diff --git a/fluxer_admin/openapi-admin.json b/fluxer_admin/openapi-admin.json
index cabb1d7f6..c7ce00df7 100644
--- a/fluxer_admin/openapi-admin.json
+++ b/fluxer_admin/openapi-admin.json
@@ -933,6 +933,22 @@
 						},
 						"description": "Filter by target entity ID (user, channel, role, invite code, etc.)"
 					},
+					{
+						"name": "access",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"description": "Only return entries recorded by reads or only entries recorded by writes",
+							"x-enumNames": ["read", "write"],
+							"x-enumDescriptions": [
+								"An entry recorded by an operation that only reads data",
+								"An entry recorded by an operation that changes data or triggers work"
+							],
+							"enum": ["read", "write"],
+							"type": "string"
+						},
+						"description": "Only return entries recorded by reads or only entries recorded by writes"
+					},
 					{
 						"name": "sort_by",
 						"in": "query",
@@ -12627,6 +12643,16 @@
 						}
 					},
 					"action": {"type": "string", "minLength": 1, "maxLength": 256},
+					"access": {
+						"description": "Whether the recorded operation read data or changed it",
+						"x-enumNames": ["read", "write"],
+						"x-enumDescriptions": [
+							"An entry recorded by an operation that only reads data",
+							"An entry recorded by an operation that changes data or triggers work"
+						],
+						"enum": ["read", "write"],
+						"type": "string"
+					},
 					"audit_log_reason": {"nullable": true, "type": "string", "minLength": 1, "maxLength": 4000},
 					"metadata": {"type": "object", "additionalProperties": {"type": "string", "maxLength": 4000}},
 					"created_at": {"type": "string"}
@@ -12644,6 +12670,7 @@
 					"related_guilds",
 					"related_channels",
 					"action",
+					"access",
 					"audit_log_reason",
 					"metadata",
 					"created_at"
diff --git a/fluxer_admin/src/api/audit.rs b/fluxer_admin/src/api/audit.rs
index b10983402..4add6fb7e 100644
--- a/fluxer_admin/src/api/audit.rs
+++ b/fluxer_admin/src/api/audit.rs
@@ -10,6 +10,7 @@ pub struct SearchAuditLogsParams {
     pub admin_user_id: Option<String>,
     pub target_id: Option<String>,
     pub target_type: Option<String>,
+    pub access: Option<String>,
     pub sort_by: Option<String>,
     pub sort_order: Option<String>,
     pub limit: u32,
@@ -21,6 +22,12 @@ impl AdminApiClient {
         &self,
         params: &SearchAuditLogsParams,
     ) -> ApiResult<AuditLogsListResponse> {
+        let access = params
+            .access
+            .as_deref()
+            .map(audit_access)
+            .transpose()?
+            .map(|value| value.to_string());
         let sort_by = params
             .sort_by
             .as_deref()
@@ -46,6 +53,7 @@ impl AdminApiClient {
                 params.target_type.as_deref().unwrap_or_default(),
             ),
             ("target_id", params.target_id.as_deref().unwrap_or_default()),
+            ("access", access.as_deref().unwrap_or_default()),
             ("sort_by", sort_by.as_deref().unwrap_or_default()),
             ("sort_order", sort_order.as_deref().unwrap_or_default()),
             ("limit", limit.as_str()),
@@ -55,6 +63,11 @@ impl AdminApiClient {
     }
 }
 
+fn audit_access(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsAccess> {
+    generated_types::ListAdminAuditLogsAccess::try_from(value)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
 fn audit_sort_by(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortBy> {
     let value = match value {
         "created_at" => "createdAt",
@@ -83,6 +96,13 @@ mod tests {
         assert_eq!(audit_sort_order("desc").unwrap().to_string(), "desc");
     }
 
+    #[test]
+    fn accepts_only_known_access_filters() {
+        assert_eq!(audit_access("read").unwrap().to_string(), "read");
+        assert_eq!(audit_access("write").unwrap().to_string(), "write");
+        assert!(audit_access("all").is_err());
+    }
+
     #[test]
     fn rejects_lossy_audit_totals() {
         for total in [serde_json::json!(1.5), serde_json::json!(-1)] {
@@ -99,6 +119,7 @@ mod tests {
                 "admin_user_id": "234567890123456789",
                 "admin_user": null,
                 "action": "USER_UPDATE",
+                "access": "write",
                 "target_id": "345678901234567890",
                 "target_type": "user",
                 "target_user": null,
@@ -118,6 +139,26 @@ mod tests {
         assert_eq!(generated.logs[0].action.to_string(), "USER_UPDATE");
 
         let response: AuditLogsListResponse = serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(response.logs[0].access.as_deref(), Some("write"));
         assert_eq!(serde_json::to_value(response).unwrap(), json);
     }
+
+    #[test]
+    fn deserializes_audit_entries_from_an_api_without_access() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "action": "USER_UPDATE",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "audit_log_reason": null,
+                "metadata": {},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let response: AuditLogsListResponse = serde_json::from_value(json).unwrap();
+        assert_eq!(response.logs[0].access, None);
+    }
 }
diff --git a/fluxer_admin/src/api/types/audit.rs b/fluxer_admin/src/api/types/audit.rs
index fa50a27a5..44ef50850 100644
--- a/fluxer_admin/src/api/types/audit.rs
+++ b/fluxer_admin/src/api/types/audit.rs
@@ -9,6 +9,8 @@ pub struct AuditLogEntry {
     #[serde(default)]
     pub admin_user: Option<AuditLogUserSummary>,
     pub action: String,
+    #[serde(default)]
+    pub access: Option<String>,
     pub target_id: String,
     pub target_type: String,
     #[serde(default)]
diff --git a/fluxer_admin/src/routes/guild_tabs.rs b/fluxer_admin/src/routes/guild_tabs.rs
index 619a4c4f0..f64b29cc7 100644
--- a/fluxer_admin/src/routes/guild_tabs.rs
+++ b/fluxer_admin/src/routes/guild_tabs.rs
@@ -121,6 +121,7 @@ pub async fn render(
                     admin_user_id: None,
                     target_id: Some(guild_id.to_owned()),
                     target_type: Some("guild".to_owned()),
+                    access: Some("write".to_owned()),
                     sort_by: Some("created_at".to_owned()),
                     sort_order: Some("desc".to_owned()),
                     limit: 50,
@@ -134,7 +135,7 @@ pub async fn render(
                     @if let Some(resp) = resp {
                         @if resp.logs.is_empty() {
                             p class="text-sm text-neutral-500" {
-                                "No admin audit log entries for this guild."
+                                "No admin write actions have been recorded for this guild."
                             }
                         } @else {
                             (table_container(table(maud::html! {
diff --git a/fluxer_admin/src/routes/system.rs b/fluxer_admin/src/routes/system.rs
index a2048bb04..7db6cd22c 100644
--- a/fluxer_admin/src/routes/system.rs
+++ b/fluxer_admin/src/routes/system.rs
@@ -28,6 +28,7 @@ struct AuditLogsQuery {
     admin_user_id: Option<String>,
     target_id: Option<String>,
     target_type: Option<String>,
+    access: Option<String>,
     sort_by: Option<String>,
     sort_order: Option<String>,
     limit: Option<u32>,
@@ -119,6 +120,7 @@ async fn audit_logs_page(
         admin_user_id: query.admin_user_id.as_deref().unwrap_or(""),
         target_id: query.target_id.as_deref().unwrap_or(""),
         target_type: query.target_type.as_deref().unwrap_or(""),
+        access: query.access.as_deref().unwrap_or(""),
         sort_by: query.sort_by.as_deref().unwrap_or("createdAt"),
         sort_order: query.sort_order.as_deref().unwrap_or("desc"),
         limit,
@@ -131,6 +133,7 @@ async fn audit_logs_page(
         admin_user_id: nonempty(params.admin_user_id),
         target_id: nonempty(params.target_id),
         target_type: nonempty(params.target_type),
+        access: nonempty(params.access),
         sort_by: Some(params.sort_by.to_owned()),
         sort_order: Some(params.sort_order.to_owned()),
         limit,
diff --git a/fluxer_admin/src/routes/user_tabs.rs b/fluxer_admin/src/routes/user_tabs.rs
index 8e40af06e..57bdb7792 100644
--- a/fluxer_admin/src/routes/user_tabs.rs
+++ b/fluxer_admin/src/routes/user_tabs.rs
@@ -245,6 +245,7 @@ pub async fn render(
                     admin_user_id: None,
                     target_id: Some(user_id.to_owned()),
                     target_type: None,
+                    access: Some("write".to_owned()),
                     sort_by: Some("created_at".to_owned()),
                     sort_order: Some("desc".to_owned()),
                     limit,
diff --git a/fluxer_admin/src/templates/components/audit_logs_for_target.rs b/fluxer_admin/src/templates/components/audit_logs_for_target.rs
index 3d65b70e2..30d3adc52 100644
--- a/fluxer_admin/src/templates/components/audit_logs_for_target.rs
+++ b/fluxer_admin/src/templates/components/audit_logs_for_target.rs
@@ -72,7 +72,7 @@ pub fn audit_logs_for_target(
     let total_pages = total.div_ceil(u64::from(PAGE_SIZE)).max(1);
     let page_number = u64::from(current_page) + 1;
     let all_logs_href = format!(
-        "{base_path}/audit-logs?target_id={}",
+        "{base_path}/audit-logs?target_id={}&access=write",
         urlencoding::encode(target_id)
     );
 
@@ -94,7 +94,7 @@ pub fn audit_logs_for_target(
                     }
                 }
                 @if entries.is_empty() {
-                    (empty_state("No admin actions have been recorded against this entity."))
+                    (empty_state("No admin write actions have been recorded against this entity."))
                 } @else {
                     (table_container(html! {
                         (table(html! {
diff --git a/fluxer_admin/src/templates/pages/audit_logs.rs b/fluxer_admin/src/templates/pages/audit_logs.rs
index ca57921c2..c9bdc09d1 100644
--- a/fluxer_admin/src/templates/pages/audit_logs.rs
+++ b/fluxer_admin/src/templates/pages/audit_logs.rs
@@ -22,6 +22,7 @@ pub struct AuditLogsParams<'a> {
     pub admin_user_id: &'a str,
     pub target_id: &'a str,
     pub target_type: &'a str,
+    pub access: &'a str,
     pub sort_by: &'a str,
     pub sort_order: &'a str,
     pub limit: u32,
@@ -42,6 +43,11 @@ fn filters_section(base: &str, params: &AuditLogsParams<'_>) -> Markup {
         ("file_sha", "File SHA"),
         ("email", "Email"),
     ];
+    let access_options: &[(&str, &str)] = &[
+        ("", "All entries"),
+        ("write", "Writes only"),
+        ("read", "Reads only"),
+    ];
     let sort_options: &[(&str, &str)] = &[("createdAt", "Created at"), ("relevance", "Relevance")];
     let order_options: &[(&str, &str)] = &[("desc", "Newest first"), ("asc", "Oldest first")];
     let limit_options: &[(&str, &str)] =
@@ -60,6 +66,7 @@ fn filters_section(base: &str, params: &AuditLogsParams<'_>) -> Markup {
                     "Filter by admin user ID..."))
                 (select_input("target_type", "Target type",
                     target_type_options, params.target_type))
+                (select_input("access", "Access", access_options, params.access))
                 (select_input("sort_by", "Sort by", sort_options, params.sort_by))
                 (select_input("sort_order", "Order", order_options, params.sort_order))
                 (select_input("limit", "Page size", limit_options, &limit_str))
@@ -81,6 +88,7 @@ fn build_pagination_url(base: &str, page: u32, params: &AuditLogsParams<'_>) ->
             ("admin_user_id", params.admin_user_id),
             ("target_id", params.target_id),
             ("target_type", params.target_type),
+            ("access", params.access),
             ("sort_by", params.sort_by),
             ("sort_order", params.sort_order),
         ]
@@ -169,6 +177,7 @@ mod tests {
             admin_user_id: "",
             target_id: "",
             target_type: "bulk_job",
+            access: "",
             sort_by: "createdAt",
             sort_order: "desc",
             limit: 50,
@@ -176,5 +185,28 @@ mod tests {
         };
         let markup = filters_section("/admin", &params).into_string();
         assert!(markup.contains(r#"<option value="bulk_job" selected>Bulk job</option>"#));
+        assert!(markup.contains(r#"<option value="" selected>All entries</option>"#));
+    }
+
+    #[test]
+    fn access_filter_survives_form_and_pagination() {
+        let params = AuditLogsParams {
+            query: "",
+            admin_user_id: "",
+            target_id: "1500000000000000001",
+            target_type: "",
+            access: "read",
+            sort_by: "createdAt",
+            sort_order: "desc",
+            limit: 50,
+            current_page: 0,
+        };
+        let markup = filters_section("/admin", &params).into_string();
+        assert!(markup.contains(r#"<select id="access" name="access""#));
+        assert!(markup.contains(r#"<option value="read" selected>Reads only</option>"#));
+        assert_eq!(
+            build_pagination_url("/admin", 1, &params),
+            "/admin/audit-logs?page=1&target_id=1500000000000000001&access=read&sort_by=createdAt&sort_order=desc&limit=50"
+        );
     }
 }
diff --git a/fluxer_admin/tests/api_deserialization.rs b/fluxer_admin/tests/api_deserialization.rs
index 23255dd5b..67ec233e3 100644
--- a/fluxer_admin/tests/api_deserialization.rs
+++ b/fluxer_admin/tests/api_deserialization.rs
@@ -230,6 +230,7 @@ fn deserialize_audit_logs_response() {
                 "target_type": "user",
                 "target_id": "1130958221824557056",
                 "action": "list_user_sessions",
+                "access": "read",
                 "audit_log_reason": null,
                 "metadata": {"session_count": "3"},
                 "created_at": "2026-05-26T13:21:47.138Z"
@@ -243,6 +244,7 @@ fn deserialize_audit_logs_response() {
     assert_eq!(resp.logs.len(), 1);
     assert_eq!(resp.logs[0].log_id, "1508822460457747580");
     assert_eq!(resp.logs[0].action, "list_user_sessions");
+    assert_eq!(resp.logs[0].access.as_deref(), Some("read"));
     assert_eq!(resp.logs[0].target_type, "user");
     assert!(resp.logs[0].audit_log_reason.is_none());
     assert_eq!(resp.logs[0].metadata.get("session_count").unwrap(), "3");
diff --git a/fluxer_admin/tests/htmx_acceptance.rs b/fluxer_admin/tests/htmx_acceptance.rs
index eb152d644..877793c3b 100644
--- a/fluxer_admin/tests/htmx_acceptance.rs
+++ b/fluxer_admin/tests/htmx_acceptance.rs
@@ -168,6 +168,39 @@ async fn detail_tab_routes_return_layout_or_fragments_by_route_shape() {
     }
 }
 
+#[tokio::test]
+async fn target_audit_log_tabs_request_write_entries_only() {
+    let app = setup().await;
+    for path in [
+        "/users/1500000000000000001/tabs/audit_logs",
+        "/guilds/1600000000000000001/tabs/audit_logs",
+    ] {
+        let fragment = get(&app, path, &[]).await;
+        assert!(fragment.contains("Temp ban"), "{path}\n{fragment}");
+        assert!(!fragment.contains("Get user"), "{path}\n{fragment}");
+    }
+}
+
+#[tokio::test]
+async fn audit_log_page_forwards_the_access_filter() {
+    let app = setup().await;
+    let all = get(&app, "/audit-logs", &[]).await;
+    assert!(all.contains("Temp ban"), "{all}");
+    assert!(all.contains("Get user"), "{all}");
+    assert!(
+        all.contains(r#"<option value="" selected>All entries</option>"#),
+        "{all}"
+    );
+
+    let reads = get(&app, "/audit-logs?access=read", &[]).await;
+    assert!(reads.contains("Get user"), "{reads}");
+    assert!(!reads.contains("Temp ban"), "{reads}");
+    assert!(
+        reads.contains(r#"<option value="read" selected>Reads only</option>"#),
+        "{reads}"
+    );
+}
+
 #[tokio::test]
 async fn report_routes_keep_layout_and_fragment_contract() {
     let app = setup().await;
@@ -844,6 +877,25 @@ async fn mock_api(method: Method, uri: Uri) -> Response {
             json_response(instance_config_without_pending_registrations())
         }
         (Method::GET, "/admin/limit-config") => json_response(limit_config()),
+        (Method::GET, "/admin/audit-logs") => {
+            let access = uri.query().and_then(|query| {
+                url::form_urlencoded::parse(query.as_bytes())
+                    .find(|(key, _)| key == "access")
+                    .map(|(_, value)| value.into_owned())
+            });
+            let logs = [
+                audit_log_entry("1900000000000000101", "get_user", "read"),
+                audit_log_entry("1900000000000000102", "temp_ban", "write"),
+            ]
+            .into_iter()
+            .filter(|entry| {
+                access
+                    .as_deref()
+                    .is_none_or(|access| entry.access.to_string() == access)
+            })
+            .collect::<Vec<_>>();
+            json_response(json!({ "total": logs.len(), "logs": logs }))
+        }
         _ => (StatusCode::NOT_FOUND, Json(json!({ "error": "not found" }))).into_response(),
     }
 }
@@ -975,6 +1027,32 @@ fn guild_fixtures_match_generated_response_contracts() {
     assert_eq!(detail.member_count, 12);
 }
 
+fn audit_log_entry(
+    log_id: &str,
+    action: &str,
+    access: &str,
+) -> generated_types::AdminAuditLogResponseSchema {
+    serde_json::from_value(json!({
+        "log_id": log_id,
+        "admin_user_id": "1500000000000000000",
+        "admin_user": null,
+        "target_type": "user",
+        "target_id": "1500000000000000001",
+        "target_user": null,
+        "target_guild": null,
+        "target_channel": null,
+        "related_users": {},
+        "related_guilds": {},
+        "related_channels": {},
+        "action": action,
+        "access": access,
+        "audit_log_reason": null,
+        "metadata": {},
+        "created_at": "2026-09-16T12:00:00.000Z"
+    }))
+    .expect("audit log fixture must match the generated response contract")
+}
+
 fn searched_application() -> Value {
     json!({
         "id": "1700000000000000001",
diff --git a/fluxer_api/pkgs/elasticsearch_search/src/adapters/ElasticsearchAuditLogAdapter.ts b/fluxer_api/pkgs/elasticsearch_search/src/adapters/ElasticsearchAuditLogAdapter.ts
index 22e3ce7db..848e5d33a 100644
--- a/fluxer_api/pkgs/elasticsearch_search/src/adapters/ElasticsearchAuditLogAdapter.ts
+++ b/fluxer_api/pkgs/elasticsearch_search/src/adapters/ElasticsearchAuditLogAdapter.ts
@@ -6,7 +6,7 @@ import type {AuditLogSearchFilters, SearchableAuditLog} from '@fluxer/schema/src
 import type {ElasticsearchDistributedLock} from '@pkgs/elasticsearch_search/src/adapters/ElasticsearchIndexAdapter';
 import {ElasticsearchIndexAdapter} from '@pkgs/elasticsearch_search/src/adapters/ElasticsearchIndexAdapter';
 import type {ElasticsearchFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
-import {compactFilters, esTermFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
+import {compactFilters, esTermFilter, esTermsFilter} from '@pkgs/elasticsearch_search/src/ElasticsearchFilterUtils';
 import {ELASTICSEARCH_INDEX_DEFINITIONS} from '@pkgs/elasticsearch_search/src/ElasticsearchIndexDefinitions';
 
 function buildAuditLogFilters(filters: AuditLogSearchFilters): Array<ElasticsearchFilter | undefined> {
@@ -15,6 +15,10 @@ function buildAuditLogFilters(filters: AuditLogSearchFilters): Array<Elasticsear
 	if (filters.targetType) clauses.push(esTermFilter('targetType', filters.targetType));
 	if (filters.targetId) clauses.push(esTermFilter('targetId', filters.targetId));
 	if (filters.action) clauses.push(esTermFilter('action', filters.action));
+	if (filters.actions && filters.actions.length > 0) clauses.push(esTermsFilter('action.keyword', filters.actions));
+	if (filters.excludeActions && filters.excludeActions.length > 0) {
+		clauses.push({bool: {must_not: [esTermsFilter('action.keyword', filters.excludeActions)]}});
+	}
 	return compactFilters(clauses);
 }
 
diff --git a/fluxer_api/src/api/admin/AdminAuditActions.ts b/fluxer_api/src/api/admin/AdminAuditActions.ts
new file mode 100644
index 000000000..e84f20a4c
--- /dev/null
+++ b/fluxer_api/src/api/admin/AdminAuditActions.ts
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {ValueOf} from '@fluxer/constants/src/ValueOf';
+import type {AdminAuditAccess} from '@fluxer/schema/src/domains/admin/AdminSchemas';
+
+export const AdminAuditReadActions = {
+	CHECK_BLOCKLIST_ENTRY: 'check_blocklist_entry',
+	GET_ADMIN_API_KEY: 'get_admin_api_key',
+	GET_APPLICATION: 'get_application',
+	GET_ARCHIVE: 'get_archive',
+	GET_ARCHIVE_DOWNLOAD_URL: 'get_archive_download_url',
+	GET_AUDIT_LOG: 'get_audit_log',
+	GET_GATEWAY_STATS: 'get_gateway_stats',
+	GET_GUILD: 'get_guild',
+	GET_INSTANCE_CONFIG: 'get_instance_config',
+	GET_LIMIT_CONFIG: 'get_limit_config',
+	GET_MESSAGE: 'get_message',
+	GET_MESSAGE_SHRED_STATUS: 'get_message_shred_status',
+	GET_REPORT: 'get_report',
+	GET_USER: 'get_user',
+	GET_VOICE_REGION: 'get_voice_region',
+	GET_VOICE_SERVER: 'get_voice_server',
+	GET_VOICE_STATE_COUNTS: 'get_voice_state_counts',
+	LIST_ADMIN_ACLS: 'list_admin_acls',
+	LIST_ADMIN_API_KEYS: 'list_admin_api_keys',
+	LIST_ARCHIVES: 'list_archives',
+	LIST_AUDIT_LOGS: 'list_audit_logs',
+	LIST_BLOCKLIST_ENTRIES: 'list_blocklist_entries',
+	LIST_BLOCKLISTS: 'list_blocklists',
+	LIST_CHANNEL_MESSAGES: 'list_channel_messages',
+	LIST_DISCOVERY_APPLICATIONS: 'list_discovery_applications',
+	LIST_DISCOVERY_CATEGORIES: 'list_discovery_categories',
+	LIST_DISCOVERY_CATEGORY_LISTINGS: 'list_discovery_category_listings',
+	LIST_DISCOVERY_LISTINGS: 'list_discovery_listings',
+	LIST_GUILD_APPLICATIONS: 'list_guild_applications',
+	LIST_GUILD_AUDIT_LOGS: 'list_guild_audit_logs',
+	LIST_GUILD_EMOJIS: 'list_guild_emojis',
+	LIST_GUILD_MEMBERS: 'list_guild_members',
+	LIST_GUILD_MEMORY_STATS: 'list_guild_memory_stats',
+	LIST_GUILD_STICKERS: 'list_guild_stickers',
+	LIST_USER_APPLICATIONS: 'list_user_applications',
+	LIST_USER_CHANGE_LOG: 'list_user_change_log',
+	LIST_USER_DM_CHANNELS: 'list_user_dm_channels',
+	LIST_USER_GUILDS: 'list_user_guilds',
+	LIST_USER_RELATIONSHIPS: 'list_user_relationships',
+	LIST_USER_SESSIONS: 'list_user_sessions',
+	LIST_VOICE_REGIONS: 'list_voice_regions',
+	LIST_VOICE_SERVERS: 'list_voice_servers',
+	LIST_WEBAUTHN_CREDENTIALS: 'list_webauthn_credentials',
+	SEARCH_AUDIT_LOGS: 'search_audit_logs',
+	SEARCH_GUILDS: 'search_guilds',
+	SEARCH_MESSAGES: 'search_messages',
+	SEARCH_REPORTS: 'search_reports',
+	SEARCH_USERS: 'search_users',
+} as const;
+
+export type AdminAuditReadAction = ValueOf<typeof AdminAuditReadActions>;
+
+export const ADMIN_AUDIT_READ_ACTIONS: ReadonlyArray<AdminAuditReadAction> = Object.values(AdminAuditReadActions);
+
+const READ_ACTION_SET: ReadonlySet<string> = new Set(ADMIN_AUDIT_READ_ACTIONS);
+
+export function getAdminAuditAccess(action: string): AdminAuditAccess {
+	return READ_ACTION_SET.has(action) ? 'read' : 'write';
+}
diff --git a/fluxer_api/src/api/admin/AdminAuditRecorder.ts b/fluxer_api/src/api/admin/AdminAuditRecorder.ts
new file mode 100644
index 000000000..a00501893
--- /dev/null
+++ b/fluxer_api/src/api/admin/AdminAuditRecorder.ts
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditReadAction} from '@app/api/admin/AdminAuditActions';
+import type {HonoEnv} from '@app/api/types/HonoEnv';
+import type {Context} from 'hono';
+
+type AdminAuditMetadataValue = string | number | bigint | boolean | null | undefined;
+
+type AdminAuditMetadataInput = Readonly<Record<string, AdminAuditMetadataValue>>;
+
+interface AdminAuditEntryInput<TAction extends string> {
+	targetType: string;
+	targetId: bigint;
+	action: TAction;
+	metadata?: AdminAuditMetadataInput;
+}
+
+const SNOWFLAKE_PATTERN = /^(0|[1-9][0-9]{0,19})$/;
+
+export function snowflakeOrUndefined(value: string | undefined): string | undefined {
+	return value !== undefined && SNOWFLAKE_PATTERN.test(value) ? value : undefined;
+}
+
+function toAdminAuditMetadata(input: AdminAuditMetadataInput = {}): Map<string, string> {
+	const metadata = new Map<string, string>();
+	for (const [key, value] of Object.entries(input)) {
+		if (value === undefined || value === null) continue;
+		metadata.set(key, String(value));
+	}
+	return metadata;
+}
+
+async function recordAdminAuditEntry(ctx: Context<HonoEnv>, entry: AdminAuditEntryInput<string>): Promise<void> {
+	await ctx.get('adminService').auditService.createAuditLog({
+		adminUserId: ctx.get('adminUserId'),
+		targetType: entry.targetType,
+		targetId: entry.targetId,
+		action: entry.action,
+		auditLogReason: ctx.get('auditLogReason'),
+		metadata: toAdminAuditMetadata(entry.metadata),
+	});
+}
+
+export async function recordAdminRead(
+	ctx: Context<HonoEnv>,
+	entry: AdminAuditEntryInput<AdminAuditReadAction>,
+): Promise<void> {
+	await recordAdminAuditEntry(ctx, entry);
+}
+
+export async function recordAdminWrite(ctx: Context<HonoEnv>, entry: AdminAuditEntryInput<string>): Promise<void> {
+	await recordAdminAuditEntry(ctx, entry);
+}
diff --git a/fluxer_api/src/api/admin/controllers/AdminApiKeyAdminController.ts b/fluxer_api/src/api/admin/controllers/AdminApiKeyAdminController.ts
index 8f2006ffe..f7d9310b7 100644
--- a/fluxer_api/src/api/admin/controllers/AdminApiKeyAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/AdminApiKeyAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import type {AdminApiKeyView} from '@app/api/admin/services/AdminApiKeyService';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -62,6 +64,15 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 				expires_at: result.apiKey.expiresAt?.toISOString() ?? null,
 				acls: Array.from(result.apiKey.acls),
 			};
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: BigInt(result.apiKey.keyId),
+				action: 'create_admin_api_key',
+				metadata: {
+					acls: response.acls.join(','),
+					expires_in_days: request.expires_in_days,
+				},
+			});
 			return ctx.json(response);
 		},
 	);
@@ -84,6 +95,12 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keys = await adminApiKeyService.listKeys(user.id);
 			const response: Array<ListAdminApiKeyResponseType> = keys.map(toApiKeyResponse);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_api_key',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ADMIN_API_KEYS,
+				metadata: {result_count: response.length},
+			});
 			return ctx.json(response);
 		},
 	);
@@ -107,6 +124,11 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keyId = ctx.req.valid('param').key_id;
 			const key = await adminApiKeyService.getKey(keyId, user.id);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: AdminAuditReadActions.GET_ADMIN_API_KEY,
+			});
 			return ctx.json(toApiKeyResponse(key));
 		},
 	);
@@ -131,8 +153,19 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const keyId = ctx.req.valid('param').key_id;
-			const key = await adminApiKeyService.updateKey(keyId, user.id, ctx.req.valid('json'), adminUserAcls);
-			return ctx.json(toApiKeyResponse(key));
+			const request = ctx.req.valid('json');
+			const key = await adminApiKeyService.updateKey(keyId, user.id, request, adminUserAcls);
+			const response = toApiKeyResponse(key);
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: 'update_admin_api_key',
+				metadata: {
+					fields: (['name', 'acls'] as const).filter((field) => request[field] !== undefined).join(','),
+					acls: request.acls !== undefined ? response.acls.join(',') : undefined,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
@@ -155,6 +188,11 @@ export function AdminApiKeyAdminController(app: HonoApp) {
 			const user = ctx.get('user');
 			const keyId = ctx.req.valid('param').key_id;
 			await adminApiKeyService.revokeKey(keyId, user.id);
+			await recordAdminWrite(ctx, {
+				targetType: 'admin_api_key',
+				targetId: keyId,
+				action: 'revoke_admin_api_key',
+			});
 			return ctx.json({success: true}, 200);
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/ApplicationAdminController.ts b/fluxer_api/src/api/admin/controllers/ApplicationAdminController.ts
index bbfceaa2a..3406431a9 100644
--- a/fluxer_api/src/api/admin/controllers/ApplicationAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/ApplicationAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createApplicationID, createGuildID, createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -50,11 +52,25 @@ export function ApplicationAdminController(app: HonoApp) {
 			}
 			if (guildId != null) {
 				requireRequestAdminACL(ctx.get('adminUserAcls'), AdminACLs.APPLICATION_LOOKUP);
-				return ctx.json(await adminService.applicationService.listGuildApplications(createGuildID(guildId)));
+				const response = await adminService.applicationService.listGuildApplications(createGuildID(guildId));
+				await recordAdminRead(ctx, {
+					targetType: 'guild',
+					targetId: guildId,
+					action: AdminAuditReadActions.LIST_GUILD_APPLICATIONS,
+					metadata: {application_count: response.applications.length},
+				});
+				return ctx.json(response);
 			}
 			if (ownerId != null) {
 				requireRequestAdminACL(ctx.get('adminUserAcls'), AdminACLs.APPLICATION_LIST_BY_OWNER);
-				return ctx.json(await adminService.applicationService.listUserApplications(createUserID(ownerId)));
+				const response = await adminService.applicationService.listUserApplications(createUserID(ownerId));
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: ownerId,
+					action: AdminAuditReadActions.LIST_USER_APPLICATIONS,
+					metadata: {application_count: response.applications.length},
+				});
+				return ctx.json(response);
 			}
 			throw InputValidationError.create('owner_id', 'One of owner_id and guild_id is required');
 		},
@@ -76,7 +92,14 @@ export function ApplicationAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const userId = createUserID(ctx.req.valid('param').user_id);
-			return ctx.json(await adminService.applicationService.listUserApplications(userId));
+			const response = await adminService.applicationService.listUserApplications(userId);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_APPLICATIONS,
+				metadata: {application_count: response.applications.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -97,7 +120,18 @@ export function ApplicationAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const applicationId = createApplicationID(ctx.req.valid('param').application_id);
-			return ctx.json(await adminService.applicationService.lookupApplication(applicationId));
+			const response = await adminService.applicationService.lookupApplication(applicationId);
+			await recordAdminRead(ctx, {
+				targetType: 'application',
+				targetId: applicationId,
+				action: AdminAuditReadActions.GET_APPLICATION,
+				metadata: {
+					found: response.application !== null,
+					owner_user_id: response.application?.owner_user_id,
+					bot_user_id: response.application?.bot_user_id,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
diff --git a/fluxer_api/src/api/admin/controllers/ArchiveAdminController.ts b/fluxer_api/src/api/admin/controllers/ArchiveAdminController.ts
index cf001cba1..cca12a4e2 100644
--- a/fluxer_api/src/api/admin/controllers/ArchiveAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/ArchiveAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID, createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -66,11 +68,15 @@ export function ArchiveAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminUserId = ctx.get('adminUserId');
-			const result = await adminArchiveService.triggerUserArchive(
-				createUserID(ctx.req.valid('param').user_id),
-				adminUserId,
-				ctx.req.valid('json').include_attachments,
-			);
+			const userId = createUserID(ctx.req.valid('param').user_id);
+			const includeAttachments = ctx.req.valid('json').include_attachments;
+			const result = await adminArchiveService.triggerUserArchive(userId, adminUserId, includeAttachments);
+			await recordAdminWrite(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: 'trigger_user_archive',
+				metadata: {archive_id: result.archive_id, include_attachments: includeAttachments},
+			});
 			return ctx.json(result, 200);
 		},
 	);
@@ -93,11 +99,15 @@ export function ArchiveAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminUserId = ctx.get('adminUserId');
-			const result = await adminArchiveService.triggerGuildArchive(
-				createGuildID(ctx.req.valid('param').guild_id),
-				adminUserId,
-				ctx.req.valid('json').include_attachments,
-			);
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const includeAttachments = ctx.req.valid('json').include_attachments;
+			const result = await adminArchiveService.triggerGuildArchive(guildId, adminUserId, includeAttachments);
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'trigger_guild_archive',
+				metadata: {archive_id: result.archive_id, include_attachments: includeAttachments},
+			});
 			return ctx.json(result, 200);
 		},
 	);
@@ -120,13 +130,28 @@ export function ArchiveAdminController(app: HonoApp) {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
+			const subjectType = resolveListSubjectType(adminAcls, query.subject_type);
 			const result = await adminArchiveService.listArchives({
-				subjectType: resolveListSubjectType(adminAcls, query.subject_type),
+				subjectType,
 				subjectId: query.subject_id ?? undefined,
 				requestedBy: query.requested_by ?? undefined,
 				limit: query.limit,
 				includeExpired: query.include_expired,
 			});
+			await recordAdminRead(ctx, {
+				targetType: 'archive',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ARCHIVES,
+				metadata: {
+					subject_type: subjectType,
+					subject_user_id: subjectType === 'user' ? query.subject_id : undefined,
+					subject_guild_id: subjectType === 'guild' ? query.subject_id : undefined,
+					requested_by_user_id: query.requested_by,
+					limit: query.limit,
+					include_expired: query.include_expired,
+					result_count: result.length,
+				},
+			});
 			return ctx.json({archives: result}, 200);
 		},
 	);
@@ -151,6 +176,12 @@ export function ArchiveAdminController(app: HonoApp) {
 			const params = ctx.req.valid('param');
 			requireArchiveSubjectAccess(adminAcls, params.subject_type);
 			const archive = await adminArchiveService.getArchive(params.subject_type, params.subject_id, params.archive_id);
+			await recordAdminRead(ctx, {
+				targetType: params.subject_type,
+				targetId: params.subject_id,
+				action: AdminAuditReadActions.GET_ARCHIVE,
+				metadata: {archive_id: params.archive_id, found: archive !== null},
+			});
 			return ctx.json({archive}, 200);
 		},
 	);
@@ -179,6 +210,12 @@ export function ArchiveAdminController(app: HonoApp) {
 				params.subject_id,
 				params.archive_id,
 			);
+			await recordAdminRead(ctx, {
+				targetType: params.subject_type,
+				targetId: params.subject_id,
+				action: AdminAuditReadActions.GET_ARCHIVE_DOWNLOAD_URL,
+				metadata: {archive_id: params.archive_id},
+			});
 			return ctx.json(result, 200);
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/AuditLogAdminController.ts b/fluxer_api/src/api/admin/controllers/AuditLogAdminController.ts
index 5c8e2db71..29b080fd3 100644
--- a/fluxer_api/src/api/admin/controllers/AuditLogAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/AuditLogAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, snowflakeOrUndefined} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -16,6 +18,8 @@ import {
 	ListAdminAuditLogsQuery,
 } from '@fluxer/schema/src/domains/admin/AdminSchemas';
 
