AuditServiceListRequest"> & {
+    /**
+     * Query for audit traces
+     *
+     * @generated from field: metalstack.api.v2.AuditQuery query = 1;
+     */
+    query?: AuditQuery;
+};
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export declare const AuditServiceListRequestSchema: GenMessage<AuditServiceListRequest>;
+/**
+ * AuditServiceListResponse is the response payload of a audit list request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceListResponse
+ */
+export type AuditServiceListResponse = Message<"metalstack.admin.v2.AuditServiceListResponse"> & {
+    /**
+     * Traces is a list of audit traces
+     *
+     * @generated from field: repeated metalstack.api.v2.AuditTrace traces = 1;
+     */
+    traces: AuditTrace[];
+};
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export declare const AuditServiceListResponseSchema: GenMessage<AuditServiceListResponse>;
+/**
+ * AuditServiceGetRequest is the request payload of a audit get request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceGetRequest
+ */
+export type AuditServiceGetRequest = Message<"metalstack.admin.v2.AuditServiceGetRequest"> & {
+    /**
+     * Uuid of the audit trace
+     *
+     * @generated from field: string uuid = 1;
+     */
+    uuid: string;
+    /**
+     * Phase specifies the audit phase. Defaults to request
+     *
+     * @generated from field: optional metalstack.api.v2.AuditPhase phase = 2;
+     */
+    phase?: AuditPhase;
+};
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export declare const AuditServiceGetRequestSchema: GenMessage<AuditServiceGetRequest>;
+/**
+ * AuditServiceGetResponse is the response payload of a audit get request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceGetResponse
+ */
+export type AuditServiceGetResponse = Message<"metalstack.admin.v2.AuditServiceGetResponse"> & {
+    /**
+     * Trace is the audit trace
+     *
+     * @generated from field: metalstack.api.v2.AuditTrace trace = 1;
+     */
+    trace?: AuditTrace;
+};
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export declare const AuditServiceGetResponseSchema: GenMessage<AuditServiceGetResponse>;
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.admin.v2.AuditService
+ */
+export declare const AuditService: GenService<{
+    /**
+     * Get an audit trace
+     *
+     * @generated from rpc metalstack.admin.v2.AuditService.Get
+     */
+    get: {
+        methodKind: "unary";
+        input: typeof AuditServiceGetRequestSchema;
+        output: typeof AuditServiceGetResponseSchema;
+    };
+    /**
+     * List all audit traces
+     *
+     * @generated from rpc metalstack.admin.v2.AuditService.List
+     */
+    list: {
+        methodKind: "unary";
+        input: typeof AuditServiceListRequestSchema;
+        output: typeof AuditServiceListResponseSchema;
+    };
+}>;
diff --git a/js/metalstack/admin/v2/audit_pb.js b/js/metalstack/admin/v2/audit_pb.js
new file mode 100644
index 00000000..6a84f276
--- /dev/null
+++ b/js/metalstack/admin/v2/audit_pb.js
@@ -0,0 +1,37 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
+// @generated from file metalstack/admin/v2/audit.proto (package metalstack.admin.v2, syntax proto3)
+/* eslint-disable */
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
+import { file_metalstack_api_v2_audit } from "../../api/v2/audit_pb";
+import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
+/**
+ * Describes the file metalstack/admin/v2/audit.proto.
+ */
+export const file_metalstack_admin_v2_audit = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL2F1ZGl0LnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF0F1ZGl0U2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRRdWVyeSJJChhBdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2USLQoGdHJhY2VzGAEgAygLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRUcmFjZSJ3ChZBdWRpdFNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjsKBXBoYXNlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRQaGFzZUIIukgFggECEAFIAIgBAUIICgZfcGhhc2UiRwoXQXVkaXRTZXJ2aWNlR2V0UmVzcG9uc2USLAoFdHJhY2UYASABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFRyYWNlMuUBCgxBdWRpdFNlcnZpY2USaAoDR2V0EisubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VHZXRSZXF1ZXN0GiwubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VHZXRSZXNwb25zZSIG0vMYAgECEmsKBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLkF1ZGl0U2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2UiBtLzGAIBAkLOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCCkF1ZGl0UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_audit, file_metalstack_api_v2_common]);
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export const AuditServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_audit, 0);
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export const AuditServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_audit, 1);
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export const AuditServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_audit, 2);
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export const AuditServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_admin_v2_audit, 3);
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.admin.v2.AuditService
+ */
+export const AuditService = /*@__PURE__*/ serviceDesc(file_metalstack_admin_v2_audit, 0);
diff --git a/js/metalstack/admin/v2/audit_pb.ts b/js/metalstack/admin/v2/audit_pb.ts
new file mode 100644
index 00000000..d2392aaf
--- /dev/null
+++ b/js/metalstack/admin/v2/audit_pb.ts
@@ -0,0 +1,138 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
+// @generated from file metalstack/admin/v2/audit.proto (package metalstack.admin.v2, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
+import type { AuditPhase, AuditQuery, AuditTrace } from "../../api/v2/audit_pb";
+import { file_metalstack_api_v2_audit } from "../../api/v2/audit_pb";
+import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file metalstack/admin/v2/audit.proto.
+ */
+export const file_metalstack_admin_v2_audit: GenFile = /*@__PURE__*/
+  fileDesc("Ch9tZXRhbHN0YWNrL2FkbWluL3YyL2F1ZGl0LnByb3RvEhNtZXRhbHN0YWNrLmFkbWluLnYyIkcKF0F1ZGl0U2VydmljZUxpc3RSZXF1ZXN0EiwKBXF1ZXJ5GAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRRdWVyeSJJChhBdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2USLQoGdHJhY2VzGAEgAygLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRUcmFjZSJ3ChZBdWRpdFNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjsKBXBoYXNlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRQaGFzZUIIukgFggECEAFIAIgBAUIICgZfcGhhc2UiRwoXQXVkaXRTZXJ2aWNlR2V0UmVzcG9uc2USLAoFdHJhY2UYASABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFRyYWNlMuUBCgxBdWRpdFNlcnZpY2USaAoDR2V0EisubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VHZXRSZXF1ZXN0GiwubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VHZXRSZXNwb25zZSIG0vMYAgECEmsKBExpc3QSLC5tZXRhbHN0YWNrLmFkbWluLnYyLkF1ZGl0U2VydmljZUxpc3RSZXF1ZXN0Gi0ubWV0YWxzdGFjay5hZG1pbi52Mi5BdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2UiBtLzGAIBAkLOAQoXY29tLm1ldGFsc3RhY2suYWRtaW4udjJCCkF1ZGl0UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9hZG1pbi92MjthZG1pbnYyogIDTUFYqgITTWV0YWxzdGFjay5BZG1pbi5WMsoCE01ldGFsc3RhY2tcQWRtaW5cVjLiAh9NZXRhbHN0YWNrXEFkbWluXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6QWRtaW46OlYyYgZwcm90bzM", [file_buf_validate_validate, file_metalstack_api_v2_audit, file_metalstack_api_v2_common]);
+
+/**
+ * AuditServiceListRequest is the request payload to list audits
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceListRequest
+ */
+export type AuditServiceListRequest = Message<"metalstack.admin.v2.AuditServiceListRequest"> & {
+  /**
+   * Query for audit traces
+   *
+   * @generated from field: metalstack.api.v2.AuditQuery query = 1;
+   */
+  query?: AuditQuery;
+};
+
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export const AuditServiceListRequestSchema: GenMessage<AuditServiceListRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_audit, 0);
+
+/**
+ * AuditServiceListResponse is the response payload of a audit list request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceListResponse
+ */
+export type AuditServiceListResponse = Message<"metalstack.admin.v2.AuditServiceListResponse"> & {
+  /**
+   * Traces is a list of audit traces
+   *
+   * @generated from field: repeated metalstack.api.v2.AuditTrace traces = 1;
+   */
+  traces: AuditTrace[];
+};
+
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export const AuditServiceListResponseSchema: GenMessage<AuditServiceListResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_audit, 1);
+
+/**
+ * AuditServiceGetRequest is the request payload of a audit get request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceGetRequest
+ */
+export type AuditServiceGetRequest = Message<"metalstack.admin.v2.AuditServiceGetRequest"> & {
+  /**
+   * Uuid of the audit trace
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+
+  /**
+   * Phase specifies the audit phase. Defaults to request
+   *
+   * @generated from field: optional metalstack.api.v2.AuditPhase phase = 2;
+   */
+  phase?: AuditPhase;
+};
+
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export const AuditServiceGetRequestSchema: GenMessage<AuditServiceGetRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_audit, 2);
+
+/**
+ * AuditServiceGetResponse is the response payload of a audit get request
+ *
+ * @generated from message metalstack.admin.v2.AuditServiceGetResponse
+ */
+export type AuditServiceGetResponse = Message<"metalstack.admin.v2.AuditServiceGetResponse"> & {
+  /**
+   * Trace is the audit trace
+   *
+   * @generated from field: metalstack.api.v2.AuditTrace trace = 1;
+   */
+  trace?: AuditTrace;
+};
+
+/**
+ * Describes the message metalstack.admin.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export const AuditServiceGetResponseSchema: GenMessage<AuditServiceGetResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_admin_v2_audit, 3);
+
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.admin.v2.AuditService
+ */
+export const AuditService: GenService<{
+  /**
+   * Get an audit trace
+   *
+   * @generated from rpc metalstack.admin.v2.AuditService.Get
+   */
+  get: {
+    methodKind: "unary";
+    input: typeof AuditServiceGetRequestSchema;
+    output: typeof AuditServiceGetResponseSchema;
+  },
+  /**
+   * List all audit traces
+   *
+   * @generated from rpc metalstack.admin.v2.AuditService.List
+   */
+  list: {
+    methodKind: "unary";
+    input: typeof AuditServiceListRequestSchema;
+    output: typeof AuditServiceListResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_metalstack_admin_v2_audit, 0);
+
diff --git a/js/metalstack/api/v2/audit_pb.d.ts b/js/metalstack/api/v2/audit_pb.d.ts
new file mode 100644
index 00000000..1530433b
--- /dev/null
+++ b/js/metalstack/api/v2/audit_pb.d.ts
@@ -0,0 +1,303 @@
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+/**
+ * Describes the file metalstack/api/v2/audit.proto.
