Seeing what a connection has done

Every request a connection makes is recorded: when, what it asked for, whether it was allowed, and how many changes it made. There are two views of this, and which one you get depends on your role.

Your own connections

On your profile, beside each key, Activity. This is available to anybody who can hold a key, and shows that key’s requests only.

Use it to answer “what has this assistant actually been doing” — particularly after a session where you are not sure a job completed.

Every connection on the site

If you run the site, the same screen offers Everything done through any key. This is the one that matters for accountability, because it includes keys you did not create — held by instructors, including instructors who have since left.

Each line says whose connection it was. That matters: “forty lessons rewritten” is not useful information without a name attached to it.

It opens with four figures for the last day:

• Calls — how many requests were made at all.
• Changes written — the number that tells you whether anything actually happened.
• Refused — requests turned away, usually a limit or a rule.
• Failed sign-ins — counted separately, because this is the only one of the four that might mean somebody is trying keys that are not theirs.

A hundred lines of detail do not answer “is anything wrong here”. Those four figures do.

How long it is kept

Thirty days. This record answers “what did that thing just do”, which is a question asked within days of it happening or not at all.

An empty list does not mean nothing happened — it may mean it happened more than thirty days ago. The screen says so.

What we watch for, and will tell you about

Two things raise an alert to Grapevine without anybody having to look:

• One key being refused over and over. The ordinary explanation is something still holding a key that was revoked or has expired — which looks exactly like an attack and is not one. We will ask you to revoke it and issue a new one.
• Many different key names being tried. That is somebody guessing, rather than a connection of yours getting something wrong. Nothing is compromised by it on its own — a wrong key is refused — but we would rather know.

If you see something in the record you did not ask for, revoke that key first and ask questions afterwards. Revoking takes effect on the next request and costs you nothing but a minute to issue a new one.