+const AUDIT_TARGET_TYPE_PATTERN = /^[a-z][a-z_]{0,63}$/;
+
 export function AuditLogAdminController(app: HonoApp) {
 	app.get(
 		'/admin/audit-logs',
@@ -34,24 +38,50 @@ export function AuditLogAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			const {q, admin_user_id, target_type, target_id, sort_by, sort_order, limit, offset} = ctx.req.valid('query');
-			if (q === undefined) {
-				return ctx.json(
-					await adminService.auditService.listAuditLogs({admin_user_id, target_type, target_id, limit, offset}),
-				);
-			}
-			return ctx.json(
-				await adminService.auditService.searchAuditLogs({
-					query: q,
-					admin_user_id,
-					target_type,
-					target_id,
-					sort_by,
-					sort_order,
+			const {q, admin_user_id, target_type, target_id, access, sort_by, sort_order, limit, offset} =
+				ctx.req.valid('query');
+			const response =
+				q === undefined
+					? await adminService.auditService.listAuditLogs({
+							admin_user_id,
+							target_type,
+							target_id,
+							access,
+							limit,
+							offset,
+						})
+					: await adminService.auditService.searchAuditLogs({
+							query: q,
+							admin_user_id,
+							target_type,
+							target_id,
+							access,
+							sort_by,
+							sort_order,
+							limit,
+							offset,
+						});
+			await recordAdminRead(ctx, {
+				targetType: 'audit_log',
+				targetId: 0n,
+				action: q === undefined ? AdminAuditReadActions.LIST_AUDIT_LOGS : AdminAuditReadActions.SEARCH_AUDIT_LOGS,
+				metadata: {
+					filter_admin_user_id: admin_user_id,
+					filter_target_type:
+						target_type !== undefined && AUDIT_TARGET_TYPE_PATTERN.test(target_type) ? target_type : undefined,
+					has_target_type_filter:
+						target_type !== undefined && !AUDIT_TARGET_TYPE_PATTERN.test(target_type) ? true : undefined,
+					filter_target_id: snowflakeOrUndefined(target_id),
+					access,
+					sort_by: q === undefined ? undefined : sort_by,
+					sort_order: q === undefined ? undefined : sort_order,
 					limit,
 					offset,
-				}),
-			);
+					result_count: response.logs.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -76,6 +106,11 @@ export function AuditLogAdminController(app: HonoApp) {
 			if (!log) {
 				throw new NotFoundError({code: APIErrorCodes.NOT_FOUND});
 			}
+			await recordAdminRead(ctx, {
+				targetType: 'audit_log',
+				targetId: log_id,
+				action: AdminAuditReadActions.GET_AUDIT_LOG,
+			});
 			return ctx.json(log);
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/BanAdminController.ts b/fluxer_api/src/api/admin/controllers/BanAdminController.ts
index a00cd1aa3..da85a2c41 100644
--- a/fluxer_api/src/api/admin/controllers/BanAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/BanAdminController.ts
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
+import type {AdminBanManagementService} from '@app/api/admin/services/AdminBanManagementService';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -180,6 +183,18 @@ const BLOCKLIST_TYPE_ACLS: Record<AdminBlocklistListType, {add: string; check: s
 	},
 };
 
+const BLOCKLIST_AUDIT_TARGET_TYPES: Record<AdminBlocklistListType, string> = {
+	ip: 'ip',
+	email: 'email',
+	'email-domain-suspicious': 'email_domain',
+	phrase: 'phrase',
+	url: 'url',
+	'url-domain': 'url_domain',
+	'file-sha': 'file_sha',
+	'avatar-hash': 'avatar_hash',
+	'profile-substring': 'profile_substring',
+};
+
 type BlocklistVerb = 'add' | 'check' | 'remove';
 
 const BLOCKLIST_ACLS_BY_VERB: Record<BlocklistVerb, Array<string>> = {
@@ -229,6 +244,37 @@ async function parseBlocklistBody<T>(schema: ZodType<T>, value: unknown): Promis
 	return result.data;
 }
 
+async function checkBlocklistEntry(
+	bans: AdminBanManagementService,
+	listType: AdminBlocklistListType,
+	entryValue: string,
+	scope: ProfileSubstringScope | undefined,
+): Promise<{banned: boolean}> {
+	switch (listType) {
+		case 'ip':
+			return bans.checkIpBan({ip: entryValue});
+		case 'email':
+			return bans.checkEmailBan({email: entryValue});
+		case 'email-domain-suspicious':
+			return bans.checkSuspiciousEmailDomain({domain: entryValue});
+		case 'phrase':
+			return bans.checkPhraseBan({phrase: entryValue});
+		case 'url':
+			return bans.checkUrlBan({url: entryValue});
+		case 'url-domain':
+			return bans.checkUrlDomainBan({domain: entryValue});
+		case 'file-sha':
+			return bans.checkFileShaBan({sha256_hex: entryValue});
+		case 'avatar-hash':
+			return bans.checkAvatarHashBan({hashes: [entryValue]});
+		case 'profile-substring':
+			return bans.checkProfileSubstringBan({
+				scope: requireProfileSubstringScope(scope),
+				substrings: [entryValue],
+			});
+	}
+}
+
 export function BanAdminController(app: HonoApp) {
 	app.get(
 		'/admin/blocklists',
@@ -245,6 +291,12 @@ export function BanAdminController(app: HonoApp) {
 				'List every blocklist this instance maintains, the request field that carries an entry value, the extra fields its entries accept, and which of the bulk and update operations it supports.',
 		}),
 		async (ctx) => {
+			await recordAdminRead(ctx, {
+				targetType: 'blocklist',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_BLOCKLISTS,
+				metadata: {result_count: BLOCKLIST_CATALOG.length},
+			});
 			return ctx.json({items: BLOCKLIST_CATALOG});
 		},
 	);
@@ -270,14 +322,26 @@ export function BanAdminController(app: HonoApp) {
 			requireBlocklistACL(ctx.get('adminUserAcls'), listType, 'check');
 			const {limit, after, scope} = ctx.req.valid('query');
 			assertBlocklistScopeAllowed(listType, scope);
-			return ctx.json(
-				await adminService.banManagementService.listBlocklistEntries({
-					listType,
+			const page = await adminService.banManagementService.listBlocklistEntries({
+				listType,
+				limit,
+				after: after ?? null,
+				scope: listType === 'profile-substring' ? requireProfileSubstringScope(scope) : null,
+			});
+			await recordAdminRead(ctx, {
+				targetType: BLOCKLIST_AUDIT_TARGET_TYPES[listType],
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_BLOCKLIST_ENTRIES,
+				metadata: {
+					list_type: listType,
+					scope,
 					limit,
-					after: after ?? null,
-					scope: listType === 'profile-substring' ? requireProfileSubstringScope(scope) : null,
-				}),
-			);
+					has_after: after === undefined ? undefined : true,
+					result_count: page.items.length,
+					has_more: page.has_more,
+				},
+			});
+			return ctx.json(page);
 		},
 	);
 	app.post(
@@ -379,6 +443,15 @@ export function BanAdminController(app: HonoApp) {
 				},
 				{requestedByUserId: adminUserId, requireLedger: true, ...(auditLogReason && {auditLogReason})},
 			);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: jobId,
+				action: 'queue_bulk_job',
+				metadata: {
+					task: 'ban_file_shas',
+					entity_count: body.sha256_list.length,
+				},
+			});
 			return ctx.json({job_id: jobId.toString()});
 		},
 	);
@@ -449,32 +522,18 @@ export function BanAdminController(app: HonoApp) {
 			requireBlocklistACL(ctx.get('adminUserAcls'), listType, 'check');
 			const {scope} = ctx.req.valid('query');
 			assertBlocklistScopeAllowed(listType, scope);
-			const bans = adminService.banManagementService;
-			switch (listType) {
-				case 'ip':
-					return ctx.json(await bans.checkIpBan({ip: entryValue}));
-				case 'email':
-					return ctx.json(await bans.checkEmailBan({email: entryValue}));
-				case 'email-domain-suspicious':
-					return ctx.json(await bans.checkSuspiciousEmailDomain({domain: entryValue}));
-				case 'phrase':
-					return ctx.json(await bans.checkPhraseBan({phrase: entryValue}));
-				case 'url':
-					return ctx.json(await bans.checkUrlBan({url: entryValue}));
-				case 'url-domain':
-					return ctx.json(await bans.checkUrlDomainBan({domain: entryValue}));
-				case 'file-sha':
-					return ctx.json(await bans.checkFileShaBan({sha256_hex: entryValue}));
-				case 'avatar-hash':
-					return ctx.json(await bans.checkAvatarHashBan({hashes: [entryValue]}));
-				case 'profile-substring':
-					return ctx.json(
-						await bans.checkProfileSubstringBan({
-							scope: requireProfileSubstringScope(scope),
-							substrings: [entryValue],
-						}),
-					);
-			}
+			const result = await checkBlocklistEntry(adminService.banManagementService, listType, entryValue, scope);
+			await recordAdminRead(ctx, {
+				targetType: BLOCKLIST_AUDIT_TARGET_TYPES[listType],
+				targetId: 0n,
+				action: AdminAuditReadActions.CHECK_BLOCKLIST_ENTRY,
+				metadata: {
+					list_type: listType,
+					scope,
+					banned: result.banned,
+				},
+			});
+			return ctx.json(result);
 		},
 	);
 	app.patch(
diff --git a/fluxer_api/src/api/admin/controllers/BulkAdminController.ts b/fluxer_api/src/api/admin/controllers/BulkAdminController.ts
index eac5777b2..9f2e14111 100644
--- a/fluxer_api/src/api/admin/controllers/BulkAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/BulkAdminController.ts
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import type {UserID} from '@app/api/BrandedTypes';
 import {requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -136,6 +137,16 @@ export function BulkAdminController(app: HonoApp) {
 				throw new MissingACLError(requiredAcl);
 			}
 			const jobId = await queueBulkJob(body, adminUserId, auditLogReason);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: jobId,
+				action: 'queue_bulk_job',
+				metadata: {
+					task: body.task,
+					entity_count: 'guild_ids' in body ? body.guild_ids.length : body.user_ids.length,
+					guild_id: body.task === AdminBulkTaskType.ADD_GUILD_MEMBERS ? body.guild_id : undefined,
+				},
+			});
 			return ctx.json({job_id: jobId.toString()});
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/DiscoveryAdminController.ts b/fluxer_api/src/api/admin/controllers/DiscoveryAdminController.ts
index 3e732fbb8..beb1347f3 100644
--- a/fluxer_api/src/api/admin/controllers/DiscoveryAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/DiscoveryAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import type {GuildDiscoveryRow} from '@app/api/database/types/GuildDiscoveryTypes';
 import {mapGuildFeatures} from '@app/api/guild/GuildFeatureUtils';
@@ -30,6 +32,8 @@ import {
 	DiscoveryCategoryListResponse,
 } from '@fluxer/schema/src/domains/guild/GuildDiscoverySchemas';
 
+const DISCOVERY_LISTING_FIELDS = ['description', 'category_type', 'primary_language', 'custom_tags'] as const;
+
 function mapRowToApplicationResponse(row: GuildDiscoveryRow) {
 	return {
 		guild_id: row.guild_id.toString(),
@@ -149,6 +153,12 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const userRepository = ctx.get('userRepository');
 			const rows = await discoveryService.listByStatus({status: DiscoveryApplicationStatus.PENDING});
 			const enrichment = await enrichGuilds(rows, guildService, userRepository);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_APPLICATIONS,
+				metadata: {result_count: rows.length},
+			});
 			return ctx.json(rows.map((row) => mapPendingResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
@@ -173,10 +183,16 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const data = ctx.req.valid('json');
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
-			const row =
-				data.status === DiscoveryApplicationStatus.APPROVED
-					? await discoveryService.approve({guildId, adminUserId, reason: data.reason})
-					: await discoveryService.reject({guildId, adminUserId, reason: data.reason});
+			const approved = data.status === DiscoveryApplicationStatus.APPROVED;
+			const row = approved
+				? await discoveryService.approve({guildId, adminUserId, reason: data.reason})
+				: await discoveryService.reject({guildId, adminUserId, reason: data.reason});
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: approved ? 'approve_discovery_application' : 'reject_discovery_application',
+				metadata: {status: data.status},
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
@@ -195,12 +211,17 @@ export function DiscoveryAdminController(app: HonoApp) {
 			tags: 'Admin',
 		}),
 		async (ctx) => {
-			return ctx.json(
-				Object.entries(DiscoveryCategoryLabels).map(([id, name]) => ({
-					id: Number(id),
-					name,
-				})),
-			);
+			const categories = Object.entries(DiscoveryCategoryLabels).map(([id, name]) => ({
+				id: Number(id),
+				name,
+			}));
+			await recordAdminRead(ctx, {
+				targetType: 'discovery_category',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_CATEGORIES,
+				metadata: {result_count: categories.length},
+			});
+			return ctx.json(categories);
 		},
 	);
 	app.get(
@@ -233,11 +254,20 @@ export function DiscoveryAdminController(app: HonoApp) {
 					(enrichment.get(right.guild_id.toString())?.member_count ?? 0) -
 					(enrichment.get(left.guild_id.toString())?.member_count ?? 0),
 			);
-			return ctx.json(
-				sorted
-					.slice(offset, offset + limit)
-					.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))),
-			);
+			const page = sorted.slice(offset, offset + limit);
+			await recordAdminRead(ctx, {
+				targetType: 'discovery_category',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_CATEGORY_LISTINGS,
+				metadata: {
+					category_id,
+					limit,
+					offset,
+					result_count: page.length,
+					total: inCategory.length,
+				},
+			});
+			return ctx.json(page.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
 	app.get(
@@ -260,6 +290,12 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const userRepository = ctx.get('userRepository');
 			const rows = await discoveryService.listByStatus({status: DiscoveryApplicationStatus.APPROVED});
 			const enrichment = await enrichGuilds(rows, guildService, userRepository);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_DISCOVERY_LISTINGS,
+				metadata: {result_count: rows.length},
+			});
 			return ctx.json(rows.map((row) => mapListedResponse(row, enrichment.get(row.guild_id.toString()))));
 		},
 	);
@@ -341,6 +377,18 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
 			const row = await discoveryService.editApplication({guildId, userId: adminUserId, data});
+			const fields = DISCOVERY_LISTING_FIELDS.filter((field) => data[field] !== undefined);
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'update_discovery_listing',
+				metadata: {
+					fields: fields.length > 0 ? fields.join(',') : undefined,
+					category_type: data.category_type,
+					primary_language: data.primary_language,
+					status: row.status,
+				},
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
@@ -366,6 +414,11 @@ export function DiscoveryAdminController(app: HonoApp) {
 			const adminUserId = ctx.get('adminUserId');
 			const discoveryService = ctx.get('discoveryService');
 			const row = await discoveryService.remove({guildId, adminUserId, reason: data.reason});
+			await recordAdminWrite(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: 'remove_discovery_listing',
+			});
 			return ctx.json(mapRowToApplicationResponse(row));
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/GatewayAdminController.ts b/fluxer_api/src/api/admin/controllers/GatewayAdminController.ts
index c80d1ac73..6a74bc85b 100644
--- a/fluxer_api/src/api/admin/controllers/GatewayAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/GatewayAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -34,7 +36,14 @@ export function GatewayAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getNodeStats());
+			const stats = await adminService.guildServiceAggregate.managementService.getNodeStats();
+			await recordAdminRead(ctx, {
+				targetType: 'gateway',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_GATEWAY_STATS,
+				metadata: {node_count: stats.node_count},
+			});
+			return ctx.json(stats);
 		},
 	);
 	app.get(
@@ -54,7 +63,14 @@ export function GatewayAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {limit} = ctx.req.valid('query');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getGuildMemoryStats(limit));
+			const stats = await adminService.guildServiceAggregate.managementService.getGuildMemoryStats(limit);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_GUILD_MEMORY_STATS,
+				metadata: {limit, result_count: stats.guilds.length},
+			});
+			return ctx.json(stats);
 		},
 	);
 	app.get(
@@ -73,7 +89,18 @@ export function GatewayAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.guildServiceAggregate.managementService.getVoiceStateCounts());
+			const counts = await adminService.guildServiceAggregate.managementService.getVoiceStateCounts();
+			await recordAdminRead(ctx, {
+				targetType: 'gateway',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_VOICE_STATE_COUNTS,
+				metadata: {
+					total_voice_states: counts.total_voice_states,
+					region_count: counts.regions.length,
+					server_count: counts.servers.length,
+				},
+			});
+			return ctx.json(counts);
 		},
 	);
 	app.post(
diff --git a/fluxer_api/src/api/admin/controllers/GuildAdminController.ts b/fluxer_api/src/api/admin/controllers/GuildAdminController.ts
index a26f5752b..eda8331ca 100644
--- a/fluxer_api/src/api/admin/controllers/GuildAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/GuildAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createGuildID} from '@app/api/BrandedTypes';
 import {requireAdminACL, requireAnyAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -107,13 +109,24 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.searchService.searchGuilds({
-					query: query.q,
+			const response = await adminService.searchService.searchGuilds({
+				query: query.q,
+				limit: query.limit,
+				offset: query.offset,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_GUILDS,
+				metadata: {
+					has_query: query.q === undefined ? undefined : true,
 					limit: query.limit,
 					offset: query.offset,
-				}),
-			);
+					result_count: response.guilds.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -133,11 +146,15 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.lookupGuild({
-					guild_id: ctx.req.valid('param').guild_id,
-				}),
-			);
+			const {guild_id} = ctx.req.valid('param');
+			const response = await adminService.guildServiceAggregate.lookupService.lookupGuild({guild_id});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.GET_GUILD,
+				metadata: {found: response.guild !== null},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -215,6 +232,16 @@ export function GuildAdminController(app: HonoApp) {
 			if (!guild) {
 				throw new UnknownGuildError();
 			}
+			const appliedFieldGroup =
+				body.fields !== undefined ||
+				hasGuildSettingsUpdate(body) ||
+				hasGuildFeatureUpdate(body) ||
+				body.name !== undefined ||
+				body.vanity_url_code !== undefined ||
+				body.new_owner_id !== undefined;
+			if (!appliedFieldGroup) {
+				await recordAdminWrite(ctx, {targetType: 'guild', targetId: guildIdRaw, action: 'update_guild'});
+			}
 			return ctx.json({
 				guild: {
 					id: guild.id,
@@ -275,14 +302,25 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
+			const {guild_id} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.listGuildMembers({
-					guild_id: ctx.req.valid('param').guild_id,
-					limit: query.limit,
-					offset: query.offset,
-				}),
-			);
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildMembers({
+				guild_id,
+				limit: query.limit,
+				offset: query.offset,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.LIST_GUILD_MEMBERS,
+				metadata: {
+					limit: response.limit,
+					offset: response.offset,
+					result_count: response.members.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.put(
@@ -391,7 +429,14 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const guildId = createGuildID(ctx.req.valid('param').guild_id);
-			return ctx.json(await adminService.guildServiceAggregate.lookupService.listGuildEmojis(guildId));
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildEmojis(guildId);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: AdminAuditReadActions.LIST_GUILD_EMOJIS,
+				metadata: {result_count: response.emojis.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -412,7 +457,14 @@ export function GuildAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const guildId = createGuildID(ctx.req.valid('param').guild_id);
-			return ctx.json(await adminService.guildServiceAggregate.lookupService.listGuildStickers(guildId));
+			const response = await adminService.guildServiceAggregate.lookupService.listGuildStickers(guildId);
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guildId,
+				action: AdminAuditReadActions.LIST_GUILD_STICKERS,
+				metadata: {result_count: response.stickers.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -433,17 +485,30 @@ export function GuildAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
+			const {guild_id} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.listGuildAuditLogs({
-					guild_id: ctx.req.valid('param').guild_id,
+			const response = await adminService.guildServiceAggregate.listGuildAuditLogs({
+				guild_id,
+				limit: query.limit,
+				before: query.before,
+				after: query.after,
+				user_id: query.user_id,
+				action_type: query.action_type,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'guild',
+				targetId: guild_id,
+				action: AdminAuditReadActions.LIST_GUILD_AUDIT_LOGS,
+				metadata: {
 					limit: query.limit,
 					before: query.before,
 					after: query.after,
-					user_id: query.user_id,
+					filter_user_id: query.user_id,
 					action_type: query.action_type,
-				}),
-			);
+					result_count: response.audit_log_entries.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
diff --git a/fluxer_api/src/api/admin/controllers/InstanceConfigAdminController.ts b/fluxer_api/src/api/admin/controllers/InstanceConfigAdminController.ts
index 5779f3734..09337c6a7 100644
--- a/fluxer_api/src/api/admin/controllers/InstanceConfigAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/InstanceConfigAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {createUserID} from '@app/api/BrandedTypes';
 import {Config} from '@app/api/Config';
 import {
@@ -167,16 +169,25 @@ function completesInitialSetup(data: InstanceConfigUpdateRequest, setupConfigure
 	);
 }
 