+ */
+export declare const file_metalstack_api_v2_audit: GenFile;
+/**
+ * AuditTrace is an audit trace
+ *
+ * @generated from message metalstack.api.v2.AuditTrace
+ */
+export type AuditTrace = Message<"metalstack.api.v2.AuditTrace"> & {
+    /**
+     * Uuid of the audit trace
+     *
+     * @generated from field: string uuid = 1;
+     */
+    uuid: string;
+    /**
+     * Timestamp is the timestamp when the request arrived at the api
+     *
+     * @generated from field: google.protobuf.Timestamp timestamp = 2;
+     */
+    timestamp?: Timestamp;
+    /**
+     * User is the login user who called the api method
+     *
+     * @generated from field: string user = 3;
+     */
+    user: string;
+    /**
+     * Tenant is the tenant targeted by the api call
+     *
+     * @generated from field: string tenant = 4;
+     */
+    tenant: string;
+    /**
+     * Project is the project targeted by the api call
+     *
+     * @generated from field: optional string project = 5;
+     */
+    project?: string;
+    /**
+     * Method is the api method that was called
+     *
+     * @generated from field: string method = 6;
+     */
+    method: string;
+    /**
+     * Body is the payload of the api call. In the request phase this contains the payload sent by the client, in the request phase it contains the payload returned by the api server
+     *
+     * @generated from field: optional string body = 7;
+     */
+    body?: string;
+    /**
+     * Source IP contains the source ip address of the api call
+     *
+     * @generated from field: string source_ip = 8;
+     */
+    sourceIp: string;
+    /**
+     * Result Code is a status code describing the result of the api call. It is set for traces in the response phase and contains official gRPC status codes
+     *
+     * @generated from field: optional int32 result_code = 9;
+     */
+    resultCode?: number;
+    /**
+     * Phase represents the phase of the audit trace
+     *
+     * @generated from field: metalstack.api.v2.AuditPhase phase = 10;
+     */
+    phase: AuditPhase;
+};
+/**
+ * Describes the message metalstack.api.v2.AuditTrace.
+ * Use `create(AuditTraceSchema)` to create a new message.
+ */
+export declare const AuditTraceSchema: GenMessage<AuditTrace>;
+/**
+ * AuditServiceListRequest is the request payload to list audits
+ *
+ * @generated from message metalstack.api.v2.AuditQuery
+ */
+export type AuditQuery = Message<"metalstack.api.v2.AuditQuery"> & {
+    /**
+     * Uuid of the audit trace
+     *
+     * @generated from field: optional string uuid = 2;
+     */
+    uuid?: string;
+    /**
+     * From describes the start of the time window in which to list audit traces. Defaults to the last eight hours
+     *
+     * @generated from field: optional google.protobuf.Timestamp from = 3;
+     */
+    from?: Timestamp;
+    /**
+     * To describes the end of the time window in which to list audit traces. Defaults to the time the request was issued
+     *
+     * @generated from field: optional google.protobuf.Timestamp to = 4;
+     */
+    to?: Timestamp;
+    /**
+     * User is the user who called the api method
+     *
+     * @generated from field: optional string user = 5;
+     */
+    user?: string;
+    /**
+     * Project is the project targeted by the api call
+     *
+     * @generated from field: optional string project = 6;
+     */
+    project?: string;
+    /**
+     * Method is the api method that was called
+     *
+     * @generated from field: optional string method = 7;
+     */
+    method?: string;
+    /**
+     * Source IP contains the ip address of the caller
+     *
+     * @generated from field: optional string source_ip = 8;
+     */
+    sourceIp?: string;
+    /**
+     * Result Code is a string describing the result of the api call
+     *
+     * @generated from field: optional int32 result_code = 9;
+     */
+    resultCode?: number;
+    /**
+     * Body is a string providing text-search of the body field
+     *
+     * @generated from field: optional string body = 10;
+     */
+    body?: string;
+    /**
+     * Limit is a number limiting the length of the response (min: 1, max: 1000, defaults to 200)
+     *
+     * @generated from field: optional int32 limit = 11;
+     */
+    limit?: number;
+    /**
+     * Phase specifies the audit phase
+     *
+     * @generated from field: optional metalstack.api.v2.AuditPhase phase = 12;
+     */
+    phase?: AuditPhase;
+};
+/**
+ * Describes the message metalstack.api.v2.AuditQuery.
+ * Use `create(AuditQuerySchema)` to create a new message.
+ */
+export declare const AuditQuerySchema: GenMessage<AuditQuery>;
+/**
+ * AuditServiceListRequest is the request payload for a audit list request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceListRequest
+ */
+export type AuditServiceListRequest = Message<"metalstack.api.v2.AuditServiceListRequest"> & {
+    /**
+     * Login for this tenant
+     *
+     * @generated from field: string login = 1;
+     */
+    login: string;
+    /**
+     * Query for audit traces
+     *
+     * @generated from field: metalstack.api.v2.AuditQuery query = 2;
+     */
+    query?: AuditQuery;
+};
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export declare const AuditServiceListRequestSchema: GenMessage<AuditServiceListRequest>;
+/**
+ * AuditServiceListResponse is the response payload of a audit list request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceListResponse
+ */
+export type AuditServiceListResponse = Message<"metalstack.api.v2.AuditServiceListResponse"> & {
+    /**
+     * Traces is a list of audit traces
+     *
+     * @generated from field: repeated metalstack.api.v2.AuditTrace traces = 1;
+     */
+    traces: AuditTrace[];
+};
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export declare const AuditServiceListResponseSchema: GenMessage<AuditServiceListResponse>;
+/**
+ * AuditServiceGetRequest is the request payload of a audit get request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceGetRequest
+ */
+export type AuditServiceGetRequest = Message<"metalstack.api.v2.AuditServiceGetRequest"> & {
+    /**
+     * Login for this tenant
+     *
+     * @generated from field: string login = 1;
+     */
+    login: string;
+    /**
+     * Uuid of the audit trace
+     *
+     * @generated from field: string uuid = 2;
+     */
+    uuid: string;
+    /**
+     * Phase specifies the audit phase. Defaults to request
+     *
+     * @generated from field: optional metalstack.api.v2.AuditPhase phase = 3;
+     */
+    phase?: AuditPhase;
+};
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export declare const AuditServiceGetRequestSchema: GenMessage<AuditServiceGetRequest>;
+/**
+ * AuditServiceGetResponse is the response payload of a audit get request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceGetResponse
+ */
+export type AuditServiceGetResponse = Message<"metalstack.api.v2.AuditServiceGetResponse"> & {
+    /**
+     * Trace is the audit trace
+     *
+     * @generated from field: metalstack.api.v2.AuditTrace trace = 1;
+     */
+    trace?: AuditTrace;
+};
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export declare const AuditServiceGetResponseSchema: GenMessage<AuditServiceGetResponse>;
+/**
+ * AuditPhase specifies phase of an audit trace
+ *
+ * @generated from enum metalstack.api.v2.AuditPhase
+ */
+export declare enum AuditPhase {
+    /**
+     * AUDIT_PHASE_UNSPECIFIED is not specified
+     *
+     * @generated from enum value: AUDIT_PHASE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * AUDIT_PHASE_REQUEST defines an audit trace in the request phase
+     *
+     * @generated from enum value: AUDIT_PHASE_REQUEST = 1;
+     */
+    REQUEST = 1,
+    /**
+     * AUDIT_PHASE_REQUEST defines an audit trace in the response phase
+     *
+     * @generated from enum value: AUDIT_PHASE_RESPONSE = 2;
+     */
+    RESPONSE = 2
+}
+/**
+ * Describes the enum metalstack.api.v2.AuditPhase.
+ */
+export declare const AuditPhaseSchema: GenEnum<AuditPhase>;
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.api.v2.AuditService
+ */
+export declare const AuditService: GenService<{
+    /**
+     * Get an audit trace
+     *
+     * @generated from rpc metalstack.api.v2.AuditService.Get
+     */
+    get: {
+        methodKind: "unary";
+        input: typeof AuditServiceGetRequestSchema;
+        output: typeof AuditServiceGetResponseSchema;
+    };
+    /**
+     * List audit traces
+     *
+     * @generated from rpc metalstack.api.v2.AuditService.List
+     */
+    list: {
+        methodKind: "unary";
+        input: typeof AuditServiceListRequestSchema;
+        output: typeof AuditServiceListResponseSchema;
+    };
+}>;
diff --git a/js/metalstack/api/v2/audit_pb.js b/js/metalstack/api/v2/audit_pb.js
new file mode 100644
index 00000000..81d5761e
--- /dev/null
+++ b/js/metalstack/api/v2/audit_pb.js
@@ -0,0 +1,78 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
+// @generated from file metalstack/api/v2/audit.proto (package metalstack.api.v2, syntax proto3)
+/* eslint-disable */
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_metalstack_api_v2_common } from "./common_pb";
+import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
+/**
+ * Describes the file metalstack/api/v2/audit.proto.
