# Operations and audit

URL: https://docs.spacerun.co/docs/platform/guides/operations-and-audit

> Inspect incidents and audit events, manage maintenance, export CSV, and read per-item results.

Prerequisites: staff keys declared by each operation (for example `ops.read`, `ops.panic`, `users.read`) and [apiRequest](https://docs.spacerun.co/docs/platform/guides/quickstart). Authentication succeeds independently of authorization; consult the operation's permission list.

## Investigate a change or incident

Read [listAuditEvents](https://docs.spacerun.co/docs/platform/reference/audit-log/listAuditEvents) with the documented actor/action/date filters. Include the `x-request-id` from the affected API response when reporting a problem. Use operations status and incidents to distinguish runtime dependency failure from platform maintenance. Stats endpoints provide aggregate views, not an event replay log.

The user CSV export shares user-list filters but exports only the first 100 matches and ignores page/per_page. Download it rather than parsing JSON:

```bash
curl 'https://api.example.com/v1/admin/users/export.csv' \
  -H "Authorization: Bearer $ACCESS_TOKEN" -o users.csv
```

See [exportAdminUsersCsv](https://docs.spacerun.co/docs/platform/reference/users/exportAdminUsersCsv). The response content type is `text/csv` with an attachment filename. Bulk user mutations return 200 with per-user results; inspect each item's error instead of treating 200 as all-or-nothing success.

## Manage maintenance

[getOpsStatus](https://docs.spacerun.co/docs/platform/reference/operations/getOpsStatus) exposes the current state. [setOpsPanicMode](https://docs.spacerun.co/docs/platform/reference/operations/setOpsPanicMode) requires `ops.panic`. To request degraded mode for a planned maintenance window:

```ts
const state = await apiRequest("/v1/admin/ops/panic", {
  method: "POST", body: JSON.stringify({ level: "degraded", reason: "Planned maintenance window" }),
});
console.log(state.panic);
```

`degraded` blocks new user checkout and game starts. `lockdown` blocks other public/user writes as well. Reads, staff routes and the user's session-stop operation stay available. To end maintenance, set `level: "off"` with a reason. Blocked requests return 503 `panic_mode` plus `Retry-After: 30`; an unavailable external dependency has a different error body.

## Alerts and jobs

Alert subscriptions specify roles, severity and incident/panic event types. Test alert delivery before relying on it, then inspect incident history for the result. Notification broadcasts can target a segment and contain in-app and/or email channels; `announcements.write` or `email.send` is accepted at the route gate, with channel rules in the implementation/reference.

System cron operations require their own permissions. Inspect a job before toggling or running it, and treat a trigger response as job acceptance rather than proof of all downstream work completing. [Errors and limits](https://docs.spacerun.co/docs/platform/guides/errors-pagination-limits) covers recovery and maintenance behavior.