-async function grantSetupCompleterAdminACL(ctx: Context<HonoEnv>): Promise<void> {
+async function grantSetupCompleterAdminACL(ctx: Context<HonoEnv>): Promise<boolean> {
 	const user = ctx.get('user');
 	if (!user || ctx.get('authTokenType') !== 'session' || hasAdminAuthenticationACL(user.acls)) {
-		return;
+		return false;
 	}
 	const nextACLs = new Set(user.acls);
 	nextACLs.add(AdminACLs.WILDCARD);
 	const updatedUser = await ctx.get('userRepository').patchUpsert(user.id, {acls: nextACLs}, user.toRow());
 	ctx.set('user', updatedUser);
 	ctx.set('adminUserAcls', updatedUser.acls);
+	return true;
+}
+
+function listSuppliedSections(data: InstanceConfigUpdateRequest): string | undefined {
+	const sections = Object.entries(data)
+		.filter(([, value]) => value != null)
+		.map(([key]) => key)
+		.sort();
+	return sections.length > 0 ? sections.join(',') : undefined;
 }
 
 export function InstanceConfigAdminController(app: HonoApp) {
@@ -196,7 +207,17 @@ export function InstanceConfigAdminController(app: HonoApp) {
 			tags: 'Admin',
 		}),
 		async (ctx) => {
-			return ctx.json(await buildInstanceConfigResponse());
+			const response = await buildInstanceConfigResponse();
+			await recordAdminRead(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_INSTANCE_CONFIG,
+				metadata: {
+					registration_url_count: response.registration.urls.length,
+					pending_registration_count: response.registration.pending_registrations.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -411,10 +432,20 @@ export function InstanceConfigAdminController(app: HonoApp) {
 					}),
 				});
 			}
+			let grantedSetupCompleterAdmin = false;
 			if (shouldGrantSetupCompleterAdmin) {
-				await grantSetupCompleterAdminACL(ctx);
+				grantedSetupCompleterAdmin = await grantSetupCompleterAdminACL(ctx);
 				await instanceConfigRepository.markAdminBootstrapped();
 			}
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'update_instance_config',
+				metadata: {
+					sections: listSuppliedSections(data),
+					granted_acls: grantedSetupCompleterAdmin ? AdminACLs.WILDCARD : undefined,
+				},
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -445,6 +476,12 @@ export function InstanceConfigAdminController(app: HonoApp) {
 			});
 			const brandingPatch: Partial<InstanceBranding> = {[`${kind}_url`]: prepared.newCdnUrl};
 			await instanceConfigRepository.setAppPublicConfig({branding: brandingPatch});
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'upload_branding_asset',
+				metadata: {kind, cleared: prepared.newCdnUrl === null},
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -465,6 +502,7 @@ export function InstanceConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const data = ctx.req.valid('json');
+			let result: InstanceEmailSmtpTestResponse;
 			try {
 				const provider = new SmtpEmailProvider({
 					host: data.host,
@@ -477,10 +515,17 @@ export function InstanceConfigAdminController(app: HonoApp) {
 					socketTimeoutMs: 10000,
 				});
 				await provider.verify();
-				return ctx.json({ok: true, error: null});
+				result = {ok: true, error: null};
 			} catch (error) {
-				return ctx.json({ok: false, error: error instanceof Error ? error.message : String(error)});
+				result = {ok: false, error: error instanceof Error ? error.message : String(error)};
 			}
+			await recordAdminWrite(ctx, {
+				targetType: 'instance_config',
+				targetId: 0n,
+				action: 'test_smtp_connection',
+				metadata: {port: data.port, secure: data.secure, ok: result.ok},
+			});
+			return ctx.json(result);
 		},
 	);
 	app.post(
@@ -507,6 +552,12 @@ export function InstanceConfigAdminController(app: HonoApp) {
 				maxUses: data.max_uses ?? null,
 				approvalRequired: data.approval_required,
 			});
+			await recordAdminWrite(ctx, {
+				targetType: 'registration_url',
+				targetId: 0n,
+				action: 'create_registration_url',
+				metadata: {approval_required: data.approval_required, max_uses: data.max_uses},
+			});
 			return ctx.json({
 				registration_url: created.registrationUrl,
 				code: created.code,
@@ -531,6 +582,11 @@ export function InstanceConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			await instanceConfigRepository.revokeRegistrationUrl(ctx.req.valid('param').registration_url_id);
+			await recordAdminWrite(ctx, {
+				targetType: 'registration_url',
+				targetId: 0n,
+				action: 'revoke_registration_url',
+			});
 			return ctx.json(await buildInstanceConfigResponse());
 		},
 	);
@@ -647,6 +703,12 @@ async function updatePendingRegistrationUser(
 	const userRepository = ctx.get('userRepository');
 	const user = await userRepository.findUnique(createUserID(BigInt(userId)));
 	if (!user) {
+		await recordAdminWrite(ctx, {
+			targetType: 'user',
+			targetId: BigInt(userId),
+			action: decision === 'approve' ? 'approve_registration' : 'reject_registration',
+			metadata: {account_found: false},
+		});
 		return;
 	}
 	const traits = new Set(user.traits);
diff --git a/fluxer_api/src/api/admin/controllers/JobsAdminController.ts b/fluxer_api/src/api/admin/controllers/JobsAdminController.ts
index f5f8ba3fd..c7695d13b 100644
--- a/fluxer_api/src/api/admin/controllers/JobsAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/JobsAdminController.ts
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -114,7 +115,15 @@ export function JobsAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.jobAdminService.cancelJob(ctx.req.valid('param').job_id));
+			const {job_id} = ctx.req.valid('param');
+			const result = await adminService.jobAdminService.cancelJob(job_id);
+			await recordAdminWrite(ctx, {
+				targetType: 'bulk_job',
+				targetId: job_id,
+				action: 'cancel_job',
+				metadata: {cancelled: result.cancelled},
+			});
+			return ctx.json(result);
 		},
 	);
 }
diff --git a/fluxer_api/src/api/admin/controllers/LimitConfigAdminController.ts b/fluxer_api/src/api/admin/controllers/LimitConfigAdminController.ts
index fb0485b16..bc6e483ea 100644
--- a/fluxer_api/src/api/admin/controllers/LimitConfigAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/LimitConfigAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead, recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {Config} from '@app/api/Config';
 import type {LimitConfigService} from '@app/api/limits/LimitConfigService';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
@@ -10,7 +12,7 @@ import type {HonoApp} from '@app/api/types/HonoEnv';
 import {Validator} from '@app/api/Validator';
 import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
 import {LIMIT_CATEGORY_LABELS, LIMIT_KEY_METADATA, LIMIT_KEYS} from '@fluxer/constants/src/LimitConfigMetadata';
-import type {LimitConfigSnapshot} from '@fluxer/limits/src/LimitTypes';
+import type {LimitConfigSnapshot, LimitRule} from '@fluxer/limits/src/LimitTypes';
 import {LimitConfigGetResponse, LimitConfigUpdateRequest} from '@fluxer/schema/src/domains/admin/AdminSchemas';
 
 function formatConfig(service: LimitConfigService) {
@@ -27,6 +29,21 @@ function formatConfig(service: LimitConfigService) {
 	};
 }
 
+function describeLimitRule(rule: LimitRule): string {
+	return JSON.stringify([
+		rule.filters?.traits ?? [],
+		rule.filters?.guildFeatures ?? [],
+		LIMIT_KEYS.map((key) => rule.limits[key] ?? null),
+	]);
+}
+
+function countChangedLimitRules(before: LimitConfigSnapshot, after: LimitConfigSnapshot): number {
+	const previous = new Map(before.rules.map((rule) => [rule.id, describeLimitRule(rule)]));
+	const next = new Map(after.rules.map((rule) => [rule.id, describeLimitRule(rule)]));
+	const ruleIds = new Set([...previous.keys(), ...next.keys()]);
+	return Array.from(ruleIds).filter((ruleId) => previous.get(ruleId) !== next.get(ruleId)).length;
+}
+
 export function LimitConfigAdminController(app: HonoApp) {
 	app.get(
 		'/admin/limit-config',
@@ -44,7 +61,14 @@ export function LimitConfigAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const limitConfigService = ctx.get('limitConfigService') as LimitConfigService;
-			return ctx.json(formatConfig(limitConfigService));
+			const response = formatConfig(limitConfigService);
+			await recordAdminRead(ctx, {
+				targetType: 'limit_config',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_LIMIT_CONFIG,
+				metadata: {rule_count: response.limit_config.rules.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.put(
@@ -69,8 +93,20 @@ export function LimitConfigAdminController(app: HonoApp) {
 				...data.limit_config,
 				traitDefinitions: data.limit_config.traitDefinitions ?? [],
 			};
+			const previous = limitConfigService.getConfigSnapshot();
 			await limitConfigService.updateConfig(normalized);
-			return ctx.json(formatConfig(limitConfigService));
+			const response = formatConfig(limitConfigService);
+			await recordAdminWrite(ctx, {
+				targetType: 'limit_config',
+				targetId: 0n,
+				action: 'update_limit_config',
+				metadata: {
+					rule_count: response.limit_config.rules.length,
+					changed_rule_count: countChangedLimitRules(previous, response.limit_config),
+					trait_definition_count: response.limit_config.traitDefinitions.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 }
diff --git a/fluxer_api/src/api/admin/controllers/MessageAdminController.ts b/fluxer_api/src/api/admin/controllers/MessageAdminController.ts
index 852b614be..7e9384617 100644
--- a/fluxer_api/src/api/admin/controllers/MessageAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/MessageAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createAttachmentID, createChannelID, createMessageID, createReportID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -57,34 +59,69 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const query = ctx.req.valid('query');
 			if (query.message_id != null) {
-				return ctx.json(
-					await adminService.messageService.lookupMessage({
+				const messageId = query.message_id;
+				const response = await adminService.messageService.lookupMessage({
+					channel_id: query.channel_id,
+					message_id: messageId,
+					context_limit: query.context_limit,
+				});
+				await recordAdminRead(ctx, {
+					targetType: 'message',
+					targetId: messageId,
+					action: AdminAuditReadActions.SEARCH_MESSAGES,
+					metadata: {
+						mode: 'message',
 						channel_id: query.channel_id,
-						message_id: query.message_id,
 						context_limit: query.context_limit,
-					}),
-				);
+						found: response.messages.some((message) => message.id === messageId.toString()),
+						result_count: response.messages.length,
+					},
+				});
+				return ctx.json(response);
 			}
 			if (query.attachment_id != null) {
 				if (query.filename == null) {
 					throw InputValidationError.fromCode('filename', ValidationErrorCodes.INVALID_FORMAT);
 				}
-				return ctx.json(
-					await adminService.messageService.lookupMessageByAttachment({
-						channel_id: query.channel_id,
-						attachment_id: query.attachment_id,
-						filename: query.filename,
-						context_limit: query.context_limit,
-					}),
-				);
-			}
-			return ctx.json(
-				await adminService.messageService.searchChannelMessages({
+				const response = await adminService.messageService.lookupMessageByAttachment({
 					channel_id: query.channel_id,
-					query: query.q ?? '',
+					attachment_id: query.attachment_id,
+					filename: query.filename,
+					context_limit: query.context_limit,
+				});
+				await recordAdminRead(ctx, {
+					targetType: 'channel',
+					targetId: query.channel_id,
+					action: AdminAuditReadActions.SEARCH_MESSAGES,
+					metadata: {
+						mode: 'attachment',
+						attachment_id: query.attachment_id,
+						message_id: response.message_id,
+						context_limit: query.context_limit,
+						found: response.message_id !== null,
+						result_count: response.messages.length,
+					},
+				});
+				return ctx.json(response);
+			}
+			const response = await adminService.messageService.searchChannelMessages({
+				channel_id: query.channel_id,
+				query: query.q ?? '',
+				limit: query.limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'channel',
+				targetId: query.channel_id,
+				action: AdminAuditReadActions.SEARCH_MESSAGES,
+				metadata: {
+					mode: 'search',
+					has_query: query.q === undefined ? undefined : true,
 					limit: query.limit,
-				}),
-			);
+					result_count: response.messages.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
@@ -139,7 +176,14 @@ export function MessageAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {job_id} = ctx.req.valid('param');
-			return ctx.json(await adminService.messageShredService.getMessageShredStatus(job_id.toString()));
+			const response = await adminService.messageShredService.getMessageShredStatus(job_id.toString());
+			await recordAdminRead(ctx, {
+				targetType: 'message_shred',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_MESSAGE_SHRED_STATUS,
+				metadata: {job_id, status: response.status},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -162,14 +206,25 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {channel_id} = ctx.req.valid('param');
 			const {limit, before, after} = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.messageService.browseChannel({
-					channel_id,
+			const response = await adminService.messageService.browseChannel({
+				channel_id,
+				before,
+				after,
+				limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'channel',
+				targetId: channel_id,
+				action: AdminAuditReadActions.LIST_CHANNEL_MESSAGES,
+				metadata: {
+					limit,
 					before,
 					after,
-					limit,
-				}),
-			);
+					result_count: response.messages.length,
+					has_more: response.has_more,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -192,13 +247,23 @@ export function MessageAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {channel_id, message_id} = ctx.req.valid('param');
 			const {context_limit} = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.messageService.lookupMessage({
+			const response = await adminService.messageService.lookupMessage({
+				channel_id,
+				message_id,
+				context_limit,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'message',
+				targetId: message_id,
+				action: AdminAuditReadActions.GET_MESSAGE,
+				metadata: {
 					channel_id,
-					message_id,
 					context_limit,
-				}),
-			);
+					found: response.messages.some((message) => message.id === message_id.toString()),
+					result_count: response.messages.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
diff --git a/fluxer_api/src/api/admin/controllers/ReportAdminController.ts b/fluxer_api/src/api/admin/controllers/ReportAdminController.ts
index 28f30995f..4b3f181cd 100644
--- a/fluxer_api/src/api/admin/controllers/ReportAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/ReportAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {createReportID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
@@ -88,15 +90,39 @@ export function ReportAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
-			if (query.status === undefined || usesReportSearchIndex(query)) {
-				return ctx.json(
-					await adminService.reportServiceAggregate.searchReports(toSearchReportsRequest(query), adminUserAcls),
-				);
-			}
-			const status = REPORT_STATUS_BY_FILTER[query.status];
-			return ctx.json(
-				await adminService.reportServiceAggregate.listReports(status, adminUserAcls, query.limit, query.offset),
-			);
+			const status = query.status;
+			const searched = status === undefined || usesReportSearchIndex(query);
+			const response = searched
+				? await adminService.reportServiceAggregate.searchReports(toSearchReportsRequest(query), adminUserAcls)
+				: await adminService.reportServiceAggregate.listReports(
+						REPORT_STATUS_BY_FILTER[status],
+						adminUserAcls,
+						query.limit,
+						query.offset,
+					);
+			await recordAdminRead(ctx, {
+				targetType: 'report',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_REPORTS,
+				metadata: {
+					has_query: query.q === undefined ? undefined : true,
+					status,
+					report_type: query.report_type,
+					reporter_user_id: query.reporter_id,
+					reported_user_id: query.reported_user_id,
+					reported_guild_id: query.reported_guild_id,
+					reported_channel_id: query.reported_channel_id,
+					context_guild_id: query.guild_context_id,
+					resolved_by_admin_user_id: query.resolved_by_admin_id,
+					sort_by: searched ? query.sort_by : undefined,
+					sort_order: searched ? query.sort_order : undefined,
+					limit: query.limit,
+					offset: query.offset,
+					result_count: response.reports.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -119,6 +145,15 @@ export function ReportAdminController(app: HonoApp) {
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {report_id} = ctx.req.valid('param');
 			const report = await adminService.reportServiceAggregate.getReport(createReportID(report_id), adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'report',
+				targetId: report_id,
+				action: AdminAuditReadActions.GET_REPORT,
+				metadata: {
+					report_type: report.report_type,
+					status: report.status,
+				},
+			});
 			return ctx.json(report);
 		},
 	);
diff --git a/fluxer_api/src/api/admin/controllers/SystemAdminController.ts b/fluxer_api/src/api/admin/controllers/SystemAdminController.ts
index 65c228e98..2cd043d49 100644
--- a/fluxer_api/src/api/admin/controllers/SystemAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/SystemAdminController.ts
@@ -4,6 +4,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import {Readable} from 'node:stream';
 import * as v8 from 'node:v8';
+import {recordAdminWrite} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -28,11 +29,17 @@ export function SystemAdminController(app: HonoApp) {
 			security: 'adminApiKey',
 			tags: 'Admin',
 		}),
-		async () => {
+		async (ctx) => {
 			const snapshotPath = path.join('/tmp', `heap-${Date.now()}.heapsnapshot`);
 			try {
 				v8.writeHeapSnapshot(snapshotPath);
 				const stat = fs.statSync(snapshotPath);
+				await recordAdminWrite(ctx, {
+					targetType: 'system',
+					targetId: 0n,
+					action: 'create_heap_snapshot',
+					metadata: {size_bytes: stat.size},
+				});
 				const nodeStream = fs.createReadStream(snapshotPath);
 				const body = Readable.toWeb(nodeStream) as ReadableStream;
 				nodeStream.on('close', () => {
diff --git a/fluxer_api/src/api/admin/controllers/UserAdminController.ts b/fluxer_api/src/api/admin/controllers/UserAdminController.ts
index de2dc8a9b..7f03c5c1b 100644
--- a/fluxer_api/src/api/admin/controllers/UserAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/UserAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {mapUserToAdminResponse} from '@app/api/admin/models/UserTypes';
 import {createUserID} from '@app/api/BrandedTypes';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
@@ -72,7 +74,14 @@ export function UserAdminController(app: HonoApp) {
 				'Returns every access control permission the admin API recognises. This is the registry admin accounts and admin API keys draw their permissions from. Requires AUTHENTICATE permission.',
 		}),
 		async (ctx) => {
-			return ctx.json({acls: Object.values(AdminACLs)});
+			const acls = Object.values(AdminACLs);
+			await recordAdminRead(ctx, {
+				targetType: 'admin_acl',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_ADMIN_ACLS,
+				metadata: {acl_count: acls.length},
+			});
+			return ctx.json({acls});
 		},
 	);
 	app.get(
@@ -127,25 +136,50 @@ export function UserAdminController(app: HonoApp) {
 					throw inputValidationErrorFromZodIssues(parsed.error.issues);
 				}
 				const {users} = await adminService.userService.lookupService.lookupUser(parsed.data, adminUserAcls);
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: 0n,
+					action: AdminAuditReadActions.SEARCH_USERS,
+					metadata: {
+						selector: userIds ? 'user_id' : 'resolve',
+						user_id: userIds?.length === 1 ? userIds[0] : undefined,
+						user_id_count: userIds?.length,
+						result_count: users.length,
+						total: users.length,
+					},
+				});
 				return ctx.json({users, total: users.length});
 			}
-			if (query.email?.trim()) {
+			const selector = query.email?.trim() ? 'email' : query.last_active_ip?.trim() ? 'last_active_ip' : 'search';
+			if (selector === 'email') {
 				requireSelectorACL(adminUserAcls, AdminACLs.USER_VIEW_EMAIL);
-			} else if (query.last_active_ip?.trim()) {
+			} else if (selector === 'last_active_ip') {
 				requireSelectorACL(adminUserAcls, AdminACLs.USER_VIEW_IP);
 			}
-			return ctx.json(
-				await adminService.searchService.searchUsers(
-					{
-						query: query.q,
-						email: query.email,
-						last_active_ip: query.last_active_ip,
-						limit: query.limit,
-						offset: query.offset,
-					},
-					adminUserAcls,
-				),
+			const response = await adminService.searchService.searchUsers(
+				{
+					query: query.q,
+					email: query.email,
+					last_active_ip: query.last_active_ip,
+					limit: query.limit,
+					offset: query.offset,
+				},
+				adminUserAcls,
 			);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: 0n,
+				action: AdminAuditReadActions.SEARCH_USERS,
+				metadata: {
+					selector,
+					has_query: selector === 'search' && query.q?.trim() ? true : undefined,
+					limit: selector === 'email' ? undefined : query.limit,
+					offset: selector === 'email' ? undefined : query.offset,
+					result_count: response.users.length,
+					total: response.total,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -167,7 +201,14 @@ export function UserAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {user_id: userId} = ctx.req.valid('param');
-			return ctx.json(await adminService.userService.lookupService.lookupUser({user_ids: [userId]}, adminUserAcls));
+			const response = await adminService.userService.lookupService.lookupUser({user_ids: [userId]}, adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.GET_USER,
+				metadata: {found: response.users.length > 0},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -190,9 +231,23 @@ export function UserAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const {user_id: userId} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(
-				await adminService.guildServiceAggregate.lookupService.listUserGuilds({user_id: userId, ...query}),
-			);
+			const response = await adminService.guildServiceAggregate.lookupService.listUserGuilds({
+				user_id: userId,
+				...query,
+			});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_GUILDS,
+				metadata: {
+					before_guild_id: query.before,
+					after_guild_id: query.after,
+					limit: query.limit,
+					with_counts: query.with_counts,
+					guild_count: response.guilds.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -216,9 +271,29 @@ export function UserAdminController(app: HonoApp) {
 			const {user_id: userId} = ctx.req.valid('param');
 			const {type, ...pagination} = ctx.req.valid('query');
 			if (type === 'group_dm') {
-				return ctx.json(await adminService.userService.listUserGroupDmChannels({user_id: userId}));
+				const response = await adminService.userService.listUserGroupDmChannels({user_id: userId});
+				await recordAdminRead(ctx, {
+					targetType: 'user',
+					targetId: userId,
+					action: AdminAuditReadActions.LIST_USER_DM_CHANNELS,
+					metadata: {type, channel_count: response.channels.length},
+				});
+				return ctx.json(response);
 			}
-			return ctx.json(await adminService.userService.listUserDmChannels({user_id: userId, ...pagination}));
+			const response = await adminService.userService.listUserDmChannels({user_id: userId, ...pagination});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_DM_CHANNELS,
+				metadata: {
+					type,
+					before_channel_id: pagination.before,
+					after_channel_id: pagination.after,
+					limit: pagination.limit,
+					channel_count: response.channels.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -242,7 +317,18 @@ export function UserAdminController(app: HonoApp) {
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const {user_id: userId} = ctx.req.valid('param');
 			const query = ctx.req.valid('query');
-			return ctx.json(await adminService.userService.listUserChangeLog({user_id: userId, ...query}, adminUserAcls));
+			const response = await adminService.userService.listUserChangeLog({user_id: userId, ...query}, adminUserAcls);
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_CHANGE_LOG,
+				metadata: {
+					limit: query.limit,
+					has_page_token: query.page_token === undefined ? undefined : true,
+					entry_count: response.entries.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.get(
@@ -263,7 +349,19 @@ export function UserAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {user_id: userId} = ctx.req.valid('param');
-			return ctx.json(await adminService.relationshipService.listRelationships({user_id: userId}));
+			const response = await adminService.relationshipService.listRelationships({user_id: userId});
+			await recordAdminRead(ctx, {
+				targetType: 'user',
+				targetId: userId,
+				action: AdminAuditReadActions.LIST_USER_RELATIONSHIPS,
+				metadata: {
+					friend_count: response.friends.length,
+					incoming_request_count: response.incoming_requests.length,
+					outgoing_request_count: response.outgoing_requests.length,
+					blocked_count: response.blocked.length,
+				},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.delete(
diff --git a/fluxer_api/src/api/admin/controllers/VoiceAdminController.ts b/fluxer_api/src/api/admin/controllers/VoiceAdminController.ts
index d78577989..c7b9ce2cf 100644
--- a/fluxer_api/src/api/admin/controllers/VoiceAdminController.ts
+++ b/fluxer_api/src/api/admin/controllers/VoiceAdminController.ts
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {AdminAuditReadActions} from '@app/api/admin/AdminAuditActions';
+import {recordAdminRead} from '@app/api/admin/AdminAuditRecorder';
 import {requireAdminACL} from '@app/api/middleware/AdminMiddleware';
 import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
 import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
@@ -53,7 +55,15 @@ export function VoiceAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.voiceService.listVoiceRegions(ctx.req.valid('query')));
+			const query = ctx.req.valid('query');
+			const response = await adminService.voiceService.listVoiceRegions(query);
+			await recordAdminRead(ctx, {
+				targetType: 'voice_region',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_VOICE_REGIONS,
+				metadata: {include_servers: query.include_servers, result_count: response.regions.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
@@ -98,12 +108,16 @@ export function VoiceAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(
-				await adminService.voiceService.getVoiceRegion({
-					id: ctx.req.valid('param').region_id,
-					include_servers: ctx.req.valid('query').include_servers,
-				}),
-			);
+			const {region_id} = ctx.req.valid('param');
+			const {include_servers} = ctx.req.valid('query');
+			const response = await adminService.voiceService.getVoiceRegion({id: region_id, include_servers});
+			await recordAdminRead(ctx, {
+				targetType: 'voice_region',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_VOICE_REGION,
+				metadata: {region_id, include_servers, found: response.region !== null},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
@@ -182,7 +196,15 @@ export function VoiceAdminController(app: HonoApp) {
 		}),
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
-			return ctx.json(await adminService.voiceService.listVoiceServers({region_id: ctx.req.valid('param').region_id}));
+			const {region_id} = ctx.req.valid('param');
+			const response = await adminService.voiceService.listVoiceServers({region_id});
+			await recordAdminRead(ctx, {
+				targetType: 'voice_server',
+				targetId: 0n,
+				action: AdminAuditReadActions.LIST_VOICE_SERVERS,
+				metadata: {region_id, result_count: response.servers.length},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.post(
@@ -234,7 +256,14 @@ export function VoiceAdminController(app: HonoApp) {
 		async (ctx) => {
 			const adminService = ctx.get('adminService');
 			const {region_id, server_id} = ctx.req.valid('param');
-			return ctx.json(await adminService.voiceService.getVoiceServer({region_id, server_id}));
+			const response = await adminService.voiceService.getVoiceServer({region_id, server_id});
+			await recordAdminRead(ctx, {
+				targetType: 'voice_server',
+				targetId: 0n,
+				action: AdminAuditReadActions.GET_VOICE_SERVER,
+				metadata: {region_id, server_id, found: response.server !== null},
+			});
+			return ctx.json(response);
 		},
 	);
 	app.patch(
diff --git a/fluxer_api/src/api/admin/services/AdminAuditService.ts b/fluxer_api/src/api/admin/services/AdminAuditService.ts
index 75acf84cd..c7ad727db 100644
--- a/fluxer_api/src/api/admin/services/AdminAuditService.ts
+++ b/fluxer_api/src/api/admin/services/AdminAuditService.ts
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {ADMIN_AUDIT_READ_ACTIONS, getAdminAuditAccess} from '@app/api/admin/AdminAuditActions';
 import type {AdminAuditLog, IAdminRepository} from '@app/api/admin/IAdminRepository';
 import type {UserID} from '@app/api/BrandedTypes';
 import {createChannelID, createGuildID, createUserID} from '@app/api/BrandedTypes';
@@ -12,7 +13,9 @@ import type {Guild} from '@app/api/models/Guild';
 import type {User} from '@app/api/models/User';
 import {getAuditLogSearchService} from '@app/api/SearchFactory';
 import type {IUserRepository} from '@app/api/user/IUserRepository';
+import type {AuditLogSearchFilters} from '@fluxer/schema/src/contracts/search/SearchDocumentTypes';
 import type {
+	AdminAuditAccess,
 	AdminAuditLogChannelSummary,
 	AdminAuditLogGuildSummary,
 	AdminAuditLogResponse,
@@ -75,6 +78,7 @@ export class AdminAuditService {
 		admin_user_id?: bigint;
 		target_type?: string;
 		target_id?: string;
+		access?: AdminAuditAccess;
 		limit?: number;
 		offset?: number;
 	}): Promise<AuditLogsListResponse> {
@@ -85,20 +89,21 @@ export class AdminAuditService {
 				adminUserId: data.admin_user_id,
 				targetType: data.target_type,
 				targetId: targetIdBigInt,
+				access: data.access,
 				limit: data.limit,
 				offset: data.offset,
 			});
 		}
 		const limit = data.limit || 50;
-		const filters: Record<string, string> = {};
+		const filters: AuditLogSearchFilters = {...accessFilters(data.access)};
 		if (data.admin_user_id) {
-			filters['adminUserId'] = data.admin_user_id.toString();
+			filters.adminUserId = data.admin_user_id.toString();
 		}
 		if (data.target_type) {
-			filters['targetType'] = data.target_type;
+			filters.targetType = data.target_type;
 		}
 		if (data.target_id) {
-			filters['targetId'] = data.target_id;
+			filters.targetId = data.target_id;
 		}
 		const {hits, total} = await auditLogSearchService.searchAuditLogs('', filters, {
 			limit,
@@ -116,6 +121,7 @@ export class AdminAuditService {
 		admin_user_id?: bigint;
 		target_type?: string;
 		target_id?: string;
+		access?: AdminAuditAccess;
 		sort_by?: 'createdAt' | 'relevance';
 		sort_order?: 'asc' | 'desc';
 		limit?: number;
@@ -128,25 +134,26 @@ export class AdminAuditService {
 				adminUserId: data.admin_user_id,
 				targetType: data.target_type,
 				targetId: targetIdBigInt,
+				access: data.access,
 				limit: data.limit,
 				offset: data.offset,
 			});
 		}
-		const filters: Record<string, string> = {};
+		const filters: AuditLogSearchFilters = {...accessFilters(data.access)};
 		if (data.admin_user_id) {
-			filters['adminUserId'] = data.admin_user_id.toString();
+			filters.adminUserId = data.admin_user_id.toString();
 		}
 		if (data.target_id) {
-			filters['targetId'] = data.target_id;
+			filters.targetId = data.target_id;
 		}
 		if (data.target_type) {
-			filters['targetType'] = data.target_type;
+			filters.targetType = data.target_type;
 		}
 		if (data.sort_by) {
-			filters['sortBy'] = data.sort_by;
+			filters.sortBy = data.sort_by;
 		}
 		if (data.sort_order) {
-			filters['sortOrder'] = data.sort_order;
+			filters.sortOrder = data.sort_order;
 		}
 		const {hits, total} = await auditLogSearchService.searchAuditLogs(data.query || '', filters, {
 			limit: data.limit || 50,
@@ -163,6 +170,7 @@ export class AdminAuditService {
 		adminUserId?: bigint;
 		targetType?: string;
 		targetId?: bigint;
+		access?: AdminAuditAccess;
 		limit?: number;
 		offset?: number;
 	}): Promise<AuditLogsListResponse> {
@@ -178,6 +186,9 @@ export class AdminAuditService {
 		if (data.targetId) {
 			filteredLogs = filteredLogs.filter((log) => log.targetId === data.targetId);
 		}
+		if (data.access) {
+			filteredLogs = filteredLogs.filter((log) => getAdminAuditAccess(log.action) === data.access);
+		}
 		const offset = data.offset || 0;
 		const paginatedLogs = filteredLogs.slice(offset, offset + limit);
 		return {
@@ -229,6 +240,7 @@ export class AdminAuditService {
 				[...enrichment.channels.entries()].map(([id, channel]) => [id, mapChannelSummary(channel)!]),
 			),
 			action: log.action,
+			access: getAdminAuditAccess(log.action),
 			audit_log_reason: log.auditLogReason,
 			metadata: Object.fromEntries(log.metadata),
 			created_at: log.createdAt.toISOString(),
@@ -318,6 +330,12 @@ export class AdminAuditService {
 	}
 }
 