+ */
+export const file_metalstack_api_v2_audit = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi9hdWRpdC5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIiqgIKCkF1ZGl0VHJhY2USFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESLQoJdGltZXN0YW1wGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIMCgR1c2VyGAMgASgJEg4KBnRlbmFudBgEIAEoCRIUCgdwcm9qZWN0GAUgASgJSACIAQESDgoGbWV0aG9kGAYgASgJEhEKBGJvZHkYByABKAlIAYgBARIRCglzb3VyY2VfaXAYCCABKAkSGAoLcmVzdWx0X2NvZGUYCSABKAVIAogBARIsCgVwaGFzZRgKIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCgoIX3Byb2plY3RCBwoFX2JvZHlCDgoMX3Jlc3VsdF9jb2RlIpoECgpBdWRpdFF1ZXJ5EhsKBHV1aWQYAiABKAlCCLpIBXIDsAEBSACIAQESLQoEZnJvbRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAYgBARIrCgJ0bxgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAogBARIeCgR1c2VyGAUgASgJQgu6SAhyBsCzrrECAUgDiAEBEh4KB3Byb2plY3QYBiABKAlCCLpIBXIDsAEBSASIAQESHwoGbWV0aG9kGAcgASgJQgq6SAdyBRACGIACSAWIAQESHwoJc291cmNlX2lwGAggASgJQge6SARyAnABSAaIAQESIQoLcmVzdWx0X2NvZGUYCSABKAVCB7pIBBoCKABIB4gBARIdCgRib2R5GAogASgJQgq6SAdyBRACGIACSAiIAQESHgoFbGltaXQYCyABKAVCCrpIBxoFGOgHIABICYgBARI7CgVwaGFzZRgMIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCLpIBYIBAhABSAqIAQFCBwoFX3V1aWRCBwoFX2Zyb21CBQoDX3RvQgcKBV91c2VyQgoKCF9wcm9qZWN0QgkKB19tZXRob2RCDAoKX3NvdXJjZV9pcEIOCgxfcmVzdWx0X2NvZGVCBwoFX2JvZHlCCAoGX2xpbWl0QggKBl9waGFzZSJjChdBdWRpdFNlcnZpY2VMaXN0UmVxdWVzdBIaCgVsb2dpbhgBIAEoCUILukgIcgbAs66xAgESLAoFcXVlcnkYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFF1ZXJ5IkkKGEF1ZGl0U2VydmljZUxpc3RSZXNwb25zZRItCgZ0cmFjZXMYASADKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFRyYWNlIpMBChZBdWRpdFNlcnZpY2VHZXRSZXF1ZXN0EhoKBWxvZ2luGAEgASgJQgu6SAhyBsCzrrECARIWCgR1dWlkGAIgASgJQgi6SAVyA7ABARI7CgVwaGFzZRgDIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCLpIBYIBAhABSACIAQFCCAoGX3BoYXNlIkcKF0F1ZGl0U2VydmljZUdldFJlc3BvbnNlEiwKBXRyYWNlGAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRUcmFjZSpcCgpBdWRpdFBoYXNlEhsKF0FVRElUX1BIQVNFX1VOU1BFQ0lGSUVEEAASFwoTQVVESVRfUEhBU0VfUkVRVUVTVBABEhgKFEFVRElUX1BIQVNFX1JFU1BPTlNFEAIy4wEKDEF1ZGl0U2VydmljZRJnCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuQXVkaXRTZXJ2aWNlR2V0UmVzcG9uc2UiCcLzGAEB4PMYAhJqCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuQXVkaXRTZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2UiCcLzGAEB4PMYAkLAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpBdWRpdFByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+/**
+ * Describes the message metalstack.api.v2.AuditTrace.
+ * Use `create(AuditTraceSchema)` to create a new message.
+ */
+export const AuditTraceSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 0);
+/**
+ * Describes the message metalstack.api.v2.AuditQuery.
+ * Use `create(AuditQuerySchema)` to create a new message.
+ */
+export const AuditQuerySchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 1);
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export const AuditServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 2);
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export const AuditServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 3);
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export const AuditServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 4);
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export const AuditServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_audit, 5);
+/**
+ * AuditPhase specifies phase of an audit trace
+ *
+ * @generated from enum metalstack.api.v2.AuditPhase
+ */
+export var AuditPhase;
+(function (AuditPhase) {
+    /**
+     * AUDIT_PHASE_UNSPECIFIED is not specified
+     *
+     * @generated from enum value: AUDIT_PHASE_UNSPECIFIED = 0;
+     */
+    AuditPhase[AuditPhase["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * AUDIT_PHASE_REQUEST defines an audit trace in the request phase
+     *
+     * @generated from enum value: AUDIT_PHASE_REQUEST = 1;
+     */
+    AuditPhase[AuditPhase["REQUEST"] = 1] = "REQUEST";
+    /**
+     * AUDIT_PHASE_REQUEST defines an audit trace in the response phase
+     *
+     * @generated from enum value: AUDIT_PHASE_RESPONSE = 2;
+     */
+    AuditPhase[AuditPhase["RESPONSE"] = 2] = "RESPONSE";
+})(AuditPhase || (AuditPhase = {}));
+/**
+ * Describes the enum metalstack.api.v2.AuditPhase.
+ */
+export const AuditPhaseSchema = /*@__PURE__*/ enumDesc(file_metalstack_api_v2_audit, 0);
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.api.v2.AuditService
+ */
+export const AuditService = /*@__PURE__*/ serviceDesc(file_metalstack_api_v2_audit, 0);
diff --git a/js/metalstack/api/v2/audit_pb.ts b/js/metalstack/api/v2/audit_pb.ts
new file mode 100644
index 00000000..4d586060
--- /dev/null
+++ b/js/metalstack/api/v2/audit_pb.ts
@@ -0,0 +1,362 @@
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
+// @generated from file metalstack/api/v2/audit.proto (package metalstack.api.v2, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_metalstack_api_v2_common } from "./common_pb";
+import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file metalstack/api/v2/audit.proto.
+ */
+export const file_metalstack_api_v2_audit: GenFile = /*@__PURE__*/
+  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi9hdWRpdC5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIiqgIKCkF1ZGl0VHJhY2USFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESLQoJdGltZXN0YW1wGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIMCgR1c2VyGAMgASgJEg4KBnRlbmFudBgEIAEoCRIUCgdwcm9qZWN0GAUgASgJSACIAQESDgoGbWV0aG9kGAYgASgJEhEKBGJvZHkYByABKAlIAYgBARIRCglzb3VyY2VfaXAYCCABKAkSGAoLcmVzdWx0X2NvZGUYCSABKAVIAogBARIsCgVwaGFzZRgKIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCgoIX3Byb2plY3RCBwoFX2JvZHlCDgoMX3Jlc3VsdF9jb2RlIpoECgpBdWRpdFF1ZXJ5EhsKBHV1aWQYAiABKAlCCLpIBXIDsAEBSACIAQESLQoEZnJvbRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAYgBARIrCgJ0bxgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAogBARIeCgR1c2VyGAUgASgJQgu6SAhyBsCzrrECAUgDiAEBEh4KB3Byb2plY3QYBiABKAlCCLpIBXIDsAEBSASIAQESHwoGbWV0aG9kGAcgASgJQgq6SAdyBRACGIACSAWIAQESHwoJc291cmNlX2lwGAggASgJQge6SARyAnABSAaIAQESIQoLcmVzdWx0X2NvZGUYCSABKAVCB7pIBBoCKABIB4gBARIdCgRib2R5GAogASgJQgq6SAdyBRACGIACSAiIAQESHgoFbGltaXQYCyABKAVCCrpIBxoFGOgHIABICYgBARI7CgVwaGFzZRgMIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCLpIBYIBAhABSAqIAQFCBwoFX3V1aWRCBwoFX2Zyb21CBQoDX3RvQgcKBV91c2VyQgoKCF9wcm9qZWN0QgkKB19tZXRob2RCDAoKX3NvdXJjZV9pcEIOCgxfcmVzdWx0X2NvZGVCBwoFX2JvZHlCCAoGX2xpbWl0QggKBl9waGFzZSJjChdBdWRpdFNlcnZpY2VMaXN0UmVxdWVzdBIaCgVsb2dpbhgBIAEoCUILukgIcgbAs66xAgESLAoFcXVlcnkYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFF1ZXJ5IkkKGEF1ZGl0U2VydmljZUxpc3RSZXNwb25zZRItCgZ0cmFjZXMYASADKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFRyYWNlIpMBChZBdWRpdFNlcnZpY2VHZXRSZXF1ZXN0EhoKBWxvZ2luGAEgASgJQgu6SAhyBsCzrrECARIWCgR1dWlkGAIgASgJQgi6SAVyA7ABARI7CgVwaGFzZRgDIAEoDjIdLm1ldGFsc3RhY2suYXBpLnYyLkF1ZGl0UGhhc2VCCLpIBYIBAhABSACIAQFCCAoGX3BoYXNlIkcKF0F1ZGl0U2VydmljZUdldFJlc3BvbnNlEiwKBXRyYWNlGAEgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuQXVkaXRUcmFjZSpcCgpBdWRpdFBoYXNlEhsKF0FVRElUX1BIQVNFX1VOU1BFQ0lGSUVEEAASFwoTQVVESVRfUEhBU0VfUkVRVUVTVBABEhgKFEFVRElUX1BIQVNFX1JFU1BPTlNFEAIy4wEKDEF1ZGl0U2VydmljZRJnCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuQXVkaXRTZXJ2aWNlR2V0UmVzcG9uc2UiCcLzGAEB4PMYAhJqCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuQXVkaXRTZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5BdWRpdFNlcnZpY2VMaXN0UmVzcG9uc2UiCcLzGAEB4PMYAkLAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpBdWRpdFByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+
+/**
+ * AuditTrace is an audit trace
+ *
+ * @generated from message metalstack.api.v2.AuditTrace
+ */
+export type AuditTrace = Message<"metalstack.api.v2.AuditTrace"> & {
+  /**
+   * Uuid of the audit trace
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+
+  /**
+   * Timestamp is the timestamp when the request arrived at the api
+   *
+   * @generated from field: google.protobuf.Timestamp timestamp = 2;
+   */
+  timestamp?: Timestamp;
+
+  /**
+   * User is the login user who called the api method
+   *
+   * @generated from field: string user = 3;
+   */
+  user: string;
+
+  /**
+   * Tenant is the tenant targeted by the api call
+   *
+   * @generated from field: string tenant = 4;
+   */
+  tenant: string;
+
+  /**
+   * Project is the project targeted by the api call
+   *
+   * @generated from field: optional string project = 5;
+   */
+  project?: string;
+
+  /**
+   * Method is the api method that was called
+   *
+   * @generated from field: string method = 6;
+   */
+  method: string;
+
+  /**
+   * Body is the payload of the api call. In the request phase this contains the payload sent by the client, in the request phase it contains the payload returned by the api server
+   *
+   * @generated from field: optional string body = 7;
+   */
+  body?: string;
+
+  /**
+   * Source IP contains the source ip address of the api call
+   *
+   * @generated from field: string source_ip = 8;
+   */
+  sourceIp: string;
+
+  /**
+   * Result Code is a status code describing the result of the api call. It is set for traces in the response phase and contains official gRPC status codes
+   *
+   * @generated from field: optional int32 result_code = 9;
+   */
+  resultCode?: number;
+
+  /**
+   * Phase represents the phase of the audit trace
+   *
+   * @generated from field: metalstack.api.v2.AuditPhase phase = 10;
+   */
+  phase: AuditPhase;
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditTrace.