+function accessFilters(access: AdminAuditAccess | undefined): AuditLogSearchFilters {
+	if (access === 'read') return {actions: [...ADMIN_AUDIT_READ_ACTIONS]};
+	if (access === 'write') return {excludeActions: [...ADMIN_AUDIT_READ_ACTIONS]};
+	return {};
+}
+
 interface AuditLogEnrichmentDeps {
 	userRepository?: Pick<IUserRepository, 'findUnique'>;
 	guildRepository?: Pick<IGuildRepositoryAggregate, 'findUnique'>;
diff --git a/fluxer_api/src/api/admin/tests/AdminAuditAccessFilter.test.ts b/fluxer_api/src/api/admin/tests/AdminAuditAccessFilter.test.ts
new file mode 100644
index 000000000..12333bb59
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/AdminAuditAccessFilter.test.ts
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {ADMIN_AUDIT_READ_ACTIONS, getAdminAuditAccess} from '@app/api/admin/AdminAuditActions';
+import {createTestAccount, setUserACLs, type TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createUserID} from '@app/api/BrandedTypes';
+import {getAdminRepository} from '@app/api/middleware/ServiceSingletons';
+import {getAuditLogSearchService} from '@app/api/SearchFactory';
+import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
+import type {AuditLogsListResponse} from '@fluxer/schema/src/domains/admin/AdminSchemas';
+import {afterEach, describe, expect, test} from 'vitest';
+
+const TARGET_USER_ID = 910000000000000001n;
+
+describe('Admin audit log access filter', () => {
+	let harness: ApiTestHarness | undefined;
+
+	afterEach(async () => {
+		await harness?.shutdown();
+		harness = undefined;
+	});
+
+	async function createAuditViewer(activeHarness: ApiTestHarness): Promise<TestAccount> {
+		return setUserACLs(activeHarness, await createTestAccount(activeHarness), [
+			AdminACLs.AUTHENTICATE,
+			AdminACLs.AUDIT_LOG_VIEW,
+		]);
+	}
+
+	async function seedEntry(admin: TestAccount, logId: bigint, action: string): Promise<void> {
+		const log = await getAdminRepository().createAuditLog({
+			log_id: logId,
+			admin_user_id: createUserID(BigInt(admin.userId)),
+			target_type: 'user',
+			target_id: TARGET_USER_ID,
+			action,
+			audit_log_reason: null,
+			metadata: new Map(),
+			created_at: new Date(),
+		});
+		await getAuditLogSearchService()?.indexAuditLog(log);
+	}
+
+	async function listActions(
+		activeHarness: ApiTestHarness,
+		admin: TestAccount,
+		query: string,
+	): Promise<Array<{action: string; access: string}>> {
+		const result = await createBuilder<AuditLogsListResponse>(activeHarness, admin.token)
+			.get(`/admin/audit-logs?target_type=user&target_id=${TARGET_USER_ID}${query}`)
+			.execute();
+		return result.logs
+			.map((log) => ({action: log.action, access: log.access}))
+			.sort((a, b) => a.action.localeCompare(b.action));
+	}
+
+	test('classifies every registered read action as a read and anything else as a write', () => {
+		expect(ADMIN_AUDIT_READ_ACTIONS.length).toBe(new Set(ADMIN_AUDIT_READ_ACTIONS).size);
+		for (const action of ADMIN_AUDIT_READ_ACTIONS) {
+			expect(getAdminAuditAccess(action)).toBe('read');
+		}
+		expect(getAdminAuditAccess('update_flags')).toBe('write');
+		expect(getAdminAuditAccess('NCMEC Report')).toBe('write');
+	});
+
+	for (const search of ['disabled', 'enabled'] as const) {
+		test(`filters entries by access with search ${search}`, async () => {
+			harness = await createApiTestHarness({search});
+			const admin = await createAuditViewer(harness);
+			await seedEntry(admin, 910000000000000011n, 'get_user');
+			await seedEntry(admin, 910000000000000012n, 'list_user_sessions');
+			await seedEntry(admin, 910000000000000013n, 'update_flags');
+			await seedEntry(admin, 910000000000000014n, 'temp_ban');
+
+			expect(await listActions(harness, admin, '')).toEqual([
+				{action: 'get_user', access: 'read'},
+				{action: 'list_user_sessions', access: 'read'},
+				{action: 'temp_ban', access: 'write'},
+				{action: 'update_flags', access: 'write'},
+			]);
+			expect(await listActions(harness, admin, '&access=read')).toEqual([
+				{action: 'get_user', access: 'read'},
+				{action: 'list_user_sessions', access: 'read'},
+			]);
+			expect(await listActions(harness, admin, '&access=write')).toEqual([
+				{action: 'temp_ban', access: 'write'},
+				{action: 'update_flags', access: 'write'},
+			]);
+		});
+	}
+
+	test('filters a full-text search by access', async () => {
+		harness = await createApiTestHarness({search: 'enabled'});
+		const admin = await createAuditViewer(harness);
+		await seedEntry(admin, 910000000000000021n, 'list_user_sessions');
+		await seedEntry(admin, 910000000000000022n, 'terminate_sessions');
+
+		expect(await listActions(harness, admin, '&q=sessions&access=write')).toEqual([
+			{action: 'terminate_sessions', access: 'write'},
+		]);
+		expect(await listActions(harness, admin, '&q=sessions&access=read')).toEqual([
+			{action: 'list_user_sessions', access: 'read'},
+		]);
+	});
+
+	test('rejects an unknown access value', async () => {
+		harness = await createApiTestHarness();
+		const admin = await createAuditViewer(harness);
+		await createBuilder(harness, admin.token).get('/admin/audit-logs?access=delete').expect(400).execute();
+	});
+});
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCases.ts
new file mode 100644
index 000000000..4d9e3ca25
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCases.ts
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {createAdminApiKey} from '@app/api/admin/tests/AdminTestUtils';
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {expect} from 'vitest';
+
+export const AdminApiKeyAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/api-keys',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/api-keys',
+					body: {name: 'Coverage key', acls: ['user:lookup', 'guild:lookup'], expires_in_days: 30},
+				},
+				expected: {
+					action: 'create_admin_api_key',
+					targetType: 'admin_api_key',
+					targetId: expect.any(String),
+					metadata: {acls: 'user:lookup,guild:lookup', expires_in_days: '30'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/api-keys',
+		async prepare({harness, admin}) {
+			await createAdminApiKey(harness, admin, 'First key', ['user:lookup'], null);
+			await createAdminApiKey(harness, admin, 'Second key', ['guild:lookup'], 7);
+			return {
+				request: {path: '/admin/api-keys'},
+				expected: {
+					action: 'list_admin_api_keys',
+					targetType: 'admin_api_key',
+					targetId: '0',
+					metadata: {result_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/api-keys/:key_id',
+		async prepare({harness, admin}) {
+			const key = await createAdminApiKey(harness, admin, 'Readable key', ['user:lookup'], null);
+			return {
+				request: {path: `/admin/api-keys/${key.keyId}`},
+				expected: {
+					action: 'get_admin_api_key',
+					targetType: 'admin_api_key',
+					targetId: key.keyId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/api-keys/:key_id',
+		name: 'name and acls',
+		async prepare({harness, admin}) {
+			const key = await createAdminApiKey(harness, admin, 'Old name', ['user:lookup'], null);
+			return {
+				request: {path: `/admin/api-keys/${key.keyId}`, body: {name: 'New name', acls: ['guild:lookup']}},
+				expected: {
+					action: 'update_admin_api_key',
+					targetType: 'admin_api_key',
+					targetId: key.keyId,
+					metadata: {fields: 'name,acls', acls: 'guild:lookup'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/api-keys/:key_id',
+		name: 'name only',
+		async prepare({harness, admin}) {
+			const key = await createAdminApiKey(harness, admin, 'Old name', ['user:lookup'], 30);
+			return {
+				request: {path: `/admin/api-keys/${key.keyId}`, body: {name: 'New name'}},
+				expected: {
+					action: 'update_admin_api_key',
+					targetType: 'admin_api_key',
+					targetId: key.keyId,
+					metadata: {fields: 'name'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/api-keys/:key_id',
+		async prepare({harness, admin}) {
+			const key = await createAdminApiKey(harness, admin, 'Revoked key', ['user:lookup'], null);
+			return {
+				request: {path: `/admin/api-keys/${key.keyId}`},
+				expected: {
+					action: 'revoke_admin_api_key',
+					targetType: 'admin_api_key',
+					targetId: key.keyId,
+					metadata: {},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..f93eb8059
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {AdminApiKeyAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCases';
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+
+describeAdminAuditCoverage('AdminApiKeyAdminController', AdminApiKeyAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditCoverage.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditCoverage.ts
new file mode 100644
index 000000000..e82bf5832
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditCoverage.ts
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {getAdminAuditAccess} from '@app/api/admin/AdminAuditActions';
+import type {AdminAuditLog} from '@app/api/admin/IAdminRepository';
+import {createTestAccount, setUserACLs, type TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {getAdminRepository} from '@app/api/middleware/ServiceSingletons';
+import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
+import {afterEach, describe, expect, test} from 'vitest';
+
+const ADMIN_AUDIT_COVERAGE_REASON = 'Audit coverage ticket 5120';
+
+type AdminRouteMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+
+export interface AdminAuditCoverageContext {
+	harness: ApiTestHarness;
+	admin: TestAccount;
+}
+
+interface AdminAuditCoverageRequest {
+	path: string;
+	body?: unknown;
+	headers?: Record<string, string>;
+	expectStatus?: number;
+}
+
+interface AdminAuditExpectedEntry {
+	action: string;
+	targetType: string;
+	targetId: unknown;
+	metadata: Record<string, unknown>;
+}
+
+interface AdminAuditCoverageCaseBase {
+	method: AdminRouteMethod;
+	route: string;
+	name?: string;
+	search?: 'disabled' | 'enabled';
+	auditLogReason?: unknown;
+}
+
+export interface AdminAuditAuditedCase extends AdminAuditCoverageCaseBase {
+	prepare(
+		context: AdminAuditCoverageContext,
+	): Promise<{request: AdminAuditCoverageRequest; expected: AdminAuditExpectedEntry}>;
+}
+
+export interface AdminAuditExemptCase extends AdminAuditCoverageCaseBase {
+	exempt: true;
+	prepare(context: AdminAuditCoverageContext): Promise<{request: AdminAuditCoverageRequest}>;
+}
+
+export type AdminAuditCoverageCase = AdminAuditAuditedCase | AdminAuditExemptCase;
+
+export function adminAuditCaseShape(coverageCase: AdminAuditCoverageCase): string {
+	return `${coverageCase.method} ${coverageCase.route}`;
+}
+
+function isExemptCase(coverageCase: AdminAuditCoverageCase): coverageCase is AdminAuditExemptCase {
+	return 'exempt' in coverageCase && coverageCase.exempt;
+}
+
+async function listAuditLogs(): Promise<Array<AdminAuditLog>> {
+	return getAdminRepository().listAllAuditLogsPaginated(100000);
+}
+
+function describeEntry(log: AdminAuditLog) {
+	return {
+		action: log.action,
+		targetType: log.targetType,
+		targetId: log.targetId.toString(),
+		metadata: Object.fromEntries(log.metadata),
+	};
+}
+
+export function describeAdminAuditCoverage(area: string, cases: ReadonlyArray<AdminAuditCoverageCase>): void {
+	describe(`Admin audit coverage: ${area}`, () => {
+		let harness: ApiTestHarness | undefined;
+
+		afterEach(async () => {
+			await harness?.shutdown();
+			harness = undefined;
+		});
+
+		for (const coverageCase of cases) {
+			const label = coverageCase.name
+				? `${adminAuditCaseShape(coverageCase)} (${coverageCase.name})`
+				: adminAuditCaseShape(coverageCase);
+			test(label, async () => {
+				harness = await createApiTestHarness({search: coverageCase.search ?? 'disabled'});
+				const admin = await setUserACLs(harness, await createTestAccount(harness), [AdminACLs.WILDCARD]);
+				const prepared = await coverageCase.prepare({harness, admin});
+				const {request} = prepared;
+				const before = new Set((await listAuditLogs()).map((log) => log.logId.toString()));
+				const response = await harness.requestJson({
+					path: request.path,
+					method: coverageCase.method,
+					body: request.body,
+					headers: {
+						Authorization: admin.token,
+						'X-Audit-Log-Reason': ADMIN_AUDIT_COVERAGE_REASON,
+						...request.headers,
+					},
+				});
+				const expectedStatus = request.expectStatus ?? 200;
+				if (response.status !== expectedStatus) {
+					throw new Error(`Expected ${expectedStatus}, got ${response.status}: ${await response.text()}`);
+				}
+				await response.arrayBuffer();
+				const recorded = (await listAuditLogs()).filter((log) => !before.has(log.logId.toString()));
+
+				if (isExemptCase(coverageCase)) {
+					expect(recorded.map(describeEntry)).toEqual([]);
+					return;
+				}
+
+				const {expected} = prepared as Awaited<ReturnType<AdminAuditAuditedCase['prepare']>>;
+				const expectedAccess = coverageCase.method === 'GET' ? 'read' : 'write';
+				expect(getAdminAuditAccess(expected.action)).toBe(expectedAccess);
+				for (const log of recorded) {
+					expect(log.adminUserId.toString()).toBe(admin.userId);
+					expect(log.auditLogReason).toEqual(coverageCase.auditLogReason ?? ADMIN_AUDIT_COVERAGE_REASON);
+					expect(getAdminAuditAccess(log.action)).toBe(expectedAccess);
+				}
+				if (coverageCase.method === 'GET') {
+					expect(recorded.map(describeEntry)).toEqual([expected]);
+				} else {
+					expect(recorded.map(describeEntry)).toContainEqual(expected);
+				}
+			});
+		}
+	});
+}
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditRouteCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditRouteCoverage.test.ts
new file mode 100644
index 000000000..39facfb35
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AdminAuditRouteCoverage.test.ts
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {registerAdminControllers} from '@app/api/admin/controllers/index';
+import {AdminApiKeyAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AdminApiKeyAdminAuditCases';
+import {adminAuditCaseShape} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {ApplicationAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ApplicationAdminAuditCases';
+import {ArchiveAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ArchiveAdminAuditCases';
+import {AssetAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AssetAdminAuditCases';
+import {AuditLogAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AuditLogAdminAuditCases';
+import {BanAdminAuditCases} from '@app/api/admin/tests/audit_coverage/BanAdminAuditCases';
+import {BulkAdminAuditCases} from '@app/api/admin/tests/audit_coverage/BulkAdminAuditCases';
+import {CodesAdminAuditCases} from '@app/api/admin/tests/audit_coverage/CodesAdminAuditCases';
+import {DiscoveryAdminAuditCases} from '@app/api/admin/tests/audit_coverage/DiscoveryAdminAuditCases';
+import {GatewayAdminAuditCases} from '@app/api/admin/tests/audit_coverage/GatewayAdminAuditCases';
+import {GuildAdminAuditCases} from '@app/api/admin/tests/audit_coverage/GuildAdminAuditCases';
+import {InstanceConfigAdminAuditCases} from '@app/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCases';
+import {JobsAdminAuditCases} from '@app/api/admin/tests/audit_coverage/JobsAdminAuditCases';
+import {LimitConfigAdminAuditCases} from '@app/api/admin/tests/audit_coverage/LimitConfigAdminAuditCases';
+import {MessageAdminAuditCases} from '@app/api/admin/tests/audit_coverage/MessageAdminAuditCases';
+import {ReportAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ReportAdminAuditCases';
+import {SearchAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SearchAdminAuditCases';
+import {SystemAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SystemAdminAuditCases';
+import {SystemDmAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SystemDmAdminAuditCases';
+import {UserAdminAuditCases} from '@app/api/admin/tests/audit_coverage/UserAdminAuditCases';
+import {UserWriteAdminAuditCases} from '@app/api/admin/tests/audit_coverage/UserWriteAdminAuditCases';
+import {VoiceAdminAuditCases} from '@app/api/admin/tests/audit_coverage/VoiceAdminAuditCases';
+import type {HonoEnv} from '@app/api/types/HonoEnv';
+import {Hono} from 'hono';
+import {describe, expect, test} from 'vitest';
+
+const ALL_CASES = [
+	...AdminApiKeyAdminAuditCases,
+	...ApplicationAdminAuditCases,
+	...ArchiveAdminAuditCases,
+	...AssetAdminAuditCases,
+	...AuditLogAdminAuditCases,
+	...BanAdminAuditCases,
+	...BulkAdminAuditCases,
+	...CodesAdminAuditCases,
+	...DiscoveryAdminAuditCases,
+	...GatewayAdminAuditCases,
+	...GuildAdminAuditCases,
+	...InstanceConfigAdminAuditCases,
+	...JobsAdminAuditCases,
+	...LimitConfigAdminAuditCases,
+	...MessageAdminAuditCases,
+	...ReportAdminAuditCases,
+	...SearchAdminAuditCases,
+	...SystemAdminAuditCases,
+	...SystemDmAdminAuditCases,
+	...UserAdminAuditCases,
+	...UserWriteAdminAuditCases,
+	...VoiceAdminAuditCases,
+];
+
+const EXEMPT_ROUTES = [
+	'GET /admin/jobs',
+	'GET /admin/jobs/:job_id',
+	'GET /admin/jobs/active',
+	'GET /admin/search/index-refreshes/:job_id',
+	'GET /admin/users/@me',
+];
+
+function registeredAdminRoutes(): Array<string> {
+	const app = new Hono<HonoEnv>();
+	registerAdminControllers(app);
+	return [
+		...new Set(app.routes.filter((route) => route.method !== 'ALL').map((route) => `${route.method} ${route.path}`)),
+	].sort();
+}
+
+describe('Admin audit route coverage', () => {
+	test('every registered admin route has an audit coverage case', () => {
+		expect([...new Set(ALL_CASES.map(adminAuditCaseShape))].sort()).toEqual(registeredAdminRoutes());
+	});
+
+	test('only the identity and polled status reads are exempt from auditing', () => {
+		const exempt = ALL_CASES.filter((coverageCase) => 'exempt' in coverageCase).map(adminAuditCaseShape);
+		expect([...new Set(exempt)].sort()).toEqual(EXEMPT_ROUTES);
+	});
+});
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCases.ts
new file mode 100644
index 000000000..3ed89c363
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCases.ts
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createGuild} from '@app/api/channel/tests/ChannelTestUtils';
+import {createOAuth2Application, createUniqueApplicationName} from '@app/api/oauth/tests/OAuth2TestUtils';
+import {HTTP_STATUS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {Permissions} from '@fluxer/constants/src/ChannelConstants';
+
+const MISSING_APPLICATION_ID = '999999999999999999';
+
+export const ApplicationAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/applications',
+		name: 'owner_id',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			await createOAuth2Application(harness, owner.token, {name: createUniqueApplicationName('Audit Owned App')});
+			return {
+				request: {path: `/admin/applications?owner_id=${owner.userId}`},
+				expected: {
+					action: 'list_user_applications',
+					targetType: 'user',
+					targetId: owner.userId,
+					metadata: {application_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/applications',
+		name: 'guild_id',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const guild = await createGuild(harness, owner.token, 'Audit Application Guild');
+			const app = await createOAuth2Application(harness, owner.token, {
+				name: createUniqueApplicationName('Audit Guild App'),
+				bot_public: true,
+			});
+			await createBuilder(harness, owner.token)
+				.post('/oauth2/authorize/consent')
+				.body({
+					client_id: app.application.id,
+					scope: 'bot',
+					guild_id: guild.id,
+					permissions: Permissions.SEND_MESSAGES.toString(),
+				})
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			return {
+				request: {path: `/admin/applications?guild_id=${guild.id}`},
+				expected: {
+					action: 'list_guild_applications',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {application_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/applications',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			await createOAuth2Application(harness, owner.token, {name: createUniqueApplicationName('Audit First App')});
+			await createOAuth2Application(harness, owner.token, {name: createUniqueApplicationName('Audit Second App')});
+			return {
+				request: {path: `/admin/users/${owner.userId}/applications`},
+				expected: {
+					action: 'list_user_applications',
+					targetType: 'user',
+					targetId: owner.userId,
+					metadata: {application_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/applications/:application_id',
+		name: 'found',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const app = await createOAuth2Application(harness, owner.token, {
+				name: createUniqueApplicationName('Audit Lookup App'),
+			});
+			return {
+				request: {path: `/admin/applications/${app.application.id}`},
+				expected: {
+					action: 'get_application',
+					targetType: 'application',
+					targetId: app.application.id,
+					metadata: {
+						found: 'true',
+						owner_user_id: owner.userId,
+						bot_user_id: app.botUserId,
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/applications/:application_id',
+		name: 'missing',
+		async prepare() {
+			return {
+				request: {path: `/admin/applications/${MISSING_APPLICATION_ID}`},
+				expected: {
+					action: 'get_application',
+					targetType: 'application',
+					targetId: MISSING_APPLICATION_ID,
+					metadata: {found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/applications/:application_id',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const newOwner = await createTestAccount(harness);
+			const app = await createOAuth2Application(harness, owner.token, {
+				name: createUniqueApplicationName('Audit Transferred App'),
+			});
+			return {
+				request: {
+					path: `/admin/applications/${app.application.id}`,
+					body: {new_owner_id: newOwner.userId},
+				},
+				expected: {
+					action: 'transfer_ownership',
+					targetType: 'application',
+					targetId: app.application.id,
+					metadata: {
+						old_owner_id: owner.userId,
+						new_owner_id: newOwner.userId,
+					},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..a36269c0f
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ApplicationAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {ApplicationAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ApplicationAdminAuditCases';
+
+describeAdminAuditCoverage('ApplicationAdminController', ApplicationAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCases.ts
new file mode 100644
index 000000000..0f9e9fb81
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCases.ts
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {AdminArchiveRepository} from '@app/api/admin/repositories/AdminArchiveRepository';
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount, type TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createTestGuild} from '@app/api/emoji/tests/EmojiTestUtils';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {HTTP_STATUS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {expect} from 'vitest';
+
+const MISSING_ARCHIVE_ID = '800000000000000201';
+
+async function createGuildArchive(
+	harness: ApiTestHarness,
+	admin: TestAccount,
+): Promise<{guildId: string; archiveId: string}> {
+	const owner = await createTestAccount(harness);
+	const guild = await createTestGuild(harness, owner.token);
+	const archive = await createBuilder<{archive_id: string}>(harness, admin.token)
+		.post(`/admin/guilds/${guild.id}/archives`)
+		.body({})
+		.expect(HTTP_STATUS.OK)
+		.execute();
+	return {guildId: guild.id, archiveId: archive.archive_id};
+}
+
+export const ArchiveAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/users/:user_id/archives',
+		async prepare({harness}) {
+			const subject = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${subject.userId}/archives`, body: {include_attachments: true}},
+				expected: {
+					action: 'trigger_user_archive',
+					targetType: 'user',
+					targetId: subject.userId,
+					metadata: {archive_id: expect.any(String), include_attachments: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/guilds/:guild_id/archives',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const guild = await createTestGuild(harness, owner.token);
+			return {
+				request: {path: `/admin/guilds/${guild.id}/archives`, body: {}},
+				expected: {
+					action: 'trigger_guild_archive',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {archive_id: expect.any(String), include_attachments: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/archives',
+		name: 'by subject',
+		async prepare({harness, admin}) {
+			const {guildId} = await createGuildArchive(harness, admin);
+			return {
+				request: {path: `/admin/archives?subject_type=guild&subject_id=${guildId}&limit=10`},
+				expected: {
+					action: 'list_archives',
+					targetType: 'archive',
+					targetId: '0',
+					metadata: {
+						subject_type: 'guild',
+						subject_guild_id: guildId,
+						limit: '10',
+						include_expired: 'false',
+						result_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/archives',
+		name: 'by requester',
+		async prepare({harness, admin}) {
+			await createGuildArchive(harness, admin);
+			return {
+				request: {path: `/admin/archives?requested_by=${admin.userId}&include_expired=true`},
+				expected: {
+					action: 'list_archives',
+					targetType: 'archive',
+					targetId: '0',
+					metadata: {
+						subject_type: 'all',
+						requested_by_user_id: admin.userId,
+						limit: '50',
+						include_expired: 'true',
+						result_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/archives/:subject_type/:subject_id/:archive_id',
+		name: 'found',
+		async prepare({harness, admin}) {
+			const {guildId, archiveId} = await createGuildArchive(harness, admin);
+			return {
+				request: {path: `/admin/archives/guild/${guildId}/${archiveId}`},
+				expected: {
+					action: 'get_archive',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {archive_id: archiveId, found: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/archives/:subject_type/:subject_id/:archive_id',
+		name: 'missing',
+		async prepare({harness}) {
+			const subject = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/archives/user/${subject.userId}/${MISSING_ARCHIVE_ID}`},
+				expected: {
+					action: 'get_archive',
+					targetType: 'user',
+					targetId: subject.userId,
+					metadata: {archive_id: MISSING_ARCHIVE_ID, found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/archives/:subject_type/:subject_id/:archive_id/download',
+		async prepare({harness, admin}) {
+			const {guildId, archiveId} = await createGuildArchive(harness, admin);
+			const repository = new AdminArchiveRepository();
+			const queued = await repository.findBySubjectAndArchiveId('guild', BigInt(guildId), BigInt(archiveId));
+			if (!queued) {
+				throw new Error(`Archive ${archiveId} not found`);
+			}
+			const started = await repository.markAsStarted(queued);
+			await repository.markAsCompleted(
+				started,
+				`test/${archiveId}.zip`,
+				1024n,
+				new Date(Date.now() + 6 * 24 * 60 * 60 * 1000),
+			);
+			return {
+				request: {path: `/admin/archives/guild/${guildId}/${archiveId}/download`},
+				expected: {
+					action: 'get_archive_download_url',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {archive_id: archiveId},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..27af3e833
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ArchiveAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {ArchiveAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ArchiveAdminAuditCases';
+
+describeAdminAuditCoverage('ArchiveAdminController', ArchiveAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCases.ts
new file mode 100644
index 000000000..a648f9b49
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCases.ts
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createGuild} from '@app/api/message/tests/MessageTestUtils';
+
+const UNKNOWN_ASSET_ID = '900000000000000002';
+
+export const AssetAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'DELETE',
+		route: '/admin/guilds/:guild_id/assets',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Asset Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/assets`, body: {ids: [UNKNOWN_ASSET_ID]}},
+				expected: {
+					action: 'purge_asset',
+					targetType: 'asset',
+					targetId: UNKNOWN_ASSET_ID,
+					metadata: {asset_type: 'unknown'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..bd818672b
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AssetAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {AssetAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AssetAdminAuditCases';
+
+describeAdminAuditCoverage('AssetAdminController', AssetAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCases.ts
new file mode 100644
index 000000000..cfc54fb0c
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCases.ts
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createUserID} from '@app/api/BrandedTypes';
+import {getAdminRepository} from '@app/api/middleware/ServiceSingletons';
+
+const SEEDED_LOG_ID = 800000000000000001n;
+
+async function seedWriteEntry(adminUserId: string): Promise<void> {
+	await getAdminRepository().createAuditLog({
+		log_id: SEEDED_LOG_ID,
+		admin_user_id: createUserID(BigInt(adminUserId)),
+		target_type: 'user',
+		target_id: BigInt(adminUserId),
+		action: 'update_flags',
+		audit_log_reason: null,
+		metadata: new Map(),
+		created_at: new Date(),
+	});
+}
+
+export const AuditLogAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/audit-logs',
+		name: 'list',
+		async prepare({admin}) {
+			await seedWriteEntry(admin.userId);
+			return {
+				request: {path: `/admin/audit-logs?access=write&target_id=${admin.userId}&limit=10`},
+				expected: {
+					action: 'list_audit_logs',
+					targetType: 'audit_log',
+					targetId: '0',
+					metadata: {
+						filter_target_id: admin.userId,
+						access: 'write',
+						limit: '10',
+						offset: '0',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/audit-logs',
+		name: 'search',
+		search: 'enabled',
+		async prepare({admin}) {
+			return {
+				request: {
+					path: `/admin/audit-logs?q=flags&admin_user_id=${admin.userId}&target_type=user&access=read&sort_by=relevance`,
+				},
+				expected: {
+					action: 'search_audit_logs',
+					targetType: 'audit_log',
+					targetId: '0',
+					metadata: {
+						filter_admin_user_id: admin.userId,
+						filter_target_type: 'user',
+						access: 'read',
+						sort_by: 'relevance',
+						sort_order: 'desc',
+						limit: '50',
+						offset: '0',
+						result_count: '0',
+						total: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/audit-logs',
+		name: 'free-text target type',
+		async prepare() {
+			return {
+				request: {path: `/admin/audit-logs?target_type=${encodeURIComponent('someone@example.com')}`},
+				expected: {
+					action: 'list_audit_logs',
+					targetType: 'audit_log',
+					targetId: '0',
+					metadata: {
+						has_target_type_filter: 'true',
+						limit: '50',
+						offset: '0',
+						result_count: '0',
+						total: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/audit-logs/:log_id',
+		async prepare({admin}) {
+			await seedWriteEntry(admin.userId);
+			return {
+				request: {path: `/admin/audit-logs/${SEEDED_LOG_ID}`},
+				expected: {
+					action: 'get_audit_log',
+					targetType: 'audit_log',
+					targetId: SEEDED_LOG_ID.toString(),
+					metadata: {},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..dd7b2ca28
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/AuditLogAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {AuditLogAdminAuditCases} from '@app/api/admin/tests/audit_coverage/AuditLogAdminAuditCases';
+
+describeAdminAuditCoverage('AuditLogAdminController', AuditLogAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCases.ts
new file mode 100644
index 000000000..d6a362d19
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCases.ts
@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {
+	AdminAuditCoverageCase,
+	AdminAuditCoverageContext,
+} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {getPngDataUrl} from '@app/api/emoji/tests/EmojiTestUtils';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {updateAvatar} from '@app/api/user/tests/UserTestUtils';
+import {expect} from 'vitest';
+
+const FILE_SHA = 'a1'.repeat(32);
+const SECOND_FILE_SHA = 'b2'.repeat(32);
+const AVATAR_HASH = '0123abcd';
+
+async function addBlocklistEntry(
+	{harness, admin}: AdminAuditCoverageContext,
+	listType: string,
+	body: Record<string, unknown>,
+): Promise<void> {
+	await createBuilder(harness, admin.token)
+		.post(`/admin/blocklists/${listType}/entries`)
+		.body(body)
+		.expect(204)
+		.execute();
+}
+
+export const BanAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/blocklists',
+		async prepare() {
+			return {
+				request: {path: '/admin/blocklists'},
+				expected: {
+					action: 'list_blocklists',
+					targetType: 'blocklist',
+					targetId: '0',
+					metadata: {result_count: '9'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/blocklists/:list_type/entries',
+		name: 'file-sha',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'file-sha', {sha256_hex: FILE_SHA});
+			await addBlocklistEntry(context, 'file-sha', {sha256_hex: SECOND_FILE_SHA});
+			return {
+				request: {path: '/admin/blocklists/file-sha/entries?limit=1'},
+				expected: {
+					action: 'list_blocklist_entries',
+					targetType: 'file_sha',
+					targetId: '0',
+					metadata: {
+						list_type: 'file-sha',
+						limit: '1',
+						result_count: '1',
+						has_more: 'true',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/blocklists/:list_type/entries',
+		name: 'profile-substring after a cursor',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'profile-substring', {scope: 'bio', substrings: ['alpha', 'beta']});
+			return {
+				request: {path: '/admin/blocklists/profile-substring/entries?scope=bio&after=alpha'},
+				expected: {
+					action: 'list_blocklist_entries',
+					targetType: 'profile_substring',
+					targetId: '0',
+					metadata: {
+						list_type: 'profile-substring',
+						scope: 'bio',
+						limit: '50',
+						has_after: 'true',
+						result_count: '1',
+						has_more: 'false',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/blocklists/:list_type/entries',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/blocklists/file-sha/entries',
+					body: {sha256_hex: FILE_SHA},
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'ban_file_sha',
+					targetType: 'file_sha',
+					targetId: '0',
+					metadata: {sha256: FILE_SHA},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/blocklists/:list_type/entries',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/blocklists/file-sha/entries',
+					body: {sha256_list: [FILE_SHA, SECOND_FILE_SHA]},
+				},
+				expected: {
+					action: 'queue_bulk_job',
+					targetType: 'bulk_job',
+					targetId: expect.any(String),
+					metadata: {task: 'ban_file_shas', entity_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/blocklists/:list_type/entries',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'avatar-hash', {hashes: [AVATAR_HASH]});
+			return {
+				request: {
+					path: '/admin/blocklists/avatar-hash/entries',
+					body: {hashes: [AVATAR_HASH]},
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'unban_avatar_hash',
+					targetType: 'avatar_hash',
+					targetId: '0',
+					metadata: {hash_short: AVATAR_HASH},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/blocklists/:list_type/entries/:entry_value',
+		name: 'file-sha banned',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'file-sha', {sha256_hex: FILE_SHA});
+			return {
+				request: {path: `/admin/blocklists/file-sha/entries/${FILE_SHA}`},
+				expected: {
+					action: 'check_blocklist_entry',
+					targetType: 'file_sha',
+					targetId: '0',
+					metadata: {list_type: 'file-sha', banned: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/blocklists/:list_type/entries/:entry_value',
+		name: 'profile-substring not banned',
+		async prepare() {
+			return {
+				request: {path: '/admin/blocklists/profile-substring/entries/gamma?scope=username'},
+				expected: {
+					action: 'check_blocklist_entry',
+					targetType: 'profile_substring',
+					targetId: '0',
+					metadata: {list_type: 'profile-substring', scope: 'username', banned: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/blocklists/:list_type/entries/:entry_value',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'file-sha', {sha256_hex: FILE_SHA});
+			return {
+				request: {
+					path: `/admin/blocklists/file-sha/entries/${FILE_SHA}`,
+					body: {severity: 3},
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'ban_file_sha',
+					targetType: 'file_sha',
+					targetId: '0',
+					metadata: {sha256: FILE_SHA},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/blocklists/:list_type/entries/:entry_value',
+		async prepare(context) {
+			await addBlocklistEntry(context, 'file-sha', {sha256_hex: FILE_SHA});
+			return {
+				request: {
+					path: `/admin/blocklists/file-sha/entries/${FILE_SHA}`,
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'unban_file_sha',
+					targetType: 'file_sha',
+					targetId: '0',
+					metadata: {sha256: FILE_SHA},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/users/:user_id/avatar-block',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const updated = await updateAvatar(harness, target.token, getPngDataUrl());
+			const hashShort = (updated.avatar ?? '').toLowerCase().replace(/^a_/, '');
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/avatar-block`,
+					body: {reason: 'spam'},
+				},
+				expected: {
+					action: 'ban_avatar_hash',
+					targetType: 'avatar_hash',
+					targetId: '0',
+					metadata: {hash_short: hashShort, reason: 'spam'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..409e7c575
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/BanAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {BanAdminAuditCases} from '@app/api/admin/tests/audit_coverage/BanAdminAuditCases';
+
+describeAdminAuditCoverage('BanAdminController', BanAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCases.ts
new file mode 100644
index 000000000..391042362
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCases.ts
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createTestGuild} from '@app/api/emoji/tests/EmojiTestUtils';
+import {expect} from 'vitest';
+
+export const BulkAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/bulk-jobs',
+		name: 'update_user_flags',
+		async prepare({harness}) {
+			const first = await createTestAccount(harness);
+			const second = await createTestAccount(harness);
+			return {
+				request: {
+					path: '/admin/bulk-jobs',
+					body: {task: 'update_user_flags', user_ids: [first.userId, second.userId], add_flags: [], remove_flags: []},
+				},
+				expected: {
+					action: 'queue_bulk_job',
+					targetType: 'bulk_job',
+					targetId: expect.any(String),
+					metadata: {task: 'update_user_flags', entity_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/bulk-jobs',
+		name: 'update_guild_features',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const guild = await createTestGuild(harness, owner.token);
+			return {
+				request: {
+					path: '/admin/bulk-jobs',
+					body: {task: 'update_guild_features', guild_ids: [guild.id], add_features: [], remove_features: []},
+				},
+				expected: {
+					action: 'queue_bulk_job',
+					targetType: 'bulk_job',
+					targetId: expect.any(String),
+					metadata: {task: 'update_guild_features', entity_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/bulk-jobs',
+		name: 'add_guild_members',
+		async prepare({harness}) {
+			const owner = await createTestAccount(harness);
+			const guild = await createTestGuild(harness, owner.token);
+			const member = await createTestAccount(harness);
+			return {
+				request: {
+					path: '/admin/bulk-jobs',
+					body: {task: 'add_guild_members', guild_id: guild.id, user_ids: [member.userId]},
+				},
+				expected: {
+					action: 'queue_bulk_job',
+					targetType: 'bulk_job',
+					targetId: expect.any(String),
+					metadata: {task: 'add_guild_members', entity_count: '1', guild_id: guild.id},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..6a6a7a473
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/BulkAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {BulkAdminAuditCases} from '@app/api/admin/tests/audit_coverage/BulkAdminAuditCases';
+
+describeAdminAuditCoverage('BulkAdminController', BulkAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCases.ts
new file mode 100644
index 000000000..7a01424d0
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCases.ts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+
+export const CodesAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/gift-codes',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/gift-codes',
+					body: {count: 2, duration_type: 'months', duration_quantity: 3},
+				},
+				expected: {
+					action: 'generate_gift_codes',
+					targetType: 'gift_code',
+					targetId: '0',
+					metadata: {count: '2', duration_type: 'months', duration_quantity: '3'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..d0c374218
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/CodesAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {CodesAdminAuditCases} from '@app/api/admin/tests/audit_coverage/CodesAdminAuditCases';
+
+describeAdminAuditCoverage('CodesAdminController', CodesAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCases.ts
new file mode 100644
index 000000000..ff039b58b
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCases.ts
@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {
+	AdminAuditCoverageCase,
+	AdminAuditCoverageContext,
+} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createGuildID} from '@app/api/BrandedTypes';
+import {GuildDiscoveryRepository} from '@app/api/guild/repositories/GuildDiscoveryRepository';
+import {createGuild} from '@app/api/guild/tests/GuildTestUtils';
+import {
+	DiscoveryApplicationStatus,
+	DiscoveryCategories,
+	type DiscoveryCategory,
+} from '@fluxer/constants/src/DiscoveryConstants';
+
+async function seedDiscoveryGuild(
+	{harness}: AdminAuditCoverageContext,
+	status: string,
+	categoryType: DiscoveryCategory = DiscoveryCategories.GAMING,
+): Promise<string> {
+	const owner = await createTestAccount(harness);
+	const guild = await createGuild(harness, owner.token, 'Audit Discovery Guild');
+	const now = new Date();
+	await new GuildDiscoveryRepository().upsert({
+		guild_id: createGuildID(BigInt(guild.id)),
+		status,
+		category_type: categoryType,
+		description: 'Audit coverage discovery listing',
+		primary_language: null,
+		custom_tags: [],
+		applied_at: now,
+		reviewed_at: status === DiscoveryApplicationStatus.APPROVED ? now : null,
+		reviewed_by: null,
+		review_reason: null,
+		removed_at: null,
+		removed_by: null,
+		removal_reason: null,
+	});
+	return guild.id;
+}
+
+export const DiscoveryAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/discovery/applications',
+		async prepare(context) {
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.PENDING);
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			return {
+				request: {path: '/admin/discovery/applications'},
+				expected: {
+					action: 'list_discovery_applications',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {result_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/discovery/applications/:guild_id',
+		name: 'approve',
+		async prepare(context) {
+			const guildId = await seedDiscoveryGuild(context, DiscoveryApplicationStatus.PENDING);
+			return {
+				request: {
+					path: `/admin/discovery/applications/${guildId}`,
+					body: {status: 'approved', reason: 'Meets every requirement'},
+				},
+				expected: {
+					action: 'approve_discovery_application',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {status: 'approved'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/discovery/applications/:guild_id',
+		name: 'reject',
+		async prepare(context) {
+			const guildId = await seedDiscoveryGuild(context, DiscoveryApplicationStatus.PENDING);
+			return {
+				request: {
+					path: `/admin/discovery/applications/${guildId}`,
+					body: {status: 'rejected', reason: 'Description is too vague'},
+				},
+				expected: {
+					action: 'reject_discovery_application',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {status: 'rejected'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/discovery/categories',
+		async prepare() {
+			return {
+				request: {path: '/admin/discovery/categories'},
+				expected: {
+					action: 'list_discovery_categories',
+					targetType: 'discovery_category',
+					targetId: '0',
+					metadata: {result_count: '9'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/discovery/categories/:category_id/listings',
+		async prepare(context) {
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED, DiscoveryCategories.MUSIC);
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED, DiscoveryCategories.MUSIC);
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED, DiscoveryCategories.GAMING);
+			return {
+				request: {path: `/admin/discovery/categories/${DiscoveryCategories.MUSIC}/listings?limit=1&offset=1`},
+				expected: {
+					action: 'list_discovery_category_listings',
+					targetType: 'discovery_category',
+					targetId: '0',
+					metadata: {
+						category_id: DiscoveryCategories.MUSIC.toString(),
+						limit: '1',
+						offset: '1',
+						result_count: '1',
+						total: '2',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/discovery/listings',
+		async prepare(context) {
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			await seedDiscoveryGuild(context, DiscoveryApplicationStatus.PENDING);
+			return {
+				request: {path: '/admin/discovery/listings'},
+				expected: {
+					action: 'list_discovery_listings',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {result_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/discovery/listings',
+		async prepare(context) {
+			const guildId = await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			return {
+				request: {
+					path: '/admin/discovery/listings',
+					body: {guild_ids: [guildId], category_type: DiscoveryCategories.EDUCATION},
+				},
+				expected: {
+					action: 'update_discovery_categories',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {
+						category_type: DiscoveryCategories.EDUCATION.toString(),
+						guild_count: '1',
+						updated: '1',
+						failed: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/discovery/listings/:guild_id',
+		async prepare(context) {
+			const guildId = await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			return {
+				request: {
+					path: `/admin/discovery/listings/${guildId}`,
+					body: {
+						description: 'A corrected discovery description',
+						category_type: DiscoveryCategories.MUSIC,
+						primary_language: 'fr',
+						custom_tags: ['makers'],
+					},
+				},
+				expected: {
+					action: 'update_discovery_listing',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {
+						fields: 'description,category_type,primary_language,custom_tags',
+						category_type: DiscoveryCategories.MUSIC.toString(),
+						primary_language: 'fr',
+						status: 'approved',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/discovery/listings/:guild_id',
+		async prepare(context) {
+			const guildId = await seedDiscoveryGuild(context, DiscoveryApplicationStatus.APPROVED);
+			return {
+				request: {
+					path: `/admin/discovery/listings/${guildId}`,
+					body: {reason: 'No longer meets the guidelines'},
+				},
+				expected: {
+					action: 'remove_discovery_listing',
+					targetType: 'guild',
+					targetId: guildId,
+					metadata: {},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..718a41104
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/DiscoveryAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {DiscoveryAdminAuditCases} from '@app/api/admin/tests/audit_coverage/DiscoveryAdminAuditCases';
+
+describeAdminAuditCoverage('DiscoveryAdminController', DiscoveryAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCases.ts
new file mode 100644
index 000000000..8c7de53a5
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCases.ts
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createGuild} from '@app/api/guild/tests/GuildTestUtils';
+
+export const GatewayAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/gateway/stats',
+		async prepare() {
+			return {
+				request: {path: '/admin/gateway/stats'},
+				expected: {
+					action: 'get_gateway_stats',
+					targetType: 'gateway',
+					targetId: '0',
+					metadata: {node_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/gateway/memory-stats',
+		async prepare() {
+			return {
+				request: {path: '/admin/gateway/memory-stats?limit=250'},
+				expected: {
+					action: 'list_guild_memory_stats',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {limit: '250', result_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/gateway/voice-state-counts',
+		async prepare() {
+			return {
+				request: {path: '/admin/gateway/voice-state-counts'},
+				expected: {
+					action: 'get_voice_state_counts',
+					targetType: 'gateway',
+					targetId: '0',
+					metadata: {total_voice_states: '0', region_count: '0', server_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/gateway/reloads',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Reload coverage guild');
+			return {
+				request: {path: '/admin/gateway/reloads', body: {guild_ids: [guild.id]}},
+				expected: {
+					action: 'reload_guilds',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {guild_count: '1', reloaded: '0'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..50c26f2db
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/GatewayAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {GatewayAdminAuditCases} from '@app/api/admin/tests/audit_coverage/GatewayAdminAuditCases';
+
+describeAdminAuditCoverage('GatewayAdminController', GatewayAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCases.ts
new file mode 100644
index 000000000..c584b0859
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCases.ts
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount, type TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createGuild} from '@app/api/message/tests/MessageTestUtils';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {AuditLogActionType} from '@fluxer/constants/src/AuditLogActionType';
+
+const MISSING_GUILD_ID = '900000000000000001';
+
+async function addMember(
+	harness: ApiTestHarness,
+	admin: TestAccount,
+	guildId: string,
+	member: TestAccount,
+): Promise<void> {
+	await createBuilder(harness, admin.token)
+		.put(`/admin/guilds/${guildId}/members/${member.userId}`)
+		.body(null)
+		.expect(200)
+		.execute();
+}
+
+export const GuildAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/guilds',
+		search: 'enabled',
+		async prepare({harness, admin}) {
+			const name = `Audit Search Guild ${Date.now()}`;
+			await createGuild(harness, admin.token, name);
+			return {
+				request: {path: `/admin/guilds?q=${encodeURIComponent(name)}&limit=10`},
+				expected: {
+					action: 'search_guilds',
+					targetType: 'guild',
+					targetId: '0',
+					metadata: {
+						has_query: 'true',
+						limit: '10',
+						offset: '0',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id',
+		name: 'found',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Detail Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}`},
+				expected: {
+					action: 'get_guild',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {found: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id',
+		name: 'missing',
+		async prepare() {
+			return {
+				request: {path: `/admin/guilds/${MISSING_GUILD_ID}`},
+				expected: {
+					action: 'get_guild',
+					targetType: 'guild',
+					targetId: MISSING_GUILD_ID,
+					metadata: {found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/guilds/:guild_id',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Patch Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}`, body: {name: 'Audit Patched Guild'}},
+				expected: {
+					action: 'update_name',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {old_name: 'Audit Patch Guild', new_name: 'Audit Patched Guild'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/guilds/:guild_id',
+		name: 'empty body',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Empty Patch Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}`, body: {}},
+				expected: {
+					action: 'update_guild',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/guilds/:guild_id',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Deleted Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}`},
+				expected: {
+					action: 'delete_guild',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {guild_id: guild.id},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id/members',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Members Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/members?limit=10&offset=5`},
+				expected: {
+					action: 'list_guild_members',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {limit: '10', offset: '5', result_count: '0', total: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/guilds/:guild_id/members/:user_id',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Force Add Guild');
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/guilds/${guild.id}/members/${target.userId}`},
+				expected: {
+					action: 'force_add_to_guild',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {guild_id: guild.id},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/guilds/:guild_id/members/:user_id',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Kick Guild');
+			const target = await createTestAccount(harness);
+			await addMember(harness, admin, guild.id, target);
+			return {
+				request: {path: `/admin/guilds/${guild.id}/members/${target.userId}`, expectStatus: 204},
+				expected: {
+					action: 'kick_member',
+					targetType: 'guild_member',
+					targetId: target.userId,
+					metadata: {guild_id: guild.id, user_id: target.userId},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/guilds/:guild_id/bans/:user_id',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Ban Guild');
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/guilds/${guild.id}/bans/${target.userId}`, body: {}, expectStatus: 204},
+				expected: {
+					action: 'ban_member',
+					targetType: 'guild_member',
+					targetId: target.userId,
+					metadata: {guild_id: guild.id, user_id: target.userId, delete_message_days: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id/emojis',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Emoji Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/emojis`},
+				expected: {
+					action: 'list_guild_emojis',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {result_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id/stickers',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Sticker Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/stickers`},
+				expected: {
+					action: 'list_guild_stickers',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {result_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/guilds/:guild_id/audit-logs',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Log Guild');
+			await createBuilder(harness, admin.token)
+				.patch(`/guilds/${guild.id}`)
+				.body({name: 'Audit Log Guild Renamed'})
+				.expect(200)
+				.execute();
+			return {
+				request: {
+					path: `/admin/guilds/${guild.id}/audit-logs?limit=10&user_id=${admin.userId}&action_type=${AuditLogActionType.GUILD_UPDATE}`,
+				},
+				expected: {
+					action: 'list_guild_audit_logs',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {
+						limit: '10',
+						filter_user_id: admin.userId,
+						action_type: String(AuditLogActionType.GUILD_UPDATE),
+						result_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/guilds/:guild_id/reloads',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Reload Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/reloads`},
+				expected: {
+					action: 'reload_guild',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {guild_id: guild.id},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/guilds/:guild_id/shutdowns',
+		async prepare({harness, admin}) {
+			const guild = await createGuild(harness, admin.token, 'Audit Shutdown Guild');
+			return {
+				request: {path: `/admin/guilds/${guild.id}/shutdowns`},
+				expected: {
+					action: 'shutdown_guild',
+					targetType: 'guild',
+					targetId: guild.id,
+					metadata: {guild_id: guild.id},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..6eb358272
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/GuildAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {GuildAdminAuditCases} from '@app/api/admin/tests/audit_coverage/GuildAdminAuditCases';
+
+describeAdminAuditCoverage('GuildAdminController', GuildAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCases.ts
new file mode 100644
index 000000000..87e8e141f
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCases.ts
@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {
+	createUniqueEmail,
+	createUniqueUsername,
+	registerUser,
+	type TestAccount,
+} from '@app/api/auth/tests/AuthTestUtils';
+import {getPngDataUrl} from '@app/api/emoji/tests/EmojiTestUtils';
+import {getInstanceConfigRepository} from '@app/api/middleware/ServiceSingletons';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {HTTP_STATUS, TEST_IDS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import type {CreateRegistrationUrlResponse} from '@fluxer/schema/src/domains/admin/AdminSchemas';
+
+async function createRegistrationUrl(harness: ApiTestHarness, admin: TestAccount): Promise<string> {
+	const created = await createBuilder<CreateRegistrationUrlResponse>(harness, admin.token)
+		.post('/admin/instance/registration-urls')
+		.body({approval_required: false})
+		.expect(HTTP_STATUS.OK)
+		.execute();
+	return created.registration_url.id;
+}
+
+export const InstanceConfigAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/instance/config',
+		name: 'admin acl',
+		async prepare({harness, admin}) {
+			await createRegistrationUrl(harness, admin);
+			return {
+				request: {path: '/admin/instance/config'},
+				expected: {
+					action: 'get_instance_config',
+					targetType: 'instance_config',
+					targetId: '0',
+					metadata: {registration_url_count: '1', pending_registration_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/instance/config',
+		name: 'setup session',
+		async prepare() {
+			await getInstanceConfigRepository().setAppPublicConfig({setup: {configured: false}});
+			return {
+				request: {path: '/admin/instance/config'},
+				expected: {
+					action: 'get_instance_config',
+					targetType: 'instance_config',
+					targetId: '0',
+					metadata: {registration_url_count: '0', pending_registration_count: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/instance/config',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/instance/config',
+					body: {
+						registration: {mode: 'approval'},
+						experiment_delivery: {poll_interval_seconds: 600},
+						sso: null,
+					},
+				},
+				expected: {
+					action: 'update_instance_config',
+					targetType: 'instance_config',
+					targetId: '0',
+					metadata: {sections: 'experiment_delivery,registration'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/instance/config/branding-assets',
+		async prepare() {
+			return {
+				request: {path: '/admin/instance/config/branding-assets', body: {kind: 'icon', image: getPngDataUrl()}},
+				expected: {
+					action: 'upload_branding_asset',
+					targetType: 'instance_config',
+					targetId: '0',
+					metadata: {kind: 'icon', cleared: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/instance/config/smtp-tests',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/instance/config/smtp-tests',
+					body: {host: '127.0.0.1', port: 1, username: 'coverage', password: 'coverage-password', secure: false},
+				},
+				expected: {
+					action: 'test_smtp_connection',
+					targetType: 'instance_config',
+					targetId: '0',
+					metadata: {port: '1', secure: 'false', ok: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/instance/registration-urls',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/instance/registration-urls',
+					body: {label: 'Coverage invite', max_uses: 5, approval_required: true},
+				},
+				expected: {
+					action: 'create_registration_url',
+					targetType: 'registration_url',
+					targetId: '0',
+					metadata: {approval_required: 'true', max_uses: '5'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/instance/registration-urls/:registration_url_id',
+		async prepare({harness, admin}) {
+			const registrationUrlId = await createRegistrationUrl(harness, admin);
+			return {
+				request: {path: `/admin/instance/registration-urls/${registrationUrlId}`},
+				expected: {
+					action: 'revoke_registration_url',
+					targetType: 'registration_url',
+					targetId: '0',
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/instance/pending-registrations/:user_id',
+		async prepare({harness}) {
+			await getInstanceConfigRepository().setRegistrationConfig({mode: 'approval'});
+			const pending = await registerUser(harness, {
+				email: createUniqueEmail('coverage-pending'),
+				username: createUniqueUsername('coveragepending'),
+				global_name: 'Coverage Pending',
+				password: 'coverage-pending-password',
+				date_of_birth: '2000-01-01',
+				consent: true,
+			});
+			return {
+				request: {path: `/admin/instance/pending-registrations/${pending.user_id}`, body: {status: 'approved'}},
+				expected: {
+					action: 'approve_registration',
+					targetType: 'user',
+					targetId: pending.user_id,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/instance/pending-registrations/:user_id',
+		name: 'missing account',
+		async prepare() {
+			await getInstanceConfigRepository().setRegistrationConfig({mode: 'approval'});
+			return {
+				request: {
+					path: `/admin/instance/pending-registrations/${TEST_IDS.NONEXISTENT_USER}`,
+					body: {status: 'rejected'},
+				},
+				expected: {
+					action: 'reject_registration',
+					targetType: 'user',
+					targetId: TEST_IDS.NONEXISTENT_USER,
+					metadata: {account_found: 'false'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..a4c8af629
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {InstanceConfigAdminAuditCases} from '@app/api/admin/tests/audit_coverage/InstanceConfigAdminAuditCases';
+
+describeAdminAuditCoverage('InstanceConfigAdminController', InstanceConfigAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCases.ts
new file mode 100644
index 000000000..4f509a66c
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCases.ts
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {JobLedgerRepository} from '@app/api/jobs/JobLedgerRepository';
+
+const LEDGER_JOB_ID = 800000000000000101n;
+
+async function seedLedgerJob(requestedByUserId: string): Promise<void> {
+	await new JobLedgerRepository().createJob({
+		jobId: LEDGER_JOB_ID,
+		taskType: 'bulkUpdateUserFlags',
+		payload: {},
+		requestedByUserId: BigInt(requestedByUserId),
+		auditLogReason: null,
+		maxAttempts: 5,
+		runAt: null,
+		jetStreamLane: 'lifecycle',
+		jetStreamSeq: null,
+	});
+}
+
+export const JobsAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/jobs',
+		exempt: true,
+		async prepare({admin}) {
+			await seedLedgerJob(admin.userId);
+			return {request: {path: `/admin/jobs?limit=10&requested_by_user_id=${admin.userId}`}};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/jobs/active',
+		exempt: true,
+		async prepare({admin}) {
+			await seedLedgerJob(admin.userId);
+			return {request: {path: '/admin/jobs/active'}};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/jobs/:job_id',
+		exempt: true,
+		async prepare({admin}) {
+			await seedLedgerJob(admin.userId);
+			return {request: {path: `/admin/jobs/${LEDGER_JOB_ID}`}};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/jobs/:job_id/cancellation',
+		async prepare({admin}) {
+			await seedLedgerJob(admin.userId);
+			return {
+				request: {path: `/admin/jobs/${LEDGER_JOB_ID}/cancellation`, body: {}},
+				expected: {
+					action: 'cancel_job',
+					targetType: 'bulk_job',
+					targetId: LEDGER_JOB_ID.toString(),
+					metadata: {cancelled: 'false'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..225ed66e2
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/JobsAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {JobsAdminAuditCases} from '@app/api/admin/tests/audit_coverage/JobsAdminAuditCases';
+
+describeAdminAuditCoverage('JobsAdminController', JobsAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCases.ts
new file mode 100644
index 000000000..3905947b6
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCases.ts
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import type {TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {HTTP_STATUS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import type {LimitConfigSnapshot} from '@fluxer/limits/src/LimitTypes';
+
+interface LimitConfigReadResponse {
+	limit_config: LimitConfigSnapshot;
+}
+
+async function readLimitConfig(harness: ApiTestHarness, admin: TestAccount): Promise<LimitConfigReadResponse> {
+	return createBuilder<LimitConfigReadResponse>(harness, admin.token)
+		.get('/admin/limit-config')
+		.expect(HTTP_STATUS.OK)
+		.execute();
+}
+
+export const LimitConfigAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/limit-config',
+		async prepare({harness, admin}) {
+			const current = await readLimitConfig(harness, admin);
+			return {
+				request: {path: '/admin/limit-config'},
+				expected: {
+					action: 'get_limit_config',
+					targetType: 'limit_config',
+					targetId: '0',
+					metadata: {rule_count: String(current.limit_config.rules.length)},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/limit-config',
+		async prepare({harness, admin}) {
+			const current = await readLimitConfig(harness, admin);
+			const rules = current.limit_config.rules.map((rule) => ({
+				id: rule.id,
+				filters: rule.filters,
+				limits: rule.id === 'default' ? {...rule.limits, max_guilds: (rule.limits.max_guilds ?? 0) + 1} : rule.limits,
+			}));
+			const traitDefinitions = [...current.limit_config.traitDefinitions, 'coverage'];
+			return {
+				request: {
+					path: '/admin/limit-config',
+					body: {
+						limit_config: {
+							traitDefinitions,
+							rules: [...rules, {id: 'coverage', filters: {traits: ['coverage']}, limits: {max_guilds: 5}}],
+						},
+					},
+				},
+				expected: {
+					action: 'update_limit_config',
+					targetType: 'limit_config',
+					targetId: '0',
+					metadata: {
+						rule_count: String(rules.length + 1),
+						changed_rule_count: '2',
+						trait_definition_count: String(traitDefinitions.length),
+					},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..8519779cb
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/LimitConfigAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {LimitConfigAdminAuditCases} from '@app/api/admin/tests/audit_coverage/LimitConfigAdminAuditCases';
+
+describeAdminAuditCoverage('LimitConfigAdminController', LimitConfigAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCases.ts
new file mode 100644
index 000000000..c2fb6d75a
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCases.ts
@@ -0,0 +1,266 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount, type TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createChannel, createGuild} from '@app/api/channel/tests/AttachmentTestUtils';
+import {markChannelAsIndexed, sendMessage} from '@app/api/message/tests/MessageTestUtils';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {createMessageWithImageAttachment} from '@app/api/user/tests/FavoriteMemeTestUtils';
+import {expect} from 'vitest';
+
+const UNKNOWN_ATTACHMENT_ID = '900000000000000003';
+const UNKNOWN_SHRED_JOB_ID = '900000000000000004';
+
+async function createAuthorChannel(harness: ApiTestHarness): Promise<{author: TestAccount; channelId: string}> {
+	const author = await createTestAccount(harness);
+	const guild = await createGuild(harness, author.token, 'Audit Message Guild');
+	const channel = await createChannel(harness, author.token, guild.id, 'audit-messages');
+	return {author, channelId: channel.id};
+}
+
+export const MessageAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/messages',
+		name: 'search',
+		search: 'enabled',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			await markChannelAsIndexed(harness, channelId);
+			await sendMessage(harness, author.token, channelId, 'quarterly harbour report');
+			return {
+				request: {path: `/admin/messages?channel_id=${channelId}&q=harbour&limit=10`},
+				expected: {
+					action: 'search_messages',
+					targetType: 'channel',
+					targetId: channelId,
+					metadata: {mode: 'search', has_query: 'true', limit: '10', result_count: '1', total: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/messages',
+		name: 'message',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const message = await sendMessage(harness, author.token, channelId, 'lookup target');
+			return {
+				request: {path: `/admin/messages?channel_id=${channelId}&message_id=${message.id}&context_limit=10`},
+				expected: {
+					action: 'search_messages',
+					targetType: 'message',
+					targetId: message.id,
+					metadata: {
+						mode: 'message',
+						channel_id: channelId,
+						context_limit: '10',
+						found: 'true',
+						result_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/messages',
+		name: 'attachment',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const message = await createMessageWithImageAttachment(harness, author.token, channelId);
+			const attachment = message.attachments[0];
+			return {
+				request: {
+					path: `/admin/messages?channel_id=${channelId}&attachment_id=${attachment.id}&filename=${encodeURIComponent(attachment.filename)}`,
+				},
+				expected: {
+					action: 'search_messages',
+					targetType: 'channel',
+					targetId: channelId,
+					metadata: {
+						mode: 'attachment',
+						attachment_id: attachment.id,
+						message_id: message.id,
+						context_limit: '50',
+						found: 'true',
+						result_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/messages',
+		name: 'attachment not found',
+		async prepare({harness}) {
+			const {channelId} = await createAuthorChannel(harness);
+			return {
+				request: {
+					path: `/admin/messages?channel_id=${channelId}&attachment_id=${UNKNOWN_ATTACHMENT_ID}&filename=missing.png`,
+				},
+				expected: {
+					action: 'search_messages',
+					targetType: 'channel',
+					targetId: channelId,
+					metadata: {
+						mode: 'attachment',
+						attachment_id: UNKNOWN_ATTACHMENT_ID,
+						context_limit: '50',
+						found: 'false',
+						result_count: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/messages/ncmec-reports',
+		auditLogReason: expect.stringMatching(/^NCMEC Report \S+ - \S+$/),
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const message = await createMessageWithImageAttachment(harness, author.token, channelId);
+			const attachment = message.attachments[0];
+			return {
+				request: {
+					path: '/admin/messages/ncmec-reports',
+					body: {
+						channel_id: channelId,
+						message_id: message.id,
+						attachment_id: attachment.id,
+						filename: attachment.filename,
+						reporter_full_name: 'Audit Coverage Reporter',
+						confirmed_viewed: true,
+					},
+				},
+				expected: {
+					action: 'NCMEC Report',
+					targetType: 'user',
+					targetId: author.userId,
+					metadata: {
+						channel_id: channelId,
+						message_id: message.id,
+						attachment_id: attachment.id,
+						reported_user_email: author.email,
+						reported_user_email_verified: 'true',
+						reported_user_date_of_birth: '2000-01-01',
+						reported_user_last_active_ip: '127.0.0.1',
+						attachment_upload_mode: 'form_data',
+						attachment_upload_request_ip: '127.0.0.1',
+						attachment_upload_requested_at: expect.any(String),
+						attachment_upload_ip_source: 'attachment upload request handled directly by Fluxer API',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/messages/shreds/:job_id',
+		async prepare() {
+			return {
+				request: {path: `/admin/messages/shreds/${UNKNOWN_SHRED_JOB_ID}`},
+				expected: {
+					action: 'get_message_shred_status',
+					targetType: 'message_shred',
+					targetId: '0',
+					metadata: {job_id: UNKNOWN_SHRED_JOB_ID, status: 'not_found'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/channels/:channel_id/messages',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const first = await sendMessage(harness, author.token, channelId, 'first');
+			await sendMessage(harness, author.token, channelId, 'second');
+			await sendMessage(harness, author.token, channelId, 'third');
+			return {
+				request: {path: `/admin/channels/${channelId}/messages?limit=1&after=${first.id}`},
+				expected: {
+					action: 'list_channel_messages',
+					targetType: 'channel',
+					targetId: channelId,
+					metadata: {limit: '1', after: first.id, result_count: '1', has_more: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/channels/:channel_id/messages/:message_id',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			await sendMessage(harness, author.token, channelId, 'context before');
+			const message = await sendMessage(harness, author.token, channelId, 'detail target');
+			return {
+				request: {path: `/admin/channels/${channelId}/messages/${message.id}`},
+				expected: {
+					action: 'get_message',
+					targetType: 'message',
+					targetId: message.id,
+					metadata: {channel_id: channelId, context_limit: '50', found: 'true', result_count: '2'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/channels/:channel_id/messages/:message_id',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const message = await sendMessage(harness, author.token, channelId, 'delete target');
+			return {
+				request: {path: `/admin/channels/${channelId}/messages/${message.id}`},
+				expected: {
+					action: 'delete_message',
+					targetType: 'message',
+					targetId: message.id,
+					metadata: {channel_id: channelId, message_id: message.id},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/users/:user_id/message-shreds',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			const message = await sendMessage(harness, author.token, channelId, 'shred target');
+			return {
+				request: {
+					path: `/admin/users/${author.userId}/message-shreds`,
+					body: {entries: [{channel_id: channelId, message_id: message.id}]},
+				},
+				expected: {
+					action: 'queue_message_shred',
+					targetType: 'message_shred',
+					targetId: author.userId,
+					metadata: {user_id: author.userId, job_id: expect.any(String), requested_entries: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/messages',
+		async prepare({harness}) {
+			const {author, channelId} = await createAuthorChannel(harness);
+			await sendMessage(harness, author.token, channelId, 'counted message');
+			return {
+				request: {path: `/admin/users/${author.userId}/messages`},
+				expected: {
+					action: 'delete_all_user_messages_dry_run',
+					targetType: 'message_deletion',
+					targetId: author.userId,
+					metadata: {user_id: author.userId, channel_count: '1', message_count: '1', dry_run: 'true'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..c783ea8dc
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/MessageAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {MessageAdminAuditCases} from '@app/api/admin/tests/audit_coverage/MessageAdminAuditCases';
+
+describeAdminAuditCoverage('MessageAdminController', MessageAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCases.ts
new file mode 100644
index 000000000..481b84e4d
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCases.ts
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {
+	AdminAuditCoverageCase,
+	AdminAuditCoverageContext,
+} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+
+interface FiledUserReport {
+	reportId: string;
+	reportedUserId: string;
+}
+
+async function fileUserReport({harness}: AdminAuditCoverageContext): Promise<FiledUserReport> {
+	const reporter = await createTestAccount(harness);
+	const reported = await createTestAccount(harness);
+	const report = await createBuilder<{report_id: string}>(harness, reporter.token)
+		.post('/reports/user')
+		.body({user_id: reported.userId, category: 'harassment'})
+		.execute();
+	return {reportId: report.report_id, reportedUserId: reported.userId};
+}
+
+export const ReportAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/reports',
+		name: 'search',
+		search: 'enabled',
+		async prepare(context) {
+			const {reportedUserId} = await fileUserReport(context);
+			await fileUserReport(context);
+			return {
+				request: {
+					path: `/admin/reports?q=harassment&report_type=user&reported_user_id=${reportedUserId}&sort_by=created_at&sort_order=asc&limit=10`,
+				},
+				expected: {
+					action: 'search_reports',
+					targetType: 'report',
+					targetId: '0',
+					metadata: {
+						has_query: 'true',
+						report_type: 'user',
+						reported_user_id: reportedUserId,
+						sort_by: 'created_at',
+						sort_order: 'asc',
+						limit: '10',
+						offset: '0',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/reports',
+		name: 'status',
+		search: 'enabled',
+		async prepare(context) {
+			await fileUserReport(context);
+			await fileUserReport(context);
+			return {
+				request: {path: '/admin/reports?status=pending&limit=1&offset=1'},
+				expected: {
+					action: 'search_reports',
+					targetType: 'report',
+					targetId: '0',
+					metadata: {
+						status: 'pending',
+						limit: '1',
+						offset: '1',
+						result_count: '1',
+						total: '2',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/reports/:report_id',
+		async prepare(context) {
+			const {reportId} = await fileUserReport(context);
+			return {
+				request: {path: `/admin/reports/${reportId}`},
+				expected: {
+					action: 'get_report',
+					targetType: 'report',
+					targetId: reportId,
+					metadata: {report_type: '1', status: '0'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/reports/:report_id',
+		async prepare(context) {
+			const {reportId} = await fileUserReport(context);
+			return {
+				request: {
+					path: `/admin/reports/${reportId}`,
+					body: {status: 'resolved', public_comment: 'We actioned the account.'},
+				},
+				expected: {
+					action: 'resolve_report',
+					targetType: 'report',
+					targetId: reportId,
+					metadata: {report_id: reportId, report_type: '1'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..f9bda3d2d
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/ReportAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {ReportAdminAuditCases} from '@app/api/admin/tests/audit_coverage/ReportAdminAuditCases';
+
+describeAdminAuditCoverage('ReportAdminController', ReportAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCases.ts
new file mode 100644
index 000000000..2316703d9
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCases.ts
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {expect} from 'vitest';
+
+export const SearchAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/search/indexes/:index_name/refreshes',
+		async prepare({admin}) {
+			return {
+				request: {path: '/admin/search/indexes/favorite_memes/refreshes', body: {user_id: admin.userId}},
+				expected: {
+					action: 'queue_refresh_index',
+					targetType: 'search_index',
+					targetId: '0',
+					metadata: {index_type: 'favorite_memes', job_id: expect.any(String), user_id: admin.userId},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/search/index-refreshes/:job_id',
+		exempt: true,
+		async prepare() {
+			return {request: {path: '/admin/search/index-refreshes/1501314428688998182'}};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..acbfc8d65
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SearchAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {SearchAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SearchAdminAuditCases';
+
+describeAdminAuditCoverage('SearchAdminController', SearchAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCases.ts
new file mode 100644
index 000000000..289f0549e
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCases.ts
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {expect} from 'vitest';
+
+export const SystemAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/system/heap-snapshots',
+		async prepare() {
+			return {
+				request: {path: '/admin/system/heap-snapshots'},
+				expected: {
+					action: 'create_heap_snapshot',
+					targetType: 'system',
+					targetId: '0',
+					metadata: {size_bytes: expect.any(String)},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..32de2d6dd
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SystemAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {SystemAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SystemAdminAuditCases';
+
+describeAdminAuditCoverage('SystemAdminController', SystemAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCases.ts
new file mode 100644
index 000000000..edc80bde6
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCases.ts
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+
+export const SystemDmAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'POST',
+		route: '/admin/system-dms',
+		async prepare({harness}) {
+			const first = await createTestAccount(harness);
+			const second = await createTestAccount(harness);
+			return {
+				request: {
+					path: '/admin/system-dms',
+					body: {content: 'Scheduled maintenance', user_ids: [first.userId, second.userId]},
+				},
+				expected: {
+					action: 'system_dm.send',
+					targetType: 'system_dm',
+					targetId: '0',
+					metadata: {recipient_count: '2', content_length: '21'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..015ae0c5f
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/SystemDmAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {SystemDmAdminAuditCases} from '@app/api/admin/tests/audit_coverage/SystemDmAdminAuditCases';
+
+describeAdminAuditCoverage('SystemDmAdminController', SystemDmAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCases.ts
new file mode 100644
index 000000000..79b074b21
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCases.ts
@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import {
+	createDmChannel,
+	createFriendship,
+	createGroupDmChannel,
+	createGuild,
+} from '@app/api/channel/tests/ChannelTestUtils';
+import {getUserActivityBuffer} from '@app/api/middleware/ServiceSingletons';
+import {HTTP_STATUS, TEST_CREDENTIALS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
+
+const MISSING_USER_ID = '999999999999999999';
+const LAST_ACTIVE_IP = '198.51.100.91';
+
+export const UserAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/acls',
+		async prepare() {
+			return {
+				request: {path: '/admin/acls'},
+				expected: {
+					action: 'list_admin_acls',
+					targetType: 'admin_acl',
+					targetId: '0',
+					metadata: {acl_count: String(Object.values(AdminACLs).length)},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/@me',
+		exempt: true,
+		async prepare() {
+			return {request: {path: '/admin/users/@me'}};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'user_id',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users?user_id=${target.userId}`},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'user_id',
+						user_id: target.userId,
+						user_id_count: '1',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'several user_id',
+		async prepare({harness}) {
+			const first = await createTestAccount(harness);
+			const second = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users?user_id=${first.userId}&user_id=${second.userId}&user_id=${MISSING_USER_ID}`},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'user_id',
+						user_id_count: '3',
+						result_count: '2',
+						total: '2',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'resolve',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users?resolve=${encodeURIComponent(target.email)}`},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'resolve',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'email',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users?email=${encodeURIComponent(target.email)}&limit=10`},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'email',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'last_active_ip',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			await createBuilder(harness, target.token)
+				.get('/users/@me')
+				.header('x-forwarded-for', LAST_ACTIVE_IP)
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			await getUserActivityBuffer().drainAndFlush();
+			return {
+				request: {path: `/admin/users?last_active_ip=${encodeURIComponent(LAST_ACTIVE_IP)}&limit=10&offset=0`},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'last_active_ip',
+						limit: '10',
+						offset: '0',
+						result_count: '1',
+						total: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users',
+		name: 'search',
+		search: 'enabled',
+		async prepare() {
+			return {
+				request: {path: '/admin/users?q=nobody-matches-this-query&limit=25'},
+				expected: {
+					action: 'search_users',
+					targetType: 'user',
+					targetId: '0',
+					metadata: {
+						selector: 'search',
+						has_query: 'true',
+						limit: '25',
+						offset: '0',
+						result_count: '0',
+						total: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id',
+		name: 'found',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}`},
+				expected: {
+					action: 'get_user',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {found: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id',
+		name: 'missing',
+		async prepare() {
+			return {
+				request: {path: `/admin/users/${MISSING_USER_ID}`},
+				expected: {
+					action: 'get_user',
+					targetType: 'user',
+					targetId: MISSING_USER_ID,
+					metadata: {found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/guilds',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			await createGuild(harness, target.token, 'Audit Guild One');
+			const second = await createGuild(harness, target.token, 'Audit Guild Two');
+			return {
+				request: {path: `/admin/users/${target.userId}/guilds?before=${second.id}&limit=50`},
+				expected: {
+					action: 'list_user_guilds',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						before_guild_id: second.id,
+						limit: '50',
+						with_counts: 'false',
+						guild_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/dm-channels',
+		name: 'dm',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const first = await createTestAccount(harness);
+			const second = await createTestAccount(harness);
+			await createFriendship(harness, target, first);
+			await createFriendship(harness, target, second);
+			const firstDm = await createDmChannel(harness, target.token, first.userId);
+			await createDmChannel(harness, target.token, second.userId);
+			return {
+				request: {path: `/admin/users/${target.userId}/dm-channels?after=${firstDm.id}&limit=10`},
+				expected: {
+					action: 'list_user_dm_channels',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						type: 'dm',
+						after_channel_id: firstDm.id,
+						limit: '10',
+						channel_count: '1',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/dm-channels',
+		name: 'group_dm',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const first = await createTestAccount(harness);
+			const second = await createTestAccount(harness);
+			await createFriendship(harness, target, first);
+			await createFriendship(harness, target, second);
+			await createGroupDmChannel(harness, target.token, [first.userId, second.userId]);
+			return {
+				request: {path: `/admin/users/${target.userId}/dm-channels?type=group_dm`},
+				expected: {
+					action: 'list_user_dm_channels',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {type: 'group_dm', channel_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/change-log',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			for (const username of ['auditfirstname', 'auditsecondname']) {
+				await createBuilder(harness, target.token)
+					.patch('/users/@me')
+					.body({username, password: TEST_CREDENTIALS.STRONG_PASSWORD})
+					.expect(HTTP_STATUS.OK)
+					.execute();
+			}
+			return {
+				request: {path: `/admin/users/${target.userId}/change-log?limit=50`},
+				expected: {
+					action: 'list_user_change_log',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						limit: '50',
+						entry_count: '2',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/relationships',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const friend = await createTestAccount(harness);
+			const requested = await createTestAccount(harness);
+			await createFriendship(harness, target, friend);
+			await createBuilder(harness, target.token)
+				.post(`/users/@me/relationships/${requested.userId}`)
+				.body({})
+				.execute();
+			return {
+				request: {path: `/admin/users/${target.userId}/relationships`},
+				expected: {
+					action: 'list_user_relationships',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						friend_count: '1',
+						incoming_request_count: '0',
+						outgoing_request_count: '1',
+						blocked_count: '0',
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/sessions',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/sessions`},
+				expected: {
+					action: 'list_user_sessions',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {session_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/users/:user_id/webauthn-credentials',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/webauthn-credentials`},
+				expected: {
+					action: 'list_webauthn_credentials',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {credential_count: '0'},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..93a3e915c
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/UserAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {UserAdminAuditCases} from '@app/api/admin/tests/audit_coverage/UserAdminAuditCases';
+
+describeAdminAuditCoverage('UserAdminController', UserAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCases.ts
new file mode 100644
index 000000000..d5b85fd91
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCases.ts
@@ -0,0 +1,562 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {
+	AdminAuditCoverageCase,
+	AdminAuditCoverageContext,
+} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {
+	createTestAccount,
+	createTotpSecret,
+	createUniqueEmail,
+	createUniqueUsername,
+	generateTotpCode,
+	type TestAccount,
+} from '@app/api/auth/tests/AuthTestUtils';
+import {
+	createRegistrationResponse,
+	createWebAuthnDevice,
+	type WebAuthnCredentialMetadata,
+	type WebAuthnRegistrationOptions,
+} from '@app/api/auth/tests/WebAuthnTestUtils';
+import {createUserID} from '@app/api/BrandedTypes';
+import {createFriendship} from '@app/api/channel/tests/ChannelTestUtils';
+import {getUserRepository} from '@app/api/middleware/ServiceSingletons';
+import type {User} from '@app/api/models/User';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+import {AdminACLs} from '@fluxer/constants/src/AdminACLs';
+import {DeletionReasons} from '@fluxer/constants/src/Core';
+import {PremiumFlags, SuspiciousActivityFlags, UserFlags} from '@fluxer/constants/src/UserConstants';
+import {expect} from 'vitest';
+
+async function loadUser(account: TestAccount): Promise<User> {
+	const user = await getUserRepository().findUnique(createUserID(BigInt(account.userId)));
+	if (!user) {
+		throw new Error(`User ${account.userId} not found`);
+	}
+	return user;
+}
+
+function adminBuilder({harness, admin}: AdminAuditCoverageContext) {
+	return createBuilder(harness, admin.token);
+}
+
+async function enableTotp(context: AdminAuditCoverageContext, account: TestAccount): Promise<string> {
+	const secret = createTotpSecret();
+	await createBuilder(context.harness, account.token)
+		.post('/users/@me/mfa/totp/enable')
+		.body({secret, code: generateTotpCode(secret), password: account.password})
+		.execute();
+	return secret;
+}
+
+export const UserWriteAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/relationships',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const friend = await createTestAccount(harness);
+			await createFriendship(harness, target, friend);
+			return {
+				request: {path: `/admin/users/${target.userId}/relationships?category=friend`},
+				expected: {
+					action: 'remove_relationships_by_category',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {category: 'friend', removed_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/relationships/:target_user_id',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const friend = await createTestAccount(harness);
+			await createFriendship(harness, target, friend);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/relationships/${friend.userId}?category=friend`,
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'remove_relationship',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {target_user_id: friend.userId, category: 'friend'},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/sessions',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/sessions`},
+				expected: {
+					action: 'terminate_sessions',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/webauthn-credentials/:credential_id',
+		async prepare(context) {
+			const {harness} = context;
+			const target = await createTestAccount(harness);
+			const secret = await enableTotp(context, target);
+			const device = createWebAuthnDevice();
+			const registrationOptions = await createBuilder<WebAuthnRegistrationOptions>(harness, target.token)
+				.post('/users/@me/mfa/webauthn/credentials/registration-options')
+				.body({mfa_method: 'totp', mfa_code: generateTotpCode(secret)})
+				.execute();
+			if (registrationOptions.rp.id) {
+				device.rpId = registrationOptions.rp.id;
+			}
+			await createBuilder(harness, target.token)
+				.post('/users/@me/mfa/webauthn/credentials')
+				.body({
+					response: createRegistrationResponse(device, registrationOptions, 'Coverage Passkey'),
+					challenge: registrationOptions.challenge,
+					name: 'Coverage Passkey',
+					mfa_method: 'totp',
+					mfa_code: generateTotpCode(secret),
+				})
+				.expect(204)
+				.execute();
+			const credentials = await createBuilder<Array<WebAuthnCredentialMetadata>>(harness, target.token)
+				.get('/users/@me/mfa/webauthn/credentials')
+				.execute();
+			const credentialId = credentials[0]!.id;
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/webauthn-credentials/${credentialId}`,
+					expectStatus: 204,
+				},
+				expected: {
+					action: 'delete_webauthn_credential',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {credential_id: credentialId},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/mfa',
+		async prepare(context) {
+			const target = await createTestAccount(context.harness);
+			await enableTotp(context, target);
+			return {
+				request: {path: `/admin/users/${target.userId}/mfa`, expectStatus: 204},
+				expected: {
+					action: 'disable_mfa',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/profile-fields',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/profile-fields`,
+					body: {fields: ['bio', 'pronouns', 'global_name']},
+				},
+				expected: {
+					action: 'clear_fields',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {fields: 'bio,pronouns,global_name'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/bot-status',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/bot-status`, body: {bot: true}},
+				expected: {
+					action: 'set_bot_status',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {bot: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/system-status',
+		async prepare(context) {
+			const target = await createTestAccount(context.harness);
+			await adminBuilder(context).put(`/admin/users/${target.userId}/bot-status`).body({bot: true}).execute();
+			return {
+				request: {path: `/admin/users/${target.userId}/system-status`, body: {system: true}},
+				expected: {
+					action: 'set_system_status',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {system: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/users/:user_id/username',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const username = createUniqueUsername('renamed');
+			return {
+				request: {path: `/admin/users/${target.userId}/username`, body: {username}},
+				expected: {
+					action: 'change_username',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						old_username: (await loadUser(target)).username,
+						new_username: username,
+						discriminator: expect.any(String),
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/users/:user_id/email',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const email = createUniqueEmail('changed');
+			return {
+				request: {path: `/admin/users/${target.userId}/email`, body: {email}},
+				expected: {
+					action: 'change_email',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {old_email: (await loadUser(target)).email!, new_email: email},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/email-verification',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness, {skipEmailVerification: true});
+			return {
+				request: {path: `/admin/users/${target.userId}/email-verification`},
+				expected: {
+					action: 'verify_email',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {email: (await loadUser(target)).email!},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/users/:user_id/verification-email',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness, {skipEmailVerification: true});
+			return {
+				request: {path: `/admin/users/${target.userId}/verification-email`, expectStatus: 204},
+				expected: {
+					action: 'resend_verification_email',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {email: (await loadUser(target)).email!},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/users/:user_id/password-reset',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/password-reset`, expectStatus: 204},
+				expected: {
+					action: 'send_password_reset',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {email: (await loadUser(target)).email!},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/ban',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/ban`,
+					body: {duration_hours: 24, reason: 'Coverage ban'},
+				},
+				expected: {
+					action: 'temp_ban',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {duration_hours: '24', reason: 'Coverage ban', banned_until: expect.any(String)},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/ban',
+		async prepare(context) {
+			const target = await createTestAccount(context.harness);
+			await adminBuilder(context).put(`/admin/users/${target.userId}/ban`).body({duration_hours: 24}).execute();
+			return {
+				request: {path: `/admin/users/${target.userId}/ban`},
+				expected: {
+					action: 'unban',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/deletion',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/deletion`,
+					body: {reason_code: DeletionReasons.USER_REQUESTED, days_until_deletion: 30},
+				},
+				expected: {
+					action: 'schedule_deletion',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {days: '30', reason_code: DeletionReasons.USER_REQUESTED.toString()},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/deletion',
+		async prepare(context) {
+			const target = await createTestAccount(context.harness);
+			await adminBuilder(context)
+				.put(`/admin/users/${target.userId}/deletion`)
+				.body({reason_code: DeletionReasons.USER_REQUESTED, days_until_deletion: 30})
+				.execute();
+			return {
+				request: {path: `/admin/users/${target.userId}/deletion`},
+				expected: {
+					action: 'cancel_deletion',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/users/:user_id/message-deletion',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			await createBuilder(harness, target.token)
+				.post('/users/@me/messages/delete')
+				.body({password: target.password})
+				.expect(204)
+				.execute();
+			return {
+				request: {path: `/admin/users/${target.userId}/message-deletion`},
+				expected: {
+					action: 'cancel_bulk_message_deletion',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/acls',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const acls = [AdminACLs.AUTHENTICATE, AdminACLs.USER_LOOKUP];
+			return {
+				request: {path: `/admin/users/${target.userId}/acls`, body: {acls}},
+				expected: {
+					action: 'set_acls',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {acls: acls.join(',')},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/traits',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/traits`, body: {traits: ['coverage_trait']}},
+				expected: {
+					action: 'set_traits',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {traits: 'coverage_trait'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/users/:user_id/flags',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const {flags} = await loadUser(target);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/flags`,
+					body: {add_flags: [UserFlags.PARTNER.toString()], remove_flags: [UserFlags.SPAMMER.toString()]},
+				},
+				expected: {
+					action: 'update_flags',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						add_flags: UserFlags.PARTNER.toString(),
+						remove_flags: UserFlags.SPAMMER.toString(),
+						new_flags: ((flags | UserFlags.PARTNER) & ~UserFlags.SPAMMER).toString(),
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/users/:user_id/premium-flags',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const {premiumFlags} = await loadUser(target);
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/premium-flags`,
+					body: {add_flags: [PremiumFlags.BADGE_HIDDEN], remove_flags: [PremiumFlags.PURCHASE_DISABLED]},
+				},
+				expected: {
+					action: 'update_premium_flags',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						add_flags: PremiumFlags.BADGE_HIDDEN.toString(),
+						remove_flags: PremiumFlags.PURCHASE_DISABLED.toString(),
+						new_flags: ((premiumFlags | PremiumFlags.BADGE_HIDDEN) & ~PremiumFlags.PURCHASE_DISABLED).toString(),
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/phone-verification',
+		async prepare(context) {
+			const target = await createTestAccount(context.harness);
+			const flags = SuspiciousActivityFlags.REQUIRE_VERIFIED_EMAIL | SuspiciousActivityFlags.REQUIRE_VERIFIED_PHONE;
+			await adminBuilder(context)
+				.put(`/admin/users/${target.userId}/suspicious-activity-flags`)
+				.body({flags})
+				.execute();
+			return {
+				request: {
+					path: `/admin/users/${target.userId}/phone-verification`,
+					body: {has_verified_phone: true},
+				},
+				expected: {
+					action: 'update_has_verified_phone',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {
+						has_verified_phone: 'true',
+						suspicious_activity_flags_before: flags.toString(),
+						suspicious_activity_flags_after: SuspiciousActivityFlags.REQUIRE_VERIFIED_EMAIL.toString(),
+					},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/users/:user_id/date-of-birth',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			return {
+				request: {path: `/admin/users/${target.userId}/date-of-birth`, body: {date_of_birth: '1995-06-15'}},
+				expected: {
+					action: 'change_dob',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {old_dob: (await loadUser(target)).dateOfBirth!, new_dob: '1995-06-15'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/suspicious-activity-flags',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const flags = SuspiciousActivityFlags.REQUIRE_VERIFIED_EMAIL | SuspiciousActivityFlags.REQUIRE_VERIFIED_PHONE;
+			return {
+				request: {path: `/admin/users/${target.userId}/suspicious-activity-flags`, body: {flags}},
+				expected: {
+					action: 'update_suspicious_activity_flags',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {flags: flags.toString()},
+				},
+			};
+		},
+	},
+	{
+		method: 'PUT',
+		route: '/admin/users/:user_id/suspicious-activity-disablement',
+		async prepare({harness}) {
+			const target = await createTestAccount(harness);
+			const flags = SuspiciousActivityFlags.REQUIRE_VERIFIED_PHONE;
+			return {
+				request: {path: `/admin/users/${target.userId}/suspicious-activity-disablement`, body: {flags}},
+				expected: {
+					action: 'disable_suspicious_activity',
+					targetType: 'user',
+					targetId: target.userId,
+					metadata: {flags: flags.toString()},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..7cbb14a36
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/UserWriteAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {UserWriteAdminAuditCases} from '@app/api/admin/tests/audit_coverage/UserWriteAdminAuditCases';
+
+describeAdminAuditCoverage('UserAdminController writes', UserWriteAdminAuditCases);
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCases.ts b/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCases.ts
new file mode 100644
index 000000000..fb70c182c
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCases.ts
@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AdminAuditCoverageCase} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import type {TestAccount} from '@app/api/auth/tests/AuthTestUtils';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {HTTP_STATUS} from '@app/api/test/TestConstants';
+import {createBuilder} from '@app/api/test/TestRequestBuilder';
+
+const REGION_ID = 'coverage-region';
+const REGION_NAME = 'Coverage Region';
+const SERVER_ID = 'coverage-server';
+const SERVER_ENDPOINT = 'wss://voice-coverage.example.com/livekit';
+
+async function createRegion(harness: ApiTestHarness, admin: TestAccount): Promise<void> {
+	await createBuilder(harness, admin.token)
+		.post('/admin/voice/regions')
+		.body({id: REGION_ID, name: REGION_NAME, emoji: ':earth_africa:', latitude: 1, longitude: 2})
+		.expect(HTTP_STATUS.OK)
+		.execute();
+}
+
+async function createRegionWithServer(harness: ApiTestHarness, admin: TestAccount): Promise<void> {
+	await createRegion(harness, admin);
+	await createBuilder(harness, admin.token)
+		.post(`/admin/voice/regions/${REGION_ID}/servers`)
+		.body({
+			server_id: SERVER_ID,
+			endpoint: SERVER_ENDPOINT,
+			api_key: 'coverage-api-key',
+			api_secret: 'coverage-api-secret',
+		})
+		.expect(HTTP_STATUS.OK)
+		.execute();
+}
+
+export const VoiceAdminAuditCases: ReadonlyArray<AdminAuditCoverageCase> = [
+	{
+		method: 'GET',
+		route: '/admin/voice/regions',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: '/admin/voice/regions?include_servers=true'},
+				expected: {
+					action: 'list_voice_regions',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {include_servers: 'true', result_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/voice/regions',
+		async prepare() {
+			return {
+				request: {
+					path: '/admin/voice/regions',
+					body: {id: REGION_ID, name: REGION_NAME, emoji: ':earth_africa:', latitude: 1, longitude: 2},
+				},
+				expected: {
+					action: 'create_voice_region',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, name: REGION_NAME},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/voice/regions/:region_id',
+		name: 'found',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}`},
+				expected: {
+					action: 'get_voice_region',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, include_servers: 'true', found: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/voice/regions/:region_id',
+		name: 'missing',
+		async prepare() {
+			return {
+				request: {path: '/admin/voice/regions/missing-region?include_servers=false'},
+				expected: {
+					action: 'get_voice_region',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {region_id: 'missing-region', include_servers: 'false', found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/voice/regions/:region_id',
+		async prepare({harness, admin}) {
+			await createRegion(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}`, body: {name: 'Renamed Region'}},
+				expected: {
+					action: 'update_voice_region',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {region_id: REGION_ID},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/voice/regions/:region_id',
+		async prepare({harness, admin}) {
+			await createRegion(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}`},
+				expected: {
+					action: 'delete_voice_region',
+					targetType: 'voice_region',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, name: REGION_NAME},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/voice/regions/:region_id/servers',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}/servers`},
+				expected: {
+					action: 'list_voice_servers',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, result_count: '1'},
+				},
+			};
+		},
+	},
+	{
+		method: 'POST',
+		route: '/admin/voice/regions/:region_id/servers',
+		async prepare({harness, admin}) {
+			await createRegion(harness, admin);
+			return {
+				request: {
+					path: `/admin/voice/regions/${REGION_ID}/servers`,
+					body: {
+						server_id: SERVER_ID,
+						endpoint: SERVER_ENDPOINT,
+						api_key: 'coverage-api-key',
+						api_secret: 'coverage-api-secret',
+					},
+				},
+				expected: {
+					action: 'create_voice_server',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, server_id: SERVER_ID, endpoint: SERVER_ENDPOINT},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/voice/regions/:region_id/servers/:server_id',
+		name: 'found',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}/servers/${SERVER_ID}`},
+				expected: {
+					action: 'get_voice_server',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, server_id: SERVER_ID, found: 'true'},
+				},
+			};
+		},
+	},
+	{
+		method: 'GET',
+		route: '/admin/voice/regions/:region_id/servers/:server_id',
+		name: 'missing',
+		async prepare({harness, admin}) {
+			await createRegion(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}/servers/missing-server`},
+				expected: {
+					action: 'get_voice_server',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, server_id: 'missing-server', found: 'false'},
+				},
+			};
+		},
+	},
+	{
+		method: 'PATCH',
+		route: '/admin/voice/regions/:region_id/servers/:server_id',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}/servers/${SERVER_ID}`, body: {is_active: false}},
+				expected: {
+					action: 'update_voice_server',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, server_id: SERVER_ID},
+				},
+			};
+		},
+	},
+	{
+		method: 'DELETE',
+		route: '/admin/voice/regions/:region_id/servers/:server_id',
+		async prepare({harness, admin}) {
+			await createRegionWithServer(harness, admin);
+			return {
+				request: {path: `/admin/voice/regions/${REGION_ID}/servers/${SERVER_ID}`},
+				expected: {
+					action: 'delete_voice_server',
+					targetType: 'voice_server',
+					targetId: '0',
+					metadata: {region_id: REGION_ID, server_id: SERVER_ID, endpoint: SERVER_ENDPOINT},
+				},
+			};
+		},
+	},
+];
diff --git a/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCoverage.test.ts b/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCoverage.test.ts
new file mode 100644
index 000000000..f6a02a660
--- /dev/null
+++ b/fluxer_api/src/api/admin/tests/audit_coverage/VoiceAdminAuditCoverage.test.ts
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {describeAdminAuditCoverage} from '@app/api/admin/tests/audit_coverage/AdminAuditCoverage';
+import {VoiceAdminAuditCases} from '@app/api/admin/tests/audit_coverage/VoiceAdminAuditCases';
+
+describeAdminAuditCoverage('VoiceAdminController', VoiceAdminAuditCases);
diff --git a/fluxer_api/src/api/search/meilisearch/MeilisearchDomainAdapters.ts b/fluxer_api/src/api/search/meilisearch/MeilisearchDomainAdapters.ts
index 2fd35cbea..b2b7e886a 100644
--- a/fluxer_api/src/api/search/meilisearch/MeilisearchDomainAdapters.ts
+++ b/fluxer_api/src/api/search/meilisearch/MeilisearchDomainAdapters.ts
@@ -204,6 +204,10 @@ function buildAuditLogFilters(filters: AuditLogSearchFilters): Array<Meilisearch
 	if (filters.targetType) clauses.push(meiliTermFilter('targetType', filters.targetType));
 	if (filters.targetId) clauses.push(meiliTermFilter('targetId', filters.targetId));
 	if (filters.action) clauses.push(meiliTermFilter('action', filters.action));
+	if (filters.actions && filters.actions.length > 0) clauses.push(meiliTermsFilter('action', filters.actions));
+	if (filters.excludeActions && filters.excludeActions.length > 0) {
+		clauses.push(...meiliExcludeAny('action', filters.excludeActions));
+	}
 	return compactMeiliFilters(clauses);
 }
 