+ * Use `create(AuditTraceSchema)` to create a new message.
+ */
+export const AuditTraceSchema: GenMessage<AuditTrace> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 0);
+
+/**
+ * AuditServiceListRequest is the request payload to list audits
+ *
+ * @generated from message metalstack.api.v2.AuditQuery
+ */
+export type AuditQuery = Message<"metalstack.api.v2.AuditQuery"> & {
+  /**
+   * Uuid of the audit trace
+   *
+   * @generated from field: optional string uuid = 2;
+   */
+  uuid?: string;
+
+  /**
+   * From describes the start of the time window in which to list audit traces. Defaults to the last eight hours
+   *
+   * @generated from field: optional google.protobuf.Timestamp from = 3;
+   */
+  from?: Timestamp;
+
+  /**
+   * To describes the end of the time window in which to list audit traces. Defaults to the time the request was issued
+   *
+   * @generated from field: optional google.protobuf.Timestamp to = 4;
+   */
+  to?: Timestamp;
+
+  /**
+   * User is the user who called the api method
+   *
+   * @generated from field: optional string user = 5;
+   */
+  user?: string;
+
+  /**
+   * Project is the project targeted by the api call
+   *
+   * @generated from field: optional string project = 6;
+   */
+  project?: string;
+
+  /**
+   * Method is the api method that was called
+   *
+   * @generated from field: optional string method = 7;
+   */
+  method?: string;
+
+  /**
+   * Source IP contains the ip address of the caller
+   *
+   * @generated from field: optional string source_ip = 8;
+   */
+  sourceIp?: string;
+
+  /**
+   * Result Code is a string describing the result of the api call
+   *
+   * @generated from field: optional int32 result_code = 9;
+   */
+  resultCode?: number;
+
+  /**
+   * Body is a string providing text-search of the body field
+   *
+   * @generated from field: optional string body = 10;
+   */
+  body?: string;
+
+  /**
+   * Limit is a number limiting the length of the response (min: 1, max: 1000, defaults to 200)
+   *
+   * @generated from field: optional int32 limit = 11;
+   */
+  limit?: number;
+
+  /**
+   * Phase specifies the audit phase
+   *
+   * @generated from field: optional metalstack.api.v2.AuditPhase phase = 12;
+   */
+  phase?: AuditPhase;
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditQuery.
+ * Use `create(AuditQuerySchema)` to create a new message.
+ */
+export const AuditQuerySchema: GenMessage<AuditQuery> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 1);
+
+/**
+ * AuditServiceListRequest is the request payload for a audit list request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceListRequest
+ */
+export type AuditServiceListRequest = Message<"metalstack.api.v2.AuditServiceListRequest"> & {
+  /**
+   * Login for this tenant
+   *
+   * @generated from field: string login = 1;
+   */
+  login: string;
+
+  /**
+   * Query for audit traces
+   *
+   * @generated from field: metalstack.api.v2.AuditQuery query = 2;
+   */
+  query?: AuditQuery;
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListRequest.
+ * Use `create(AuditServiceListRequestSchema)` to create a new message.
+ */
+export const AuditServiceListRequestSchema: GenMessage<AuditServiceListRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 2);
+
+/**
+ * AuditServiceListResponse is the response payload of a audit list request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceListResponse
+ */
+export type AuditServiceListResponse = Message<"metalstack.api.v2.AuditServiceListResponse"> & {
+  /**
+   * Traces is a list of audit traces
+   *
+   * @generated from field: repeated metalstack.api.v2.AuditTrace traces = 1;
+   */
+  traces: AuditTrace[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditServiceListResponse.
+ * Use `create(AuditServiceListResponseSchema)` to create a new message.
+ */
+export const AuditServiceListResponseSchema: GenMessage<AuditServiceListResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 3);
+
+/**
+ * AuditServiceGetRequest is the request payload of a audit get request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceGetRequest
+ */
+export type AuditServiceGetRequest = Message<"metalstack.api.v2.AuditServiceGetRequest"> & {
+  /**
+   * Login for this tenant
+   *
+   * @generated from field: string login = 1;
+   */
+  login: string;
+
+  /**
+   * Uuid of the audit trace
+   *
+   * @generated from field: string uuid = 2;
+   */
+  uuid: string;
+
+  /**
+   * Phase specifies the audit phase. Defaults to request
+   *
+   * @generated from field: optional metalstack.api.v2.AuditPhase phase = 3;
+   */
+  phase?: AuditPhase;
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetRequest.
+ * Use `create(AuditServiceGetRequestSchema)` to create a new message.
+ */
+export const AuditServiceGetRequestSchema: GenMessage<AuditServiceGetRequest> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 4);
+
+/**
+ * AuditServiceGetResponse is the response payload of a audit get request
+ *
+ * @generated from message metalstack.api.v2.AuditServiceGetResponse
+ */
+export type AuditServiceGetResponse = Message<"metalstack.api.v2.AuditServiceGetResponse"> & {
+  /**
+   * Trace is the audit trace
+   *
+   * @generated from field: metalstack.api.v2.AuditTrace trace = 1;
+   */
+  trace?: AuditTrace;
+};
+
+/**
+ * Describes the message metalstack.api.v2.AuditServiceGetResponse.
+ * Use `create(AuditServiceGetResponseSchema)` to create a new message.
+ */
+export const AuditServiceGetResponseSchema: GenMessage<AuditServiceGetResponse> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_audit, 5);
+
+/**
+ * AuditPhase specifies phase of an audit trace
+ *
+ * @generated from enum metalstack.api.v2.AuditPhase
+ */
+export enum AuditPhase {
+  /**
+   * AUDIT_PHASE_UNSPECIFIED is not specified
+   *
+   * @generated from enum value: AUDIT_PHASE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * AUDIT_PHASE_REQUEST defines an audit trace in the request phase
+   *
+   * @generated from enum value: AUDIT_PHASE_REQUEST = 1;
+   */
+  REQUEST = 1,
+
+  /**
+   * AUDIT_PHASE_REQUEST defines an audit trace in the response phase
+   *
+   * @generated from enum value: AUDIT_PHASE_RESPONSE = 2;
+   */
+  RESPONSE = 2,
+}
+
+/**
+ * Describes the enum metalstack.api.v2.AuditPhase.
+ */
+export const AuditPhaseSchema: GenEnum<AuditPhase> = /*@__PURE__*/
+  enumDesc(file_metalstack_api_v2_audit, 0);
+
+/**
+ * AuditService serves audit related functions
+ *
+ * @generated from service metalstack.api.v2.AuditService
+ */
+export const AuditService: GenService<{
+  /**
+   * Get an audit trace
+   *
+   * @generated from rpc metalstack.api.v2.AuditService.Get
+   */
+  get: {
+    methodKind: "unary";
+    input: typeof AuditServiceGetRequestSchema;
+    output: typeof AuditServiceGetResponseSchema;
+  },
+  /**
+   * List audit traces
+   *
+   * @generated from rpc metalstack.api.v2.AuditService.List
+   */
+  list: {
+    methodKind: "unary";
+    input: typeof AuditServiceListRequestSchema;
+    output: typeof AuditServiceListResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_metalstack_api_v2_audit, 0);
+
diff --git a/proto/metalstack/admin/v2/audit.proto b/proto/metalstack/admin/v2/audit.proto
new file mode 100644
index 00000000..0b131174
--- /dev/null
+++ b/proto/metalstack/admin/v2/audit.proto
@@ -0,0 +1,47 @@
+syntax = "proto3";
+
+package metalstack.admin.v2;
+
+import "buf/validate/validate.proto";
+import "metalstack/api/v2/audit.proto";
+import "metalstack/api/v2/common.proto";
+
+// AuditService serves audit related functions
+service AuditService {
+  // Get an audit trace
+  rpc Get(AuditServiceGetRequest) returns (AuditServiceGetResponse) {
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_VIEWER;
+  }
+  // List all audit traces
+  rpc List(AuditServiceListRequest) returns (AuditServiceListResponse) {
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_EDITOR;
+    option (metalstack.api.v2.admin_roles) = ADMIN_ROLE_VIEWER;
+  }
+}
+
+// AuditServiceListRequest is the request payload to list audits
+message AuditServiceListRequest {
+  // Query for audit traces
+  metalstack.api.v2.AuditQuery query = 1;
+}
+
+// AuditServiceListResponse is the response payload of a audit list request
+message AuditServiceListResponse {
+  // Traces is a list of audit traces
+  repeated metalstack.api.v2.AuditTrace traces = 1;
+}
+
+// AuditServiceGetRequest is the request payload of a audit get request
+message AuditServiceGetRequest {
+  // Uuid of the audit trace
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Phase specifies the audit phase. Defaults to request
+  optional metalstack.api.v2.AuditPhase phase = 2 [(buf.validate.field).enum.defined_only = true];
+}
+
+// AuditServiceGetResponse is the response payload of a audit get request
+message AuditServiceGetResponse {
+  // Trace is the audit trace
+  metalstack.api.v2.AuditTrace trace = 1;
+}
diff --git a/proto/metalstack/api/v2/audit.proto b/proto/metalstack/api/v2/audit.proto
new file mode 100644
index 00000000..ac31e0b1
--- /dev/null
+++ b/proto/metalstack/api/v2/audit.proto
@@ -0,0 +1,121 @@
+syntax = "proto3";
+
+package metalstack.api.v2;
+
+import "buf/validate/validate.proto";
+import "google/protobuf/timestamp.proto";
+import "metalstack/api/v2/common.proto";
+import "metalstack/api/v2/predefined_rules.proto";
+
+// AuditService serves audit related functions
+service AuditService {
+  // Get an audit trace
+  rpc Get(AuditServiceGetRequest) returns (AuditServiceGetResponse) {
+    option (tenant_roles) = TENANT_ROLE_OWNER;
+    option (auditing) = AUDITING_EXCLUDED;
+  }
+  // List audit traces
+  rpc List(AuditServiceListRequest) returns (AuditServiceListResponse) {
+    option (tenant_roles) = TENANT_ROLE_OWNER;
+    option (auditing) = AUDITING_EXCLUDED;
+  }
+}
+
+// AuditPhase specifies phase of an audit trace
+enum AuditPhase {
+  // AUDIT_PHASE_UNSPECIFIED is not specified
+  AUDIT_PHASE_UNSPECIFIED = 0;
+  // AUDIT_PHASE_REQUEST defines an audit trace in the request phase
+  AUDIT_PHASE_REQUEST = 1;
+  // AUDIT_PHASE_REQUEST defines an audit trace in the response phase
+  AUDIT_PHASE_RESPONSE = 2;
+}
+
+// AuditTrace is an audit trace
+message AuditTrace {
+  // Uuid of the audit trace
+  string uuid = 1 [(buf.validate.field).string.uuid = true];
+  // Timestamp is the timestamp when the request arrived at the api
+  google.protobuf.Timestamp timestamp = 2;
+  // User is the login user who called the api method
+  string user = 3;
+  // Tenant is the tenant targeted by the api call
+  string tenant = 4;
+  // Project is the project targeted by the api call
+  optional string project = 5;
+  // Method is the api method that was called
+  string method = 6;
+  // Body is the payload of the api call. In the request phase this contains the payload sent by the client, in the request phase it contains the payload returned by the api server
+  optional string body = 7;
+  // Source IP contains the source ip address of the api call
+  string source_ip = 8;
+  // Result Code is a status code describing the result of the api call. It is set for traces in the response phase and contains official gRPC status codes
+  optional int32 result_code = 9;
+  // Phase represents the phase of the audit trace
+  AuditPhase phase = 10;
+}
+
+// AuditServiceListRequest is the request payload to list audits
+message AuditQuery {
+  // Uuid of the audit trace
+  optional string uuid = 2 [(buf.validate.field).string.uuid = true];
+  // From describes the start of the time window in which to list audit traces. Defaults to the last eight hours
+  optional google.protobuf.Timestamp from = 3;
+  // To describes the end of the time window in which to list audit traces. Defaults to the time the request was issued
+  optional google.protobuf.Timestamp to = 4;
+  // User is the user who called the api method
+  optional string user = 5 [(buf.validate.field).string.(metalstack.api.v2.is_name) = true];
+  // Project is the project targeted by the api call
+  optional string project = 6 [(buf.validate.field).string.uuid = true];
+  // Method is the api method that was called
+  optional string method = 7 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 256
+  }];
+  // Source IP contains the ip address of the caller
+  optional string source_ip = 8 [(buf.validate.field).string.ip = true];
+  // Result Code is a string describing the result of the api call
+  optional int32 result_code = 9 [(buf.validate.field).int32 = {gte: 0}];
+  // Body is a string providing text-search of the body field
+  optional string body = 10 [(buf.validate.field).string = {
+    min_len: 2
+    max_len: 256
+  }];
+  // Limit is a number limiting the length of the response (min: 1, max: 1000, defaults to 200)
+  optional int32 limit = 11 [(buf.validate.field).int32 = {
+    gt: 0
+    lte: 1000
+  }];
+  // Phase specifies the audit phase
+  optional AuditPhase phase = 12 [(buf.validate.field).enum.defined_only = true];
+}
+
+// AuditServiceListRequest is the request payload for a audit list request
+message AuditServiceListRequest {
+  // Login for this tenant
+  string login = 1 [(buf.validate.field).string.(metalstack.api.v2.is_name) = true];
+  // Query for audit traces
+  AuditQuery query = 2;
+}
+
+// AuditServiceListResponse is the response payload of a audit list request
+message AuditServiceListResponse {
+  // Traces is a list of audit traces
+  repeated AuditTrace traces = 1;
+}
+
+// AuditServiceGetRequest is the request payload of a audit get request
+message AuditServiceGetRequest {
+  // Login for this tenant
+  string login = 1 [(buf.validate.field).string.(metalstack.api.v2.is_name) = true];
+  // Uuid of the audit trace
+  string uuid = 2 [(buf.validate.field).string.uuid = true];
+  // Phase specifies the audit phase. Defaults to request
+  optional AuditPhase phase = 3 [(buf.validate.field).enum.defined_only = true];
+}
+
+// AuditServiceGetResponse is the response payload of a audit get request
+message AuditServiceGetResponse {
+  // Trace is the audit trace
+  AuditTrace trace = 1;
+}
diff --git a/python/metalstack/admin/v2/audit_connect.py b/python/metalstack/admin/v2/audit_connect.py
new file mode 100644
index 00000000..77ad12b2
--- /dev/null
+++ b/python/metalstack/admin/v2/audit_connect.py
@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+# Generated by https://github.com/connectrpc/connect-python.  DO NOT EDIT!