diff --git a/fluxer_api/src/api/test/search/InMemorySearchProvider.ts b/fluxer_api/src/api/test/search/InMemorySearchProvider.ts
index a7c58ef2b..656b9461b 100644
--- a/fluxer_api/src/api/test/search/InMemorySearchProvider.ts
+++ b/fluxer_api/src/api/test/search/InMemorySearchProvider.ts
@@ -581,6 +581,8 @@ function matchesAuditLogFilters(doc: SearchableAuditLog, filters: AuditLogSearch
 	if (filters.targetType !== undefined && doc.targetType !== filters.targetType) return false;
 	if (filters.targetId !== undefined && doc.targetId !== filters.targetId) return false;
 	if (filters.action !== undefined && doc.action !== filters.action) return false;
+	if (filters.actions !== undefined && !filters.actions.includes(doc.action)) return false;
+	if (filters.excludeActions?.includes(doc.action)) return false;
 	return true;
 }
 
diff --git a/fluxer_docs/scripts/VerifyDocsStyle.ts b/fluxer_docs/scripts/VerifyDocsStyle.ts
index 3184987e1..308dff65e 100644
--- a/fluxer_docs/scripts/VerifyDocsStyle.ts
+++ b/fluxer_docs/scripts/VerifyDocsStyle.ts
@@ -271,7 +271,7 @@ const ACCEPTED_TABLE_FINDINGS = new Map<string, Readonly<Partial<Record<TableRul
 	['admin-api/bulk-jobs.mdx', {'table-fit': 1}],
 	['admin-api/discovery.mdx', {'table-identifier': 1}],
 	['admin-api/guilds.mdx', {'table-identifier': 3}],
-	['admin-api/index.mdx', {'table-fit': 1, 'table-identifier': 2}],
+	['admin-api/index.mdx', {'table-fit': 1, 'table-identifier': 3}],
 	['admin-api/instance.mdx', {'table-fit': 1, 'table-identifier': 5}],
 	['admin-api/messages.mdx', {'table-identifier': 1}],
 	['admin-api/reports.mdx', {'table-fit': 1, 'table-identifier': 2}],
diff --git a/fluxer_docs/src/content/docs/admin-api/api-keys.mdx b/fluxer_docs/src/content/docs/admin-api/api-keys.mdx
index c09042b99..37b453f64 100644
--- a/fluxer_docs/src/content/docs/admin-api/api-keys.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/api-keys.mdx
@@ -8,7 +8,7 @@ import RouteHeader from '@/components/RouteHeader.astro';
 
 An Admin API key is a long-lived credential for the [Admin API](/admin-api/). It authenticates as the account that created it, has its own [ACL](/admin-api/#acl-registry) set, and authenticates only requests to paths below `/v1/admin`.
 
-Every operation on this page requires `admin_api_key:manage`. None records an Admin audit entry or reads the `X-Audit-Log-Reason` header. An operation that addresses one key returns 404 `ADMIN_API_KEY_NOT_FOUND` when any of these holds:
+Every operation on this page requires `admin_api_key:manage`. A successful operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with target type `admin_api_key` and the `X-Audit-Log-Reason` header as its reason. A request that returns an error records no entry. An operation that addresses one key returns 404 `ADMIN_API_KEY_NOT_FOUND` when any of these holds:
 
 - No key has that identifier.
 - Another account created the key.
@@ -104,7 +104,7 @@ The secret cannot be retrieved or rotated later. If it is lost, revoke the key a
 
 ## List Admin API keys
 
-<RouteHeader method="GET" path="/v1/admin/api-keys" />
+<RouteHeader method="GET" path="/v1/admin/api-keys" auditReason />
 
 Returns every [Admin API key](#admin-api-key-object) object the acting account created, as a bare JSON array with no ordering guarantee. Requires `admin_api_key:manage`.
 
@@ -118,13 +118,17 @@ A key past its expiry is never returned.
 
 <sup>1</sup> An account that created no key receives an empty array
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_admin_api_keys`, target type `admin_api_key`, target ID `0`, and metadata key `result_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Create Admin API key
 
-<RouteHeader method="POST" path="/v1/admin/api-keys" />
+<RouteHeader method="POST" path="/v1/admin/api-keys" auditReason />
 
 Creates a key and returns an [Admin API key creation](#admin-api-key-creation-object) object that has the raw credential, with HTTP 200, not 201. Requires `admin_api_key:manage`.
 
@@ -154,13 +158,17 @@ Fluxer rejects the request with 403 `MISSING_ACL` on the first ungrantable value
 | 400 | [error response](/admin-api/#error-response) | Body validation fails, including an `acls` value outside the [ACL registry](/admin-api/#acl-registry), returned as `INVALID_FORM_BODY` |
 | 403 | [error response](/admin-api/#error-response) | Credential type is refused, `admin_api_key:manage` is absent, or `acls` names a value the acting credential does not have |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `create_admin_api_key`, target type `admin_api_key`, target ID equal to the new `key_id`, and metadata keys `acls` and `expires_in_days`. `acls` is the stored ACL set joined with commas. `expires_in_days` is present only when the request supplied it. The entry has no name and no raw credential.
+
 ### Rate limit
 
 30 requests per minute for each authenticated user, on the `admin:code:generation` bucket.
 
 ## Get Admin API key
 
-<RouteHeader method="GET" path="/v1/admin/api-keys/{key_id}" />
+<RouteHeader method="GET" path="/v1/admin/api-keys/{key_id}" auditReason />
 
 Returns one [Admin API key](#admin-api-key-object) object. Requires `admin_api_key:manage`.
 
@@ -179,13 +187,17 @@ This operation never returns the raw credential.
 | 200 | [Admin API key](#admin-api-key-object) object | Key was returned |
 | 404 | [error response](/admin-api/#error-response) | `ADMIN_API_KEY_NOT_FOUND`, which also covers an expired key and a key created by another account |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_admin_api_key`, target type `admin_api_key`, target ID equal to `key_id`, and no metadata.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Update Admin API key
 
-<RouteHeader method="PATCH" path="/v1/admin/api-keys/{key_id}" />
+<RouteHeader method="PATCH" path="/v1/admin/api-keys/{key_id}" auditReason />
 
 Renames a key or replaces its ACL set, and returns the updated [Admin API key](#admin-api-key-object) object. Requires `admin_api_key:manage`.
 
@@ -223,13 +235,17 @@ An update never rotates the credential, and no field on this route changes the e
 
 <sup>1</sup> The ownership check runs before the ACL grant check, so a key belonging to another account returns 404, not 403
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `update_admin_api_key`, target type `admin_api_key`, target ID equal to `key_id`, and metadata keys `fields` and `acls`. `fields` lists the supplied field names joined with commas, and is empty for an empty body. `acls` is the stored ACL set joined with commas, present only when the request supplied `acls`. The entry has no name.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the `admin:user:modify` bucket.
 
 ## Revoke Admin API key
 
-<RouteHeader method="DELETE" path="/v1/admin/api-keys/{key_id}" />
+<RouteHeader method="DELETE" path="/v1/admin/api-keys/{key_id}" auditReason />
 
 Revokes an Admin API key and returns HTTP 200 with a response body. Requires `admin_api_key:manage`.
 
@@ -258,6 +274,10 @@ Every later request presenting that credential fails authentication, and no oper
 | 200 | response body | Key was revoked |
 | 404 | [error response](/admin-api/#error-response) | `ADMIN_API_KEY_NOT_FOUND`, which also covers an expired key and a key created by another account |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `revoke_admin_api_key`, target type `admin_api_key`, target ID equal to `key_id`, and no metadata.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the `admin:user:modify` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/applications.mdx b/fluxer_docs/src/content/docs/admin-api/applications.mdx
index 23dc75ef9..f441d69fd 100644
--- a/fluxer_docs/src/content/docs/admin-api/applications.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/applications.mdx
@@ -94,7 +94,7 @@ Fluxer serves one synthetic application for its own Admin OAuth2 client. The app
 
 ## List applications
 
-<RouteHeader method="GET" path="/v1/admin/applications" />
+<RouteHeader method="GET" path="/v1/admin/applications" auditReason />
 
 Returns the [Admin application](#admin-application-object) objects selected by exactly one of `owner_id` and `guild_id`. Requires `application:lookup` or `application:list:by_owner`.
 
@@ -130,13 +130,17 @@ The route returns the complete selection in one response. There is no cursor, no
 | 200 | response body | The selected applications were returned |
 | 404 | [error response](/admin-api/#error-response) | `UNKNOWN_USER` when `owner_id` names no account, or `UNKNOWN_GUILD` when `guild_id` names no guild |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with a metadata key `application_count`. An `owner_id` request records action `list_user_applications`, target type `user`, and the owner as target ID. A `guild_id` request records action `list_guild_applications`, target type `guild`, and the guild as target ID. A failed request records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get application
 
-<RouteHeader method="GET" path="/v1/admin/applications/{application_id}" />
+<RouteHeader method="GET" path="/v1/admin/applications/{application_id}" auditReason />
 
 Returns one [Admin application](#admin-application-object) object wrapped in a single-member object. Requires `application:lookup`.
 
@@ -162,6 +166,10 @@ Fluxer answers 200 with `application` set to null when the ID names no applicati
 | --- | --- | --- |
 | 200 | response body | The lookup completed, whether or not it resolved an application |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_application`, target type `application`, the path `application_id` as target ID, and a metadata key `found`. `found` is `true` when `application` is an object and `false` when it is null. A returned application adds `owner_user_id`, and `bot_user_id` when the application has a bot.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/archives.mdx b/fluxer_docs/src/content/docs/admin-api/archives.mdx
index 4a761198f..9a4eaf315 100644
--- a/fluxer_docs/src/content/docs/admin-api/archives.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/archives.mdx
@@ -103,7 +103,7 @@ This object uses camelCase field names, unlike every other Admin response body.
 
 ## List archives
 
-<RouteHeader method="GET" path="/v1/admin/archives" />
+<RouteHeader method="GET" path="/v1/admin/archives" auditReason />
 
 Returns [archive](#archive-object) objects matching the supplied filters, newest first. Requires an ACL covering the requested `subject_type`.
 
@@ -145,13 +145,17 @@ Returns [archive](#archive-object) objects matching the supplied filters, newest
 | 400 | [error response](/admin-api/#error-response) | `subject_id` is supplied while `subject_type` is `all`. `INVALID_FORM_BODY` has `INVALID_FORMAT` on `subject_type` |
 | 403 | [error response](/admin-api/#error-response) | `MISSING_ACL` without an ACL covering the requested subject type |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_archives`, target type `archive`, target ID `0`, and metadata keys `subject_type`, `limit`, `include_expired`, and `result_count`. `subject_type` is the value after Fluxer narrows `all` to the account's ACLs. The entry also has `subject_user_id` or `subject_guild_id` when `subject_id` is supplied, and `requested_by_user_id` when `requested_by` is supplied.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get archive
 
-<RouteHeader method="GET" path="/v1/admin/archives/{subject_type}/{subject_id}/{archive_id}" />
+<RouteHeader method="GET" path="/v1/admin/archives/{subject_type}/{subject_id}/{archive_id}" auditReason />
 
 Returns one [archive](#archive-object) object. Requires an ACL covering the subject type.
 
@@ -182,13 +186,15 @@ Returns one [archive](#archive-object) object. Requires an ACL covering the subj
 
 The read issues no download grant.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_archive`, target type equal to `subject_type`, target ID equal to `subject_id`, and metadata keys `archive_id` and `found`. `found` is `false` when the response has a null archive.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Create archive download
 
-<RouteHeader method="GET" path="/v1/admin/archives/{subject_type}/{subject_id}/{archive_id}/download" />
+<RouteHeader method="GET" path="/v1/admin/archives/{subject_type}/{subject_id}/{archive_id}/download" auditReason />
 
 Issues a temporary download URL for a completed archive. Returns an [archive download](#archive-download-object) object on success. Requires an ACL covering the subject type.
 
@@ -219,7 +225,9 @@ The URL has its own signature and works for seven days for anyone who holds it.
 
 ### Side effects
 
-The operation creates a presigned download URL valid for seven days and changes no field of the archive, including `download_url_expires_at`. It records no Admin audit entry.
+The operation creates a presigned download URL valid for seven days and changes no field of the archive, including `download_url_expires_at`.
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_archive_download_url`, target type equal to `subject_type`, target ID equal to `subject_id`, and metadata key `archive_id`. The entry has no URL. A request that returns 400 or 404 records no entry.
 
 ### Rate limit
 
diff --git a/fluxer_docs/src/content/docs/admin-api/blocklists.mdx b/fluxer_docs/src/content/docs/admin-api/blocklists.mdx
index 0a4212d6d..1f6c4ffa9 100644
--- a/fluxer_docs/src/content/docs/admin-api/blocklists.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/blocklists.mdx
@@ -8,7 +8,7 @@ import RouteHeader from '@/components/RouteHeader.astro';
 
 Fluxer has nine blocklists for account access and user content. Each defines its accepted values, matching rules and metadata. Fluxer normalises a value when it adds the value and again when it checks the value.
 
-Each list has its own [Admin ACLs](/admin-api/#acl-registry). A read needs the selected list's `check` permission, an addition or an update needs its `add` permission, and a removal needs its `remove` permission. An account holding `ban:ip:add` writes to the `ip` list and to no other. Every write records the audit reason on the [Admin audit entries](/admin-api/#admin-audit-entry-object) it produces. The reads record nothing.
+Each list has its own [Admin ACLs](/admin-api/#acl-registry). A read needs the selected list's `check` permission, an addition or an update needs its `add` permission, and a removal needs its `remove` permission. An account holding `ban:ip:add` writes to the `ip` list and to no other. Every operation records the audit reason on the [Admin audit entries](/admin-api/#admin-audit-entry-object) it produces, and each read produces one entry. An entry about one list has a target type built from the list name with each hyphen written as an underscore, so `url-domain` entries use `url_domain`. `email-domain-suspicious` is the one exception and uses `email_domain`.
 
 Fluxer builds each permission name from `ban:`, the list name with each hyphen written as an underscore, and the verb, so the `url-domain` list uses `ban:url_domain:check`, `ban:url_domain:add`, and `ban:url_domain:remove`. The `email-domain-suspicious` list is the one exception and uses `suspicious_email_domain:check`, `suspicious_email_domain:add`, and `suspicious_email_domain:remove`.
 
@@ -265,7 +265,7 @@ Each field is a string, except `hashes` and `substrings`, which are `array[strin
 
 ## List blocklists
 
-<RouteHeader method="GET" path="/v1/admin/blocklists" />
+<RouteHeader method="GET" path="/v1/admin/blocklists" auditReason />
 
 Returns one [blocklist](#blocklist-object) object for every blocklist this instance keeps. Requires any one of the `check` permissions.
 
@@ -285,13 +285,17 @@ The response is identical for every Admin.
 | --- | --- | --- |
 | 200 | response body | Catalogue was returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_blocklists`, target type `blocklist`, target ID `0`, and metadata key `result_count`.
+
 ### Rate limit
 
 60 requests per minute for each authenticated user, on the `admin:ban:operation` bucket.
 
 ## List blocklist entries
 
-<RouteHeader method="GET" path="/v1/admin/blocklists/{list_type}/entries" />
+<RouteHeader method="GET" path="/v1/admin/blocklists/{list_type}/entries" auditReason />
 
 Returns a value-ordered cursor page of [blocklist entry](#blocklist-entry-object) objects. Requires the selected list's `check` permission.
 
@@ -332,6 +336,10 @@ Returns a value-ordered cursor page of [blocklist entry](#blocklist-entry-object
 
 The cost of a page does not fall as the cursor advances, so walk a large list with the largest `limit` the operation accepts.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_blocklist_entries`, the target type of the selected list, target ID `0`, and metadata keys `list_type`, `limit`, `result_count` for the entries in this page, and `has_more`. `profile-substring` adds `scope`, and a supplied `after` adds `has_after`. The cursor value and the entry values are not recorded. A 400 records nothing.
+
 ### Rate limit
 
 60 requests per minute for each authenticated user, on the `admin:ban:operation` bucket.
@@ -422,6 +430,8 @@ Every hash is written with the category `manual`, the severity `2`, and a null c
 
 Each hash is lowercased and replaces any existing entry. Changes become visible across the instance when the job stops, whether it ran to the end or was cancelled, so a cancelled job still enforces the hashes it already wrote. No Gateway Dispatch is emitted.
 
+The request records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `queue_bulk_job`, target type `bulk_job`, the job ID as target ID, and metadata keys `task` and `entity_count`. `task` is `ban_file_shas`, and `entity_count` is the number of submitted hashes.
+
 The job records one [Admin audit entry](/admin-api/#admin-audit-entry-object) per written hash under the action `ban_file_sha`, with that hash in its metadata, exactly as [Add blocklist entry](#add-blocklist-entry) does. It then records one aggregate entry under the action `bulk_ban_file_shas`, with the submitted, processed, successful, and failed counts. A cancelled job records the entries for the hashes it wrote and an aggregate entry marked `cancelled`.
 
 ### Rate limit
@@ -479,7 +489,7 @@ The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-obje
 
 ## Check blocklist entry
 
-<RouteHeader method="GET" path="/v1/admin/blocklists/{list_type}/entries/{entry_value}" />
+<RouteHeader method="GET" path="/v1/admin/blocklists/{list_type}/entries/{entry_value}" auditReason />
 
 Reports whether one value is currently blocked by the selected blocklist and returns a [blocklist check](#blocklist-check-object) object. Requires the selected list's `check` permission.
 
@@ -533,6 +543,10 @@ A value with no row and no covering match returns 200 with `banned` false, so th
 
 For every list except `email` and `email-domain-suspicious`, a row written on another node becomes visible here after a short propagation delay.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `check_blocklist_entry`, the target type of the selected list, target ID `0`, and metadata keys `list_type` and `banned`. `profile-substring` adds `scope`. The checked value is not recorded. A 400 records nothing.
+
 ### Rate limit
 
 60 requests per minute for each authenticated user, on the `admin:ban:operation` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/bulk-jobs.mdx b/fluxer_docs/src/content/docs/admin-api/bulk-jobs.mdx
index 669c75350..91efb6a4b 100644
--- a/fluxer_docs/src/content/docs/admin-api/bulk-jobs.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/bulk-jobs.mdx
@@ -144,7 +144,7 @@ The `task` discriminator selects one of these structures. Every ID array has an
 
 ### Side effects
 
-The [job](/admin-api/jobs/) records the acting Admin and audit reason. Queueing writes no Admin audit entry. Failure to create the job returns 500 `INTERNAL_SERVER_ERROR` without starting the operation.
+The [job](/admin-api/jobs/) records the acting Admin and audit reason. Queueing records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `queue_bulk_job`, target type `bulk_job`, target ID equal to the job identifier, and metadata keys `task` and `entity_count`. `entity_count` is the length of `guild_ids` for `update_guild_features` and of `user_ids` for every other task. An `add_guild_members` entry also has `guild_id`. Failure to create the job returns 500 `INTERNAL_SERVER_ERROR` without starting the operation or recording an entry.
 
 Entities are processed in the submitted order. [Cancel job](/admin-api/jobs/#cancel-job) stops the run between entities and sets its status to `cancelled`. Completed changes remain in place. A failed or unknown entity counts as failed without stopping the remaining work.
 
diff --git a/fluxer_docs/src/content/docs/admin-api/discovery.mdx b/fluxer_docs/src/content/docs/admin-api/discovery.mdx
index 2fb6757c1..9256ea133 100644
--- a/fluxer_docs/src/content/docs/admin-api/discovery.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/discovery.mdx
@@ -10,7 +10,7 @@ Admin discovery is the review side of the public guild directory. An Admin decid
 
 Every operation except [Remove discovery listing](#remove-discovery-listing) requires `discovery:review`, which covers the reads, [Review discovery application](#review-discovery-application), [Move discovery listings to a category](#move-discovery-listings-to-a-category), and [Update discovery listing](#update-discovery-listing). [Remove discovery listing](#remove-discovery-listing) requires `discovery:remove` instead. Neither implies the other.
 
-[Move discovery listings to a category](#move-discovery-listings-to-a-category) reads `X-Audit-Log-Reason` and records one `update_discovery_categories` Admin audit entry with the audit reason, the category, and the requested, updated, and failed counts. No other operation here reads that header or records an Admin audit entry. An operation that stores a reason takes it in its request body.
+Every operation here records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with the audit reason from `X-Audit-Log-Reason` when it succeeds. An operation that stores a reason on the application takes it in its request body, and that reason is not recorded in the entry.
 
 :::note[Review runs regardless of the discovery setting]
 An operator can disable discovery for the whole instance. Only the public [Discovery](/http-api/discovery/) routes read that state, and they return 400 `DISCOVERY_DISABLED` while it is off, so an application can be reviewed into a directory no account can see.
@@ -145,7 +145,7 @@ Every `category_type` and `category_id` here is an integer of 0 through 8. A val
 
 ## List discovery applications
 
-<RouteHeader method="GET" path="/v1/admin/discovery/applications" />
+<RouteHeader method="GET" path="/v1/admin/discovery/applications" auditReason />
 
 Returns every pending application as an array of [Admin pending application](#admin-pending-application-object) objects. Requires `discovery:review`.
 
@@ -159,13 +159,17 @@ A guild approved automatically on submission never appears here. An application
 | --- | --- | --- |
 | 200 | array[[Admin pending application](#admin-pending-application-object) object] | Pending applications were returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_discovery_applications`, target type `guild`, target ID `0`, and metadata key `result_count`.
+
 ### Rate limit
 
 30 requests per 10 seconds for each authenticated user, on the `discovery:admin:list` bucket.
 
 ## Review discovery application
 
-<RouteHeader method="PATCH" path="/v1/admin/discovery/applications/{guild_id}" />
+<RouteHeader method="PATCH" path="/v1/admin/discovery/applications/{guild_id}" auditReason />
 
 Approves or rejects a pending application and returns the updated [discovery application](#discovery-application-object) object. Requires `discovery:review`.
 
@@ -210,13 +214,15 @@ A rejection moves the application to `rejected` and records the review time, the
 
 An approval whose guild can no longer be resolved still succeeds. Fluxer skips the feature grant and the Dispatch.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `approve_discovery_application` or `reject_discovery_application`, target type `guild`, the guild ID as target ID, and metadata key `status`.
+
 ### Rate limit
 
 20 requests per 10 seconds for each authenticated user, on the `discovery:admin:action` bucket.
 
 ## List discovery categories
 
-<RouteHeader method="GET" path="/v1/admin/discovery/categories" />
+<RouteHeader method="GET" path="/v1/admin/discovery/categories" auditReason />
 
 Returns the fixed [discovery category](/http-api/discovery/#discovery-categories) set as an array of [discovery category](/http-api/discovery/#discovery-category-object) objects, in ascending ID order. Requires `discovery:review`.
 
@@ -228,13 +234,17 @@ It reports the same set on every instance running the same release and has no li
 | --- | --- | --- |
 | 200 | array[[discovery category](/http-api/discovery/#discovery-category-object) object] | Categories were returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_discovery_categories`, target type `discovery_category`, target ID `0`, and metadata key `result_count`.
+
 ### Rate limit
 
 30 requests per 10 seconds for each authenticated user, on the `discovery:admin:list` bucket.
 
 ## List guilds in a discovery category
 
-<RouteHeader method="GET" path="/v1/admin/discovery/categories/{category_id}/listings" />
+<RouteHeader method="GET" path="/v1/admin/discovery/categories/{category_id}/listings" auditReason />
 
 Returns an offset page of the approved listings filed under one category, most members first, as an array of [Admin discovery listing](#admin-discovery-listing-object) objects. Requires `discovery:review`.
 
@@ -261,13 +271,17 @@ A rebuild of the discovery search index does not change what this operation answ
 | --- | --- | --- |
 | 200 | array[[Admin discovery listing](#admin-discovery-listing-object) object] | The page was returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_discovery_category_listings`, target type `discovery_category`, target ID `0`, and metadata keys `category_id`, `limit`, `offset`, `result_count` for the listings in this page, and `total` for every approved listing in the category.
+
 ### Rate limit
 
 30 requests per 10 seconds for each authenticated user, on the `discovery:admin:list` bucket.
 
 ## List discovery listings
 
-<RouteHeader method="GET" path="/v1/admin/discovery/listings" />
+<RouteHeader method="GET" path="/v1/admin/discovery/listings" auditReason />
 
 Returns every approved listing as an array of [Admin discovery listing](#admin-discovery-listing-object) objects. Requires `discovery:review`.
 
@@ -279,13 +293,17 @@ The response is a bare array with no guaranteed order, cursor or limit. Pending,
 | --- | --- | --- |
 | 200 | array[[Admin discovery listing](#admin-discovery-listing-object) object] | Approved listings were returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_discovery_listings`, target type `guild`, target ID `0`, and metadata key `result_count`.
+
 ### Rate limit
 
 30 requests per 10 seconds for each authenticated user, on the `discovery:admin:list` bucket.
 
 ## Move discovery listings to a category
 
-<RouteHeader method="PATCH" path="/v1/admin/discovery/listings" />
+<RouteHeader method="PATCH" path="/v1/admin/discovery/listings" auditReason />
 
 Files every named guild under one [discovery category](/http-api/discovery/#discovery-categories) and reports how many moved. Requires `discovery:review`.
 
@@ -323,13 +341,15 @@ Repeating the request is safe. The operation moves a pending application the sam
 
 A move replaces the application's `category_type` and preserves its description, language, tags, status, and timestamps. A moved listing that is already approved appears under the new category in the next public search. No guild field changes and no Gateway Dispatch is emitted.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `update_discovery_categories`, target type `guild`, target ID `0`, and metadata keys `category_type`, `guild_count`, `updated`, and `failed`. It records the entry when every guild fails as well. The guild IDs are not recorded.
+
 ### Rate limit
 
 20 requests per 10 seconds for each authenticated user, on the `discovery:admin:action` bucket.
 
 ## Update discovery listing
 
-<RouteHeader method="PATCH" path="/v1/admin/discovery/listings/{guild_id}" />
+<RouteHeader method="PATCH" path="/v1/admin/discovery/listings/{guild_id}" auditReason />
 
 Updates the stored listing of one guild and returns the updated [discovery application](#discovery-application-object) object. Requires `discovery:review`.
 
@@ -375,13 +395,15 @@ The supplied members update the application while preserving its status, submiss
 
 No guild field changes, so no [Guild Update](/gateway/events/#guild-update) fires.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `update_discovery_listing`, target type `guild`, the guild ID as target ID, and metadata key `status` with the stored [application status](/http-api/discovery/#discovery-application-statuses). `fields` names the supplied members joined by commas and is absent for an empty body. A supplied `category_type` or `primary_language` adds a key of the same name with its value. The description and tags are not recorded.
+
 ### Rate limit
 
 20 requests per 10 seconds for each authenticated user, on the `discovery:admin:action` bucket.
 
 ## Remove discovery listing
 
-<RouteHeader method="DELETE" path="/v1/admin/discovery/listings/{guild_id}" />
+<RouteHeader method="DELETE" path="/v1/admin/discovery/listings/{guild_id}" auditReason />
 
 Removes an approved listing from discovery, strips the guild's discoverable feature, and returns the updated [discovery application](#discovery-application-object) object. Requires `discovery:remove`.
 
@@ -419,6 +441,8 @@ The application moves to `removed` and records the removal time, the removing Ad
 
 A removal whose guild can no longer be resolved still succeeds. Fluxer skips the feature strip and the Dispatch.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `remove_discovery_listing`, target type `guild`, the guild ID as target ID, and no metadata.
+
 ### Rate limit
 
 20 requests per 10 seconds for each authenticated user, on the `discovery:admin:action` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/gateway.mdx b/fluxer_docs/src/content/docs/admin-api/gateway.mdx
index a395a982f..49aea5ce7 100644
--- a/fluxer_docs/src/content/docs/admin-api/gateway.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/gateway.mdx
@@ -173,7 +173,7 @@ One entry for each voice server that holds at least one voice state.
 
 ## Get Gateway node statistics
 
-<RouteHeader method="GET" path="/v1/admin/gateway/stats" />
+<RouteHeader method="GET" path="/v1/admin/gateway/stats" auditReason />
 
 Returns the [node statistics](#node-statistics-object) object for the whole Gateway cluster. Requires `gateway:memory_stats`.
 
@@ -183,13 +183,17 @@ Returns the [node statistics](#node-statistics-object) object for the whole Gate
 | --- | --- | --- |
 | 200 | [node statistics](#node-statistics-object) object | Cluster state was returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_gateway_stats`, target type `gateway`, target ID `0`, and metadata key `node_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get guild memory statistics
 
-<RouteHeader method="GET" path="/v1/admin/gateway/memory-stats" />
+<RouteHeader method="GET" path="/v1/admin/gateway/memory-stats" auditReason />
 
 Returns the heaviest live guild processes as [guild memory statistics](#guild-memory-statistics-object) objects. Requires `gateway:memory_stats`.
 
@@ -217,13 +221,15 @@ Returns the heaviest live guild processes as [guild memory statistics](#guild-me
 
 A node that does not answer within 5 seconds contributes no entries, and the request still returns 200.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_guild_memory_stats`, target type `guild`, target ID `0`, and metadata keys `limit` and `result_count` for the entries in this response.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get voice state counts
 
-<RouteHeader method="GET" path="/v1/admin/gateway/voice-state-counts" />
+<RouteHeader method="GET" path="/v1/admin/gateway/voice-state-counts" auditReason />
 
 Returns the [voice state count](#voice-state-count-object) object. Requires `gateway:memory_stats`.
 
@@ -237,13 +243,15 @@ Returns the [voice state count](#voice-state-count-object) object. Requires `gat
 
 The counts cover voice states in guild channels and in calls. A node that does not answer within 10 seconds contributes zero, and the request still returns 200.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_voice_state_counts`, target type `gateway`, target ID `0`, and metadata keys `total_voice_states`, `region_count`, and `server_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Reload Gateway guilds
 
-<RouteHeader method="POST" path="/v1/admin/gateway/reloads" />
+<RouteHeader method="POST" path="/v1/admin/gateway/reloads" auditReason />
 
 Fetches the guild data for the supplied guilds from the database again and sends it to each live guild process and returns how many live guild processes were selected. Requires `gateway:reload_all`.
 
@@ -281,7 +289,9 @@ Every reloaded guild process fires one [Guild Update](/gateway/events/#guild-upd
 
 ### Side effects
 
-A guild whose owner node cannot be resolved is not counted. Reloads can still be in progress when the response arrives. No guild data is changed. The operation records one `reload_guilds` Admin audit entry with the audit reason, the requested guild count, and the reloaded count.
+A guild whose owner node cannot be resolved is not counted. Reloads can still be in progress when the response arrives. No guild data is changed.
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `reload_guilds`, target type `guild`, target ID `0`, and metadata keys `guild_count` for the requested guilds and `reloaded` for the returned `count`.
 
 ### Rate limit
 
diff --git a/fluxer_docs/src/content/docs/admin-api/gift-codes.mdx b/fluxer_docs/src/content/docs/admin-api/gift-codes.mdx
index 9ca225e2b..c17f4757b 100644
--- a/fluxer_docs/src/content/docs/admin-api/gift-codes.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/gift-codes.mdx
@@ -29,7 +29,7 @@ The unit and the quantity together define the span a redeemed code grants. At re
 
 ## Create gift codes
 
-<RouteHeader method="POST" path="/v1/admin/gift-codes" />
+<RouteHeader method="POST" path="/v1/admin/gift-codes" auditReason />
 
 Generates the requested number of unredeemed gift codes. Requires `gift_codes:generate`. Returns the complete redemption links on success.
 
@@ -77,7 +77,7 @@ Each code is 32 characters drawn from the uppercase letters, the lowercase lette
 
 A failed request can leave some codes redeemable without returning them. Retrying can therefore create additional codes.
 
-The operation records one `generate_gift_codes` Admin audit entry with the audit reason, the code count, and the requested duration. The codes themselves are not recorded. It emits no Gateway Dispatch.
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `generate_gift_codes`, target type `gift_code`, target ID `0`, and metadata keys `count`, `duration_type`, and `duration_quantity`. The codes are not recorded. It emits no Gateway Dispatch.
 
 ### Rate limit
 
diff --git a/fluxer_docs/src/content/docs/admin-api/guilds.mdx b/fluxer_docs/src/content/docs/admin-api/guilds.mdx
index e95dde0d7..925f4d6f0 100644
--- a/fluxer_docs/src/content/docs/admin-api/guilds.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/guilds.mdx
@@ -232,7 +232,7 @@ An ID owned by a different guild appears in `errors` with no asset type.
 
 ## List guilds
 
-<RouteHeader method="GET" path="/v1/admin/guilds" />
+<RouteHeader method="GET" path="/v1/admin/guilds" auditReason />
 
 Searches guilds through the guild search index and returns [Admin guild](#admin-guild-object) objects. Requires `guild:lookup`.
 
@@ -264,13 +264,17 @@ The index matches `q` against the guild name, the discovery tags, the custom inv
 | 200 | response body | Guild page was returned |
 | 403 | [error response](/admin-api/#error-response) | `FEATURE_TEMPORARILY_DISABLED`, because the instance has no search backend configured |
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `search_guilds`, the target type `guild`, and the target ID `0`. Its metadata keys are `limit`, `offset`, `result_count` for the guilds in this page, and `total`. `has_query` is added as `true` when `q` is supplied, and the query text is not recorded. A 403 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get guild
 
-<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}" />
+<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}" auditReason />
 
 Returns one guild with its channels and roles. Requires `guild:lookup`.
 
@@ -294,6 +298,10 @@ Returns one guild with its channels and roles. Requires `guild:lookup`.
 | --- | --- | --- |
 | 200 | response body | A lookup was done, whether or not it resolved |
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `get_guild`, the target type `guild`, and the requested guild ID as the target. Its metadata key `found` is `true` when the guild resolved and `false` when `guild` is null.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -314,7 +322,7 @@ Fluxer evaluates authorisation in two stages and reads the body between them. Th
 - `vanity_url_code` selects `guild:update:vanity`.
 - `new_owner_id` selects `guild:transfer_ownership`.
 
-A body with no field at all selects nothing, so an empty patch applies no change.
+A body with no field at all selects nothing, so an empty patch applies no change and records one `update_guild` entry.
 
 ### Path parameters
 
@@ -385,7 +393,7 @@ Supplying `add_features` or `remove_features` reconciles an existing discovery a
 
 Every applied group refreshes the guild's entry in the guild search index and fires one [Guild Update](/gateway/events/#guild-update) Dispatch to every session that can see the guild, including when the write changes no value.
 
-Each applied group records one Admin audit entry with the target type `guild` and the guild ID as the target.
+Each applied group records one Admin audit entry with the target type `guild` and the guild ID as the target. A body that applies no group records one entry with action `update_guild` and no metadata instead.
 
 - `clear_fields` records the cleared field names.
 - `update_settings` records each applied setting.
@@ -439,7 +447,7 @@ One Admin audit entry is recorded with the action `delete_guild`, the target typ
 
 ## List guild members
 
-<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/members" />
+<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/members" auditReason />
 
 Returns one page of [guild member](/http-api/guild-members/#guild-member-object) objects read from the main Gateway, without requiring membership. Requires `guild:list:members`.
 
@@ -480,6 +488,10 @@ A guild the main Gateway cannot load answers 404 `UNKNOWN_GUILD`.
 
 A member query the main Gateway reports as failed returns 502 `BAD_GATEWAY`, an unanswered call returns 504 `GATEWAY_TIMEOUT`, and an overloaded cluster returns 503 `SERVICE_UNAVAILABLE`.
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `list_guild_members`, the target type `guild`, and the guild ID as the target. Its metadata keys are `limit` and `offset` as applied, `result_count` for the members in this page, and `total`. An error response records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -628,7 +640,7 @@ One Admin audit entry is recorded with the action `ban_member`, the target type
 
 ## List guild emojis
 
-<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/emojis" />
+<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/emojis" auditReason />
 
 Returns every custom emoji of a guild as [Admin guild expression](#admin-guild-expression-object) objects. Requires `asset:purge`.
 
@@ -655,13 +667,17 @@ Returns every custom emoji of a guild as [Admin guild expression](#admin-guild-e
 
 The operation does not verify that the guild exists, so an unknown guild ID returns an empty listing.
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `list_guild_emojis`, the target type `guild`, and the guild ID as the target. Its metadata key `result_count` is the number of emojis returned.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## List guild stickers
 
-<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/stickers" />
+<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/stickers" auditReason />
 
 Returns every sticker of a guild as [Admin guild expression](#admin-guild-expression-object) objects. Requires `asset:purge`.
 
@@ -688,6 +704,10 @@ Returns every sticker of a guild as [Admin guild expression](#admin-guild-expres
 
 The operation does not verify that the guild exists, so an unknown guild ID returns an empty listing.
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `list_guild_stickers`, the target type `guild`, and the guild ID as the target. Its metadata key `result_count` is the number of stickers returned.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -745,7 +765,7 @@ Every entry in `processed` records its own Admin audit entry, with the numeric I
 
 ## List guild audit logs
 
-<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/audit-logs" />
+<RouteHeader method="GET" path="/v1/admin/guilds/{guild_id}/audit-logs" auditReason />
 
 Returns one page of the guild's own in-app audit log, without requiring guild membership or [VIEW_AUDIT_LOG](/http-api/permissions/). Requires `guild:audit_log:view`.
 
@@ -790,7 +810,9 @@ The operation does not verify that the guild exists, so an unknown guild ID retu
 
 ### Side effects
 
-The read records no Admin audit entry and appends no ordinary entry to the guild's own audit log. It still changes that log. Runs of consecutive message deletion entries are replaced with one bulk entry, and that replacement emits [Guild Audit Log Entry Create](/gateway/events/#guild-audit-log-entry-create), exactly as the public operation does.
+The read appends no ordinary entry to the guild's own audit log. It still changes that log. Runs of consecutive message deletion entries are replaced with one bulk entry, and that replacement emits [Guild Audit Log Entry Create](/gateway/events/#guild-audit-log-entry-create), exactly as the public operation does.
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `list_guild_audit_logs`, the target type `guild`, and the guild ID as the target. Its metadata key `result_count` is the number of entries returned. The supplied query parameters add `limit`, `before`, `after`, `filter_user_id` for `user_id`, and `action_type`. A 400 records nothing.
 
 ### Rate limit
 
@@ -874,7 +896,7 @@ One Admin audit entry is recorded with the action `shutdown_guild`, the target t
 
 ## Create guild archive
 
-<RouteHeader method="POST" path="/v1/admin/guilds/{guild_id}/archives" />
+<RouteHeader method="POST" path="/v1/admin/guilds/{guild_id}/archives" auditReason />
 
 Queues an asynchronous archive of the guild's channels, messages, members, roles, and settings, and returns the created [archive](/admin-api/archives/#archive-object) object. Requires `archive:trigger:guild`.
 
@@ -904,7 +926,9 @@ Archive status and downloads are read through [Archives](/admin-api/archives/).
 
 The archive record is created with the acting Admin account as `requested_by`, a `progress_percent` of 0, a `progress_step` of `Queued`, and an `expires_at` that is never extended. The archive is built after the response is returned. A client reads progress through [Get archive](/admin-api/archives/#get-archive).
 
-The operation emits no Gateway Dispatch and records no Admin audit entry.
+The operation emits no Gateway Dispatch.
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `trigger_guild_archive`, the target type `guild`, and the guild ID as the target. Its metadata keys are `archive_id` for the new archive and `include_attachments`, which is `true` or `false`.
 
 ### Rate limit
 
diff --git a/fluxer_docs/src/content/docs/admin-api/index.mdx b/fluxer_docs/src/content/docs/admin-api/index.mdx
index bd5443387..ae0ef5b88 100644
--- a/fluxer_docs/src/content/docs/admin-api/index.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/index.mdx
@@ -74,11 +74,15 @@ The [ACL registry](#acl-registry) below lists every value the instance recognise
 
 An Admin audit entry records one Admin action against one target.
 
-Not every Admin operation records an entry. Each Admin resource page states, per operation, whether it records one and what that entry stores.
+Every Admin operation records at least one entry, reads included. Five reads are the exception and record nothing. They are [Get current Admin user](/admin-api/users/#get-current-admin-user), [List jobs](/admin-api/jobs/#list-jobs), [List active jobs](/admin-api/jobs/#list-active-jobs), [Get job](/admin-api/jobs/#get-job), and [Get search index refresh](/admin-api/search-indexes/#get-search-index-refresh). Each Admin resource page states, per operation, what its entry stores, and names the requests that change nothing and so record nothing, such as a purge whose every ID fails.
 
-A request refused by authentication, ACL evaluation, rate limiting, or body validation records nothing.
+A read records its entry after the data is loaded and before the response is sent. A read that returns 200 with no match still records one. A read entry stores identifiers, filter values from a fixed set, counts, and whether a free-text query was supplied. It never stores query text, email addresses, IP addresses, blocklist values, or other free-form input.
 
-Fluxer can record more than one entry for one request. [Update guild](/admin-api/guilds/#update-guild) records one entry for each mapped field group it applies. A queued bulk job records one summary entry when it finishes, with the creating Admin and that request's audit reason. The `update_user_flags`, `update_guild_features`, and `schedule_user_deletion` tasks also record one ordinary entry for each account or guild the worker changes, with `audit_log_reason` null.
+An entry is a read entry when its action is one of the [read actions](#read-actions), and a write entry otherwise. The `access` field reports which, and the `access` query parameter of [List audit log entries](#list-audit-log-entries) filters on it.
+
+A request refused by authentication, ACL evaluation, rate limiting, or path, query, or body validation records nothing.
+
+Fluxer can record more than one entry for one request. [Update guild](/admin-api/guilds/#update-guild) records one entry for each mapped field group it applies. A bulk job records a `queue_bulk_job` entry when it is queued and one summary entry when it finishes, both with the creating Admin and that request's audit reason. The `update_user_flags`, `update_guild_features`, and `schedule_user_deletion` tasks also record one ordinary entry for each account or guild the worker changes, with `audit_log_reason` null.
 
 An entry stores an acting Admin, a target type, a target ID, an action name, an optional audit reason, and a string metadata map. Fluxer fills every other field of the entry when the entry is read.
 
@@ -98,13 +102,14 @@ An entry stores an acting Admin, a target type, a target ID, an action name, an
 | related_guilds<sup>6</sup> | map[snowflake, [Admin guild summary](#admin-guild-summary-object) object] | The guilds the entry references, keyed by ID |
 | related_channels<sup>6</sup> | map[snowflake, [Admin channel summary](#admin-channel-summary-object) object] | The channels the entry references, keyed by ID |
 | action | string | The [audit action](#audit-actions) the service recorded (1-256 characters) |
+| access | string | `read` for an entry recorded by a read, `write` for any other entry |
 | audit_log_reason | ?string | The normalised [audit reason](#audit-reasons) (1-4,000 characters), or null when the request supplied none |
 | metadata<sup>7</sup> | map[string, string] | The additional values the operation recorded |
 | created_at | ISO8601 timestamp | The time the entry was recorded |
 
 <sup>1</sup> Resolved from `admin_user_id` at read time, so an account deleted after the entry was written reports null while `admin_user_id` still has the ID
 
-<sup>2</sup> Serialised as a decimal string, like a [snowflake](/snowflakes/). A blocklist entry, a voice region, and a voice server record `0` here and their textual identity in `metadata`
+<sup>2</sup> Serialised as a decimal string, like a [snowflake](/snowflakes/). A read that is not scoped to one account, guild, channel, or message, a blocklist entry, a voice region, and a voice server record `0` here, and any identity they have is in `metadata`
 
 <sup>3</sup> Resolved only when `target_type` is `user`, `guild_member`, `message_deletion`, or `message_shred`
 
@@ -146,6 +151,7 @@ An entry has no request method, request path, status, duration, IP address, or f
   "related_guilds": {},
   "related_channels": {},
   "action": "change_username",
+  "access": "write",
   "audit_log_reason": "Impersonation report 4821",
   "metadata": {
     "old_username": "subj3ct",
@@ -201,11 +207,25 @@ An entry has no request method, request path, status, duration, IP address, or f
 | message | Message |
 | message_deletion<sup>1</sup> | Bulk deletion of every message one account sent |
 | message_shred<sup>1</sup> | Message shred job for one account |
+| channel | Channel |
 | asset | Stored media asset |
 | application | OAuth2 application |
 | report | User report |
 | search_index | Search index |
 | system_dm | System DM broadcast |
+| gift_code<sup>2</sup> | Batch of generated gift codes |
+| bulk_job | Background job |
+| admin_api_key | Admin API key |
+| audit_log | Admin audit entry |
+| archive<sup>2</sup> | Archive list |
+| admin_acl<sup>2</sup> | Admin ACL registry |
+| blocklist<sup>2</sup> | Blocklist catalogue |
+| discovery_category<sup>2</sup> | Discovery category |
+| instance_config<sup>2</sup> | Instance configuration |
+| limit_config<sup>2</sup> | Limit configuration |
+| registration_url<sup>3</sup> | Admin-issued registration URL |
+| gateway<sup>2</sup> | Gateway cluster |
+| system<sup>2</sup> | API process that served the request |
 | voice_region<sup>2</sup> | Voice region |
 | voice_server<sup>2</sup> | Voice server registration |
 | ip<sup>2</sup> | IP blocklist entry or suspicious IP marker |
@@ -218,28 +238,90 @@ An entry has no request method, request path, status, duration, IP address, or f
 | avatar_hash<sup>2</sup> | Avatar hash blocklist entry |
 | profile_substring<sup>2</sup> | Profile substring blocklist entry |
 
-<sup>1</sup> The target ID is the account the job acts on, and the entry resolves that account into `target_user`
+<sup>1</sup> The target ID is the account the job acts on, and the entry resolves that account into `target_user`. [Get message shred job](/admin-api/messages/#get-message-shred-job) is the exception and records `0`
 
-<sup>2</sup> The target has no snowflake, so `target_id` is `0` and the entry's textual identity is in `metadata`
+<sup>2</sup> The target has no snowflake, so `target_id` is `0`, and any identity the entry has is in `metadata`
+
+<sup>3</sup> The ID of a registration URL is its redeemable code, so `target_id` is `0` and the entry stores no ID
 
 The field is a free-form string, so a client MUST accept a value outside this table.
 
 ### Audit actions
 
-An operation records one of the following actions. The field is a free-form string of 1 to 256 characters, so a client MUST accept a value outside this table.
+An operation records one of the following actions. The field is a free-form string of 1 to 256 characters, so a client MUST accept a value outside these tables.
+
+#### Read actions
+
+An entry with one of these actions has `access` set to `read`.
+
+| Value | Description |
+| --- | --- |
+| check_blocklist_entry | A value was checked against a blocklist |
+| get_admin_api_key | An Admin API key was read |
+| get_application | An application was read |
+| get_archive | An archive was read |
+| get_archive_download_url | A download URL for an archive was issued |
+| get_audit_log | An Admin audit entry was read |
+| get_gateway_stats | Gateway node statistics were read |
+| get_guild | A guild was read |
+| get_instance_config | The instance configuration was read |
+| get_limit_config | The limit configuration was read |
+| get_message | A message and its surrounding messages were read |
+| get_message_shred_status | The state of a message shred job was read |
+| get_report | A report was read |
+| get_user | An account was read |
+| get_voice_region | A voice region was read |
+| get_voice_server | A voice server was read |
+| get_voice_state_counts | Gateway voice state counts were read |
+| list_admin_acls | The Admin ACL registry was read |
+| list_admin_api_keys | The acting Admin's API keys were listed |
+| list_archives | Archives were listed |
+| list_audit_logs | A page of the Admin audit log was read |
+| list_blocklist_entries | A page of blocklist entries was read |
+| list_blocklists | The blocklist catalogue was read |
+| list_channel_messages | The messages of a channel were listed |
+| list_discovery_applications | Pending discovery applications were read |
+| list_discovery_categories | The discovery categories were read |
+| list_discovery_category_listings | A page of the discovery listings in one category was read |
+| list_discovery_listings | Approved discovery listings were read |
+| list_guild_applications | The applications whose bots are members of a guild were read |
+| list_guild_audit_logs | The audit log of a guild was read |
+| list_guild_emojis | The custom emojis of a guild were listed |
+| list_guild_members | The members of a guild were listed |
+| list_guild_memory_stats | Guild memory statistics were listed |
+| list_guild_stickers | The stickers of a guild were listed |
+| list_user_applications | The applications an account owns were read |
+| list_user_change_log | The contact change log of an account was read |
+| list_user_dm_channels | The direct message channels of an account were read |
+| list_user_guilds | The guild memberships of an account were read |
+| list_user_relationships | The relationships of an account were read |
+| list_user_sessions | An account's login sessions were read |
+| list_voice_regions | Voice regions were listed |
+| list_voice_servers | The voice servers of a region were listed |
+| list_webauthn_credentials | An account's WebAuthn credentials were read |
+| search_audit_logs | The Admin audit log was searched |
+| search_guilds | Guilds were listed or searched |
+| search_messages | The messages of a channel were searched, or one message was looked up |
+| search_reports | Reports were listed or searched |
+| search_users | Accounts were listed or searched |
+
+#### Write actions
+
+An entry with any other action has `access` set to `write`.
 
 | Value | Description |
 | --- | --- |
 | NCMEC Report | An attachment was submitted through the NCMEC reporting integration |
 | add_suspicious_email_domain | A domain was added to the suspicious email domain list |
+| approve_discovery_application | A discovery application was approved |
 | approve_registration | A pending registration was approved |
 | auto_resolve_reports_on_deletion | Reports against an account were resolved automatically as part of its deletion |
 | ban_avatar_hash | An avatar hash was added to the avatar blocklist |
 | ban_email | An address was added to the email blocklist |
 | ban_file_sha | A file hash was added to the attachment blocklist |
 | ban_ip | An address was added to the IP blocklist |
-| ban_ip_skipped_exempt | An IP blocklist entry was declined by the instance exemption list |
 | ban_ip_skipped_cgnat | An IP blocklist entry was declined because IP intelligence reports the address as a mobile carrier network |
+| ban_ip_skipped_exempt | An IP blocklist entry was declined by the instance exemption list |
 | ban_member | An account was banned from a guild |
 | ban_phrase | A phrase was added to the message phrase blocklist |
 | ban_profile_substring | A substring was added to the profile substring blocklist |
@@ -247,16 +329,21 @@ An operation records one of the following actions. The field is a free-form stri
 | ban_url_domain | A domain was added to the URL domain blocklist |
 | bulk_add_guild_members | A bulk guild member addition was queued or applied |
 | bulk_ban_file_shas | A queued bulk file hash blocklist job was applied |
+| bulk_delete_user_messages | A queued bulk message deletion job was applied |
 | bulk_schedule_deletion | A bulk account deletion schedule was queued or applied |
 | bulk_update_guild_features | A bulk guild feature change was queued or applied |
 | bulk_update_suspicious_activity_flags | A bulk suspicious activity flag change was queued or applied |
 | bulk_update_user_flags | A bulk account flag change was queued or applied |
 | cancel_bulk_message_deletion | A bulk message deletion an account scheduled for itself was cancelled |
 | cancel_deletion | A scheduled account deletion was cancelled |
+| cancel_job | Cancellation of a job was requested |
 | change_dob | A date of birth was changed |
 | change_email | An email address was changed |
 | change_username | A username or discriminator was changed |
 | clear_fields<sup>1</sup> | Profile fields of an account, or fields of a guild, were cleared |
+| create_admin_api_key | An Admin API key was created |
+| create_heap_snapshot | A heap snapshot of the API process was written |
+| create_registration_url | A registration URL was issued |
 | create_voice_region | A voice region was created |
 | create_voice_server | A voice server was registered |
 | delete_all_user_messages | Deletion of every message an account sent was queued |
@@ -269,26 +356,31 @@ An operation records one of the following actions. The field is a free-form stri
 | disable_mfa | Multi-factor authentication was disabled on an account |
 | disable_suspicious_activity | An account flagged for suspicious activity was disabled |
 | force_add_to_guild | An account was added to a guild while bypassing the ban check |
+| generate_gift_codes | Gift codes were generated |
 | kick_member | A member was removed from a guild |
-| list_user_sessions | An account's login sessions were read |
-| list_webauthn_credentials | An account's WebAuthn credentials were read |
 | mark_suspicious_ip | An IP address was marked as suspicious |
+| mark_suspicious_ip_skipped_high_blast_radius | IP intelligence reports the address as a mobile, anycast, satellite, or education network, so no marker was written |
 | mark_suspicious_ip_skipped_invalid | The address could not be parsed, so no marker was written |
 | mark_suspicious_ip_skipped_ipinfo_unavailable | IP intelligence was unavailable, so no marker was written |
 | mark_suspicious_ip_skipped_trusted_commercial_privacy_provider | The address belongs to a