+# source: metalstack/admin/v2/audit.proto
+
+from collections.abc import AsyncGenerator, AsyncIterator, Iterable, Iterator, Mapping
+from typing import Protocol
+
+from connectrpc.client import ConnectClient, ConnectClientSync
+from connectrpc.code import Code
+from connectrpc.errors import ConnectError
+from connectrpc.interceptor import Interceptor, InterceptorSync
+from connectrpc.method import IdempotencyLevel, MethodInfo
+from connectrpc.request import Headers, RequestContext
+from connectrpc.server import ConnectASGIApplication, ConnectWSGIApplication, Endpoint, EndpointSync
+import metalstack.admin.v2.audit_pb2 as metalstack_dot_admin_dot_v2_dot_audit__pb2
+
+
+class AuditService(Protocol):
+    async def get(self, request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def list(self, request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AuditServiceASGIApplication(ConnectASGIApplication[AuditService]):
+    def __init__(self, service: AuditService | AsyncGenerator[AuditService], *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            service=service,
+            endpoints=lambda svc: {
+                "/metalstack.admin.v2.AuditService/Get": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Get",
+                        service_name="metalstack.admin.v2.AuditService",
+                        input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.get,
+                ),
+                "/metalstack.admin.v2.AuditService/List": Endpoint.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.admin.v2.AuditService",
+                        input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.admin.v2.AuditService"
+
+
+class AuditServiceClient(ConnectClient):
+    async def get(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Get",
+                service_name="metalstack.admin.v2.AuditService",
+                input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def list(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.admin.v2.AuditService",
+                input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+
+class AuditServiceSync(Protocol):
+    def get(self, request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def list(self, request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest, ctx: RequestContext) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AuditServiceWSGIApplication(ConnectWSGIApplication):
+    def __init__(self, service: AuditServiceSync, interceptors: Iterable[InterceptorSync]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.admin.v2.AuditService/Get": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Get",
+                        service_name="metalstack.admin.v2.AuditService",
+                        input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.get,
+                ),
+                "/metalstack.admin.v2.AuditService/List": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.admin.v2.AuditService",
+                        input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                        output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.admin.v2.AuditService"
+
+
+class AuditServiceClientSync(ConnectClientSync):
+    def get(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Get",
+                service_name="metalstack.admin.v2.AuditService",
+                input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def list(
+        self,
+        request: metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.admin.v2.AuditService",
+                input=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                output=metalstack_dot_admin_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
diff --git a/python/metalstack/admin/v2/audit_pb2.py b/python/metalstack/admin/v2/audit_pb2.py
new file mode 100644
index 00000000..0d6a773e
--- /dev/null
+++ b/python/metalstack/admin/v2/audit_pb2.py
@@ -0,0 +1,56 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: metalstack/admin/v2/audit.proto
+# Protobuf Python Version: 6.33.5
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    6,
+    33,
+    5,
+    '',
+    'metalstack/admin/v2/audit.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
+from metalstack.api.v2 import audit_pb2 as metalstack_dot_api_dot_v2_dot_audit__pb2
+from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/admin/v2/audit.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1dmetalstack/api/v2/audit.proto\x1a\x1emetalstack/api/v2/common.proto\"N\n\x17\x41uditServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.AuditQueryR\x05query\"Q\n\x18\x41uditServiceListResponse\x12\x35\n\x06traces\x18\x01 \x03(\x0b\x32\x1d.metalstack.api.v2.AuditTraceR\x06traces\"\x84\x01\n\x16\x41uditServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x42\n\x05phase\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.AuditPhaseB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x05phase\x88\x01\x01\x42\x08\n\x06_phase\"N\n\x17\x41uditServiceGetResponse\x12\x33\n\x05trace\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.AuditTraceR\x05trace2\xe5\x01\n\x0c\x41uditService\x12h\n\x03Get\x12+.metalstack.admin.v2.AuditServiceGetRequest\x1a,.metalstack.admin.v2.AuditServiceGetResponse\"\x06\xd2\xf3\x18\x02\x01\x02\x12k\n\x04List\x12,.metalstack.admin.v2.AuditServiceListRequest\x1a-.metalstack.admin.v2.AuditServiceListResponse\"\x06\xd2\xf3\x18\x02\x01\x02\x42\xce\x01\n\x17\x63om.metalstack.admin.v2B\nAuditProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'metalstack.admin.v2.audit_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.admin.v2B\nAuditProtoP\001Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\242\002\003MAX\252\002\023Metalstack.Admin.V2\312\002\023Metalstack\\Admin\\V2\342\002\037Metalstack\\Admin\\V2\\GPBMetadata\352\002\025Metalstack::Admin::V2'
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['phase']._loaded_options = None
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['phase']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_AUDITSERVICE'].methods_by_name['Get']._loaded_options = None
+  _globals['_AUDITSERVICE'].methods_by_name['Get']._serialized_options = b'\322\363\030\002\001\002'
+  _globals['_AUDITSERVICE'].methods_by_name['List']._loaded_options = None
+  _globals['_AUDITSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002'
+  _globals['_AUDITSERVICELISTREQUEST']._serialized_start=148
+  _globals['_AUDITSERVICELISTREQUEST']._serialized_end=226
+  _globals['_AUDITSERVICELISTRESPONSE']._serialized_start=228
+  _globals['_AUDITSERVICELISTRESPONSE']._serialized_end=309
+  _globals['_AUDITSERVICEGETREQUEST']._serialized_start=312
+  _globals['_AUDITSERVICEGETREQUEST']._serialized_end=444
+  _globals['_AUDITSERVICEGETRESPONSE']._serialized_start=446
+  _globals['_AUDITSERVICEGETRESPONSE']._serialized_end=524
+  _globals['_AUDITSERVICE']._serialized_start=527
+  _globals['_AUDITSERVICE']._serialized_end=756
+# @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/audit_pb2.pyi b/python/metalstack/admin/v2/audit_pb2.pyi
new file mode 100644
index 00000000..85932c7a
--- /dev/null
+++ b/python/metalstack/admin/v2/audit_pb2.pyi
@@ -0,0 +1,36 @@
+from buf.validate import validate_pb2 as _validate_pb2
+from metalstack.api.v2 import audit_pb2 as _audit_pb2
+from metalstack.api.v2 import common_pb2 as _common_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from collections.abc import Iterable as _Iterable, Mapping as _Mapping
+from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class AuditServiceListRequest(_message.Message):
+    __slots__ = ("query",)
+    QUERY_FIELD_NUMBER: _ClassVar[int]
+    query: _audit_pb2.AuditQuery
+    def __init__(self, query: _Optional[_Union[_audit_pb2.AuditQuery, _Mapping]] = ...) -> None: ...
+
+class AuditServiceListResponse(_message.Message):
+    __slots__ = ("traces",)
+    TRACES_FIELD_NUMBER: _ClassVar[int]
+    traces: _containers.RepeatedCompositeFieldContainer[_audit_pb2.AuditTrace]
+    def __init__(self, traces: _Optional[_Iterable[_Union[_audit_pb2.AuditTrace, _Mapping]]] = ...) -> None: ...
+
+class AuditServiceGetRequest(_message.Message):
+    __slots__ = ("uuid", "phase")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    PHASE_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    phase: _audit_pb2.AuditPhase
+    def __init__(self, uuid: _Optional[str] = ..., phase: _Optional[_Union[_audit_pb2.AuditPhase, str]] = ...) -> None: ...
+
+class AuditServiceGetResponse(_message.Message):
+    __slots__ = ("trace",)
+    TRACE_FIELD_NUMBER: _ClassVar[int]
+    trace: _audit_pb2.AuditTrace
+    def __init__(self, trace: _Optional[_Union[_audit_pb2.AuditTrace, _Mapping]] = ...) -> None: ...
diff --git a/python/metalstack/api/v2/audit_connect.py b/python/metalstack/api/v2/audit_connect.py
new file mode 100644
index 00000000..22eb53dd
--- /dev/null
+++ b/python/metalstack/api/v2/audit_connect.py
@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+# Generated by https://github.com/connectrpc/connect-python.  DO NOT EDIT!
+# source: metalstack/api/v2/audit.proto
+
+from collections.abc import AsyncGenerator, AsyncIterator, Iterable, Iterator, Mapping
+from typing import Protocol
+
+from connectrpc.client import ConnectClient, ConnectClientSync
+from connectrpc.code import Code
+from connectrpc.errors import ConnectError
+from connectrpc.interceptor import Interceptor, InterceptorSync
+from connectrpc.method import IdempotencyLevel, MethodInfo
+from connectrpc.request import Headers, RequestContext
+from connectrpc.server import ConnectASGIApplication, ConnectWSGIApplication, Endpoint, EndpointSync
+import metalstack.api.v2.audit_pb2 as metalstack_dot_api_dot_v2_dot_audit__pb2
+
+
+class AuditService(Protocol):
+    async def get(self, request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest, ctx: RequestContext) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+    async def list(self, request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest, ctx: RequestContext) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AuditServiceASGIApplication(ConnectASGIApplication[AuditService]):
+    def __init__(self, service: AuditService | AsyncGenerator[AuditService], *, interceptors: Iterable[Interceptor]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            service=service,
+            endpoints=lambda svc: {
+                "/metalstack.api.v2.AuditService/Get": Endpoint.unary(
+                    method=MethodInfo(
+                        name="Get",
+                        service_name="metalstack.api.v2.AuditService",
+                        input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                        output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.get,
+                ),
+                "/metalstack.api.v2.AuditService/List": Endpoint.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.api.v2.AuditService",
+                        input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                        output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=svc.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.api.v2.AuditService"
+
+
+class AuditServiceClient(ConnectClient):
+    async def get(
+        self,
+        request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Get",
+                service_name="metalstack.api.v2.AuditService",
+                input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    async def list(
+        self,
+        request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        return await self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.api.v2.AuditService",
+                input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+
+class AuditServiceSync(Protocol):
+    def get(self, request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest, ctx: RequestContext) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+    def list(self, request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest, ctx: RequestContext) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        raise ConnectError(Code.UNIMPLEMENTED, "Not implemented")
+
+
+class AuditServiceWSGIApplication(ConnectWSGIApplication):
+    def __init__(self, service: AuditServiceSync, interceptors: Iterable[InterceptorSync]=(), read_max_bytes: int | None = None) -> None:
+        super().__init__(
+            endpoints={
+                "/metalstack.api.v2.AuditService/Get": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="Get",
+                        service_name="metalstack.api.v2.AuditService",
+                        input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                        output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.get,
+                ),
+                "/metalstack.api.v2.AuditService/List": EndpointSync.unary(
+                    method=MethodInfo(
+                        name="List",
+                        service_name="metalstack.api.v2.AuditService",
+                        input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                        output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                        idempotency_level=IdempotencyLevel.UNKNOWN,
+                    ),
+                    function=service.list,
+                ),
+            },
+            interceptors=interceptors,
+            read_max_bytes=read_max_bytes,
+        )
+
+    @property
+    def path(self) -> str:
+        """Returns the URL path to mount the application to when serving multiple applications."""
+        return "/metalstack.api.v2.AuditService"
+
+
+class AuditServiceClientSync(ConnectClientSync):
+    def get(
+        self,
+        request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="Get",
+                service_name="metalstack.api.v2.AuditService",
+                input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetRequest,
+                output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceGetResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
+
+    def list(
+        self,
+        request: metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+        *,
+        headers: Headers | Mapping[str, str] | None = None,
+        timeout_ms: int | None = None,
+    ) -> metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse:
+        return self.execute_unary(
+            request=request,
+            method=MethodInfo(
+                name="List",
+                service_name="metalstack.api.v2.AuditService",
+                input=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListRequest,
+                output=metalstack_dot_api_dot_v2_dot_audit__pb2.AuditServiceListResponse,
+                idempotency_level=IdempotencyLevel.UNKNOWN,
+            ),
+            headers=headers,
+            timeout_ms=timeout_ms,
+        )
diff --git a/python/metalstack/api/v2/audit_pb2.py b/python/metalstack/api/v2/audit_pb2.py
new file mode 100644
index 00000000..217d9fdf
--- /dev/null
+++ b/python/metalstack/api/v2/audit_pb2.py
@@ -0,0 +1,87 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# NO CHECKED-IN PROTOBUF GENCODE
+# source: metalstack/api/v2/audit.proto
+# Protobuf Python Version: 6.33.5
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import runtime_version as _runtime_version
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+_runtime_version.ValidateProtobufRuntimeVersion(
+    _runtime_version.Domain.PUBLIC,
+    6,
+    33,
+    5,
+    '',
+    'metalstack/api/v2/audit.proto'
+)
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
+from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
+from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
+from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/audit.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xfd\x02\n\nAuditTrace\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x38\n\ttimestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\ttimestamp\x12\x12\n\x04user\x18\x03 \x01(\tR\x04user\x12\x16\n\x06tenant\x18\x04 \x01(\tR\x06tenant\x12\x1d\n\x07project\x18\x05 \x01(\tH\x00R\x07project\x88\x01\x01\x12\x16\n\x06method\x18\x06 \x01(\tR\x06method\x12\x17\n\x04\x62ody\x18\x07 \x01(\tH\x01R\x04\x62ody\x88\x01\x01\x12\x1b\n\tsource_ip\x18\x08 \x01(\tR\x08sourceIp\x12$\n\x0bresult_code\x18\t \x01(\x05H\x02R\nresultCode\x88\x01\x01\x12\x33\n\x05phase\x18\n \x01(\x0e\x32\x1d.metalstack.api.v2.AuditPhaseR\x05phaseB\n\n\x08_projectB\x07\n\x05_bodyB\x0e\n\x0c_result_code\"\xeb\x04\n\nAuditQuery\x12!\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12\x33\n\x04\x66rom\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x01R\x04\x66rom\x88\x01\x01\x12/\n\x02to\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x02R\x02to\x88\x01\x01\x12$\n\x04user\x18\x05 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01H\x03R\x04user\x88\x01\x01\x12\'\n\x07project\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x04R\x07project\x88\x01\x01\x12\'\n\x06method\x18\x07 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x02H\x05R\x06method\x88\x01\x01\x12)\n\tsource_ip\x18\x08 \x01(\tB\x07\xbaH\x04r\x02p\x01H\x06R\x08sourceIp\x88\x01\x01\x12-\n\x0bresult_code\x18\t \x01(\x05\x42\x07\xbaH\x04\x1a\x02(\x00H\x07R\nresultCode\x88\x01\x01\x12#\n\x04\x62ody\x18\n \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x02H\x08R\x04\x62ody\x88\x01\x01\x12%\n\x05limit\x18\x0b \x01(\x05\x42\n\xbaH\x07\x1a\x05\x18\xe8\x07 \x00H\tR\x05limit\x88\x01\x01\x12\x42\n\x05phase\x18\x0c \x01(\x0e\x32\x1d.metalstack.api.v2.AuditPhaseB\x08\xbaH\x05\x82\x01\x02\x10\x01H\nR\x05phase\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_fromB\x05\n\x03_toB\x07\n\x05_userB\n\n\x08_projectB\t\n\x07_methodB\x0c\n\n_source_ipB\x0e\n\x0c_result_codeB\x07\n\x05_bodyB\x08\n\x06_limitB\x08\n\x06_phase\"q\n\x17\x41uditServiceListRequest\x12!\n\x05login\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x05login\x12\x33\n\x05query\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.AuditQueryR\x05query\"Q\n\x18\x41uditServiceListResponse\x12\x35\n\x06traces\x18\x01 \x03(\x0b\x32\x1d.metalstack.api.v2.AuditTraceR\x06traces\"\xa7\x01\n\x16\x41uditServiceGetRequest\x12!\n\x05login\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc0\xb3\xae\xb1\x02\x01R\x05login\x12\x1c\n\x04uuid\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x42\n\x05phase\x18\x03 \x01(\x0e\x32\x1d.metalstack.api.v2.AuditPhaseB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\x05phase\x88\x01\x01\x42\x08\n\x06_phase\"N\n\x17\x41uditServiceGetResponse\x12\x33\n\x05trace\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.AuditTraceR\x05trace*\\\n\nAuditPhase\x12\x1b\n\x17\x41UDIT_PHASE_UNSPECIFIED\x10\x00\x12\x17\n\x13\x41UDIT_PHASE_REQUEST\x10\x01\x12\x18\n\x14\x41UDIT_PHASE_RESPONSE\x10\x02\x32\xe3\x01\n\x0c\x41uditService\x12g\n\x03Get\x12).metalstack.api.v2.AuditServiceGetRequest\x1a*.metalstack.api.v2.AuditServiceGetResponse\"\t\xc2\xf3\x18\x01\x01\xe0\xf3\x18\x02\x12j\n\x04List\x12*.metalstack.api.v2.AuditServiceListRequest\x1a+.metalstack.api.v2.AuditServiceListResponse\"\t\xc2\xf3\x18\x01\x01\xe0\xf3\x18\x02\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nAuditProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'metalstack.api.v2.audit_pb2', _globals)
+if not _descriptor._USE_C_DESCRIPTORS:
+  _globals['DESCRIPTOR']._loaded_options = None
+  _globals['DESCRIPTOR']._serialized_options = b'\n\025com.metalstack.api.v2B\nAuditProtoP\001Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\242\002\003MAX\252\002\021Metalstack.Api.V2\312\002\021Metalstack\\Api\\V2\342\002\035Metalstack\\Api\\V2\\GPBMetadata\352\002\023Metalstack::Api::V2'
+  _globals['_AUDITTRACE'].fields_by_name['uuid']._loaded_options = None
+  _globals['_AUDITTRACE'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_AUDITQUERY'].fields_by_name['uuid']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_AUDITQUERY'].fields_by_name['user']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['user']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
+  _globals['_AUDITQUERY'].fields_by_name['project']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['project']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_AUDITQUERY'].fields_by_name['method']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['method']._serialized_options = b'\272H\007r\005\020\002\030\200\002'
+  _globals['_AUDITQUERY'].fields_by_name['source_ip']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['source_ip']._serialized_options = b'\272H\004r\002p\001'
+  _globals['_AUDITQUERY'].fields_by_name['result_code']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['result_code']._serialized_options = b'\272H\004\032\002(\000'
+  _globals['_AUDITQUERY'].fields_by_name['body']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['body']._serialized_options = b'\272H\007r\005\020\002\030\200\002'
+  _globals['_AUDITQUERY'].fields_by_name['limit']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['limit']._serialized_options = b'\272H\007\032\005\030\350\007 \000'
+  _globals['_AUDITQUERY'].fields_by_name['phase']._loaded_options = None
+  _globals['_AUDITQUERY'].fields_by_name['phase']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_AUDITSERVICELISTREQUEST'].fields_by_name['login']._loaded_options = None
+  _globals['_AUDITSERVICELISTREQUEST'].fields_by_name['login']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['login']._loaded_options = None
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['login']._serialized_options = b'\272H\010r\006\300\263\256\261\002\001'
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['uuid']._loaded_options = None
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['phase']._loaded_options = None
+  _globals['_AUDITSERVICEGETREQUEST'].fields_by_name['phase']._serialized_options = b'\272H\005\202\001\002\020\001'
+  _globals['_AUDITSERVICE'].methods_by_name['Get']._loaded_options = None
+  _globals['_AUDITSERVICE'].methods_by_name['Get']._serialized_options = b'\302\363\030\001\001\340\363\030\002'
+  _globals['_AUDITSERVICE'].methods_by_name['List']._loaded_options = None
+  _globals['_AUDITSERVICE'].methods_by_name['List']._serialized_options = b'\302\363\030\001\001\340\363\030\002'
+  _globals['_AUDITPHASE']._serialized_start=1642
+  _globals['_AUDITPHASE']._serialized_end=1734
+  _globals['_AUDITTRACE']._serialized_start=189
+  _globals['_AUDITTRACE']._serialized_end=570
+  _globals['_AUDITQUERY']._serialized_start=573
+  _globals['_AUDITQUERY']._serialized_end=1192
+  _globals['_AUDITSERVICELISTREQUEST']._serialized_start=1194
+  _globals['_AUDITSERVICELISTREQUEST']._serialized_end=1307
+  _globals['_AUDITSERVICELISTRESPONSE']._serialized_start=1309
+  _globals['_AUDITSERVICELISTRESPONSE']._serialized_end=1390
+  _globals['_AUDITSERVICEGETREQUEST']._serialized_start=1393
+  _globals['_AUDITSERVICEGETREQUEST']._serialized_end=1560
+  _globals['_AUDITSERVICEGETRESPONSE']._serialized_start=1562
+  _globals['_AUDITSERVICEGETRESPONSE']._serialized_end=1640
+  _globals['_AUDITSERVICE']._serialized_start=1737
+  _globals['_AUDITSERVICE']._serialized_end=1964
+# @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/audit_pb2.pyi b/python/metalstack/api/v2/audit_pb2.pyi
new file mode 100644
index 00000000..d8972771
--- /dev/null
+++ b/python/metalstack/api/v2/audit_pb2.pyi
@@ -0,0 +1,102 @@
+import datetime
+
+from buf.validate import validate_pb2 as _validate_pb2
+from google.protobuf import timestamp_pb2 as _timestamp_pb2
+from metalstack.api.v2 import common_pb2 as _common_pb2
+from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf.internal import enum_type_wrapper as _enum_type_wrapper
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from collections.abc import Iterable as _Iterable, Mapping as _Mapping
+from typing import ClassVar as _ClassVar, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class AuditPhase(int, metaclass=_enum_type_wrapper.EnumTypeWrapper):
+    __slots__ = ()
+    AUDIT_PHASE_UNSPECIFIED: _ClassVar[AuditPhase]
+    AUDIT_PHASE_REQUEST: _ClassVar[AuditPhase]
+    AUDIT_PHASE_RESPONSE: _ClassVar[AuditPhase]
+AUDIT_PHASE_UNSPECIFIED: AuditPhase
+AUDIT_PHASE_REQUEST: AuditPhase
+AUDIT_PHASE_RESPONSE: AuditPhase
+
+class AuditTrace(_message.Message):
+    __slots__ = ("uuid", "timestamp", "user", "tenant", "project", "method", "body", "source_ip", "result_code", "phase")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    TIMESTAMP_FIELD_NUMBER: _ClassVar[int]
+    USER_FIELD_NUMBER: _ClassVar[int]
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    METHOD_FIELD_NUMBER: _ClassVar[int]
+    BODY_FIELD_NUMBER: _ClassVar[int]
+    SOURCE_IP_FIELD_NUMBER: _ClassVar[int]
+    RESULT_CODE_FIELD_NUMBER: _ClassVar[int]
+    PHASE_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    timestamp: _timestamp_pb2.Timestamp
+    user: str
+    tenant: str
+    project: str
+    method: str
+    body: str
+    source_ip: str
+    result_code: int
+    phase: AuditPhase
+    def __init__(self, uuid: _Optional[str] = ..., timestamp: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., user: _Optional[str] = ..., tenant: _Optional[str] = ..., project: _Optional[str] = ..., method: _Optional[str] = ..., body: _Optional[str] = ..., source_ip: _Optional[str] = ..., result_code: _Optional[int] = ..., phase: _Optional[_Union[AuditPhase, str]] = ...) -> None: ...
+
+class AuditQuery(_message.Message):
+    __slots__ = ("uuid", "to", "user", "project", "method", "source_ip", "result_code", "body", "limit", "phase")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    FROM_FIELD_NUMBER: _ClassVar[int]
+    TO_FIELD_NUMBER: _ClassVar[int]
+    USER_FIELD_NUMBER: _ClassVar[int]
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    METHOD_FIELD_NUMBER: _ClassVar[int]
+    SOURCE_IP_FIELD_NUMBER: _ClassVar[int]
+    RESULT_CODE_FIELD_NUMBER: _ClassVar[int]
+    BODY_FIELD_NUMBER: _ClassVar[int]
+    LIMIT_FIELD_NUMBER: _ClassVar[int]
+    PHASE_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    to: _timestamp_pb2.Timestamp
+    user: str
+    project: str
+    method: str
+    source_ip: str
+    result_code: int
+    body: str
+    limit: int
+    phase: AuditPhase
+    def __init__(self, uuid: _Optional[str] = ..., to: _Optional[_Union[datetime.datetime, _timestamp_pb2.Timestamp, _Mapping]] = ..., user: _Optional[str] = ..., project: _Optional[str] = ..., method: _Optional[str] = ..., source_ip: _Optional[str] = ..., result_code: _Optional[int] = ..., body: _Optional[str] = ..., limit: _Optional[int] = ..., phase: _Optional[_Union[AuditPhase, str]] = ..., **kwargs) -> None: ...
+
+class AuditServiceListRequest(_message.Message):
+    __slots__ = ("login", "query")
+    LOGIN_FIELD_NUMBER: _ClassVar[int]
+    QUERY_FIELD_NUMBER: _ClassVar[int]
+    login: str
+    query: AuditQuery
+    def __init__(self, login: _Optional[str] = ..., query: _Optional[_Union[AuditQuery, _Mapping]] = ...) -> None: ...
+
+class AuditServiceListResponse(_message.Message):
+    __slots__ = ("traces",)
+    TRACES_FIELD_NUMBER: _ClassVar[int]
+    traces: _containers.RepeatedCompositeFieldContainer[AuditTrace]
+    def __init__(self, traces: _Optional[_Iterable[_Union[AuditTrace, _Mapping]]] = ...) -> None: ...
+
+class AuditServiceGetRequest(_message.Message):
+    __slots__ = ("login", "uuid", "phase")
+    LOGIN_FIELD_NUMBER: _ClassVar[int]
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    PHASE_FIELD_NUMBER: _ClassVar[int]
+    login: str
+    uuid: str
+    phase: AuditPhase
+    def __init__(self, login: _Optional[str] = ..., uuid: _Optional[str] = ..., phase: _Optional[_Union[AuditPhase, str]] = ...) -> None: ...
+
+class AuditServiceGetResponse(_message.Message):
+    __slots__ = ("trace",)
+    TRACE_FIELD_NUMBER: _ClassVar[int]
+    trace: AuditTrace
+    def __init__(self, trace: _Optional[_Union[AuditTrace, _Mapping]] = ...) -> None: ...
diff --git a/python/metalstack/client/client.py b/python/metalstack/client/client.py
index 8bc3365e..9f15fc31 100755
--- a/python/metalstack/client/client.py
+++ b/python/metalstack/client/client.py
@@ -2,6 +2,7 @@
 
 import pyqwest
 
+import metalstack.admin.v2.audit_connect as admin_audit_connect
 import metalstack.admin.v2.component_connect as admin_component_connect
 import metalstack.admin.v2.filesystem_connect as admin_filesystem_connect
 import metalstack.admin.v2.image_connect as admin_image_connect
@@ -19,6 +20,7 @@
 import metalstack.admin.v2.token_connect as admin_token_connect
 import metalstack.admin.v2.vpn_connect as admin_vpn_connect
 
+import metalstack.api.v2.audit_connect as api_audit_connect
 import metalstack.api.v2.filesystem_connect as api_filesystem_connect
 import metalstack.api.v2.health_connect as api_health_connect
 import metalstack.api.v2.image_connect as api_image_connect
@@ -73,6 +75,9 @@ def __init__(self, baseurl: str, client: pyqwest.SyncClient = None):
             self._client = client
 
 
+        def audit(self):
+            return admin_audit_connect.AuditServiceClientSync(address=self._baseurl, http_client=self._client)
+
         def component(self):
             return admin_component_connect.ComponentServiceClientSync(address=self._baseurl, http_client=self._client)
 
@@ -128,6 +133,9 @@ def __init__(self, baseurl: str, client: pyqwest.SyncClient = None):
             self._client = client
 
 
+        def audit(self):
+            return api_audit_connect.AuditServiceClientSync(address=self._baseurl, http_client=self._client)
+
         def filesystem(self):
             return api_filesystem_connect.FilesystemServiceClientSync(address=self._baseurl, http_client=self._client)
 

From 7e792811c8b0abba0ae366341db67081ce3899db Mon Sep 17 00:00:00 2001
From: Gerrit <tirreg91@googlemail.com>
Date: Fri, 20 Mar 2026 10:14:42 +0100
Subject: [PATCH 2/2] Update!

---
 doc/index.html                      | 2 +-
 go/metalstack/api/v2/audit.pb.go    | 2 +-
 js/metalstack/api/v2/audit_pb.d.ts  | 2 +-
 js/metalstack/api/v2/audit_pb.ts    | 2 +-
 proto/metalstack/api/v2/audit.proto | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index f5494335..2cc2b9ba 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -3327,7 +3327,7 @@ <h2 id="metalstack/api/v2/audit.proto">metalstack/api/v2/audit.proto</h2><a href
 
       
         <h3 id="metalstack.api.v2.AuditQuery">AuditQuery</h3>
-        <p>AuditServiceListRequest is the request payload to list audits</p>
+        <p>AuditQuery is the query for audit traces</p>
 
         
           <table class="field-table">
diff --git a/go/metalstack/api/v2/audit.pb.go b/go/metalstack/api/v2/audit.pb.go
index f2cbb681..376cf788 100644
--- a/go/metalstack/api/v2/audit.pb.go
+++ b/go/metalstack/api/v2/audit.pb.go
@@ -203,7 +203,7 @@ func (x *AuditTrace) GetPhase() AuditPhase {
 	return AuditPhase_AUDIT_PHASE_UNSPECIFIED
 }
 
-// AuditServiceListRequest is the request payload to list audits
+// AuditQuery is the query for audit traces
 type AuditQuery struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Uuid of the audit trace
diff --git a/js/metalstack/api/v2/audit_pb.d.ts b/js/metalstack/api/v2/audit_pb.d.ts
index 1530433b..bd437adb 100644
--- a/js/metalstack/api/v2/audit_pb.d.ts
+++ b/js/metalstack/api/v2/audit_pb.d.ts
@@ -78,7 +78,7 @@ export type AuditTrace = Message<"metalstack.api.v2.AuditTrace"> & {
  */
 export declare const AuditTraceSchema: GenMessage<AuditTrace>;
 /**
- * AuditServiceListRequest is the request payload to list audits
+ * AuditQuery is the query for audit traces
  *
  * @generated from message metalstack.api.v2.AuditQuery
  */
diff --git a/js/metalstack/api/v2/audit_pb.ts b/js/metalstack/api/v2/audit_pb.ts
index 4d586060..38adf518 100644
--- a/js/metalstack/api/v2/audit_pb.ts
+++ b/js/metalstack/api/v2/audit_pb.ts
@@ -102,7 +102,7 @@ export const AuditTraceSchema: GenMessage<AuditTrace> = /*@__PURE__*/
   messageDesc(file_metalstack_api_v2_audit, 0);
 
 /**
- * AuditServiceListRequest is the request payload to list audits
+ * AuditQuery is the query for audit traces
  *
  * @generated from message metalstack.api.v2.AuditQuery
  */
diff --git a/proto/metalstack/api/v2/audit.proto b/proto/metalstack/api/v2/audit.proto
index ac31e0b1..8d5bdb22 100644
--- a/proto/metalstack/api/v2/audit.proto
+++ b/proto/metalstack/api/v2/audit.proto
@@ -55,7 +55,7 @@ message AuditTrace {
   AuditPhase phase = 10;
 }
 
-// AuditServiceListRequest is the request payload to list audits
+// AuditQuery is the query for audit traces
 message AuditQuery {
   // Uuid of the audit trace
   optional string uuid = 2 [(buf.validate.field).string.uuid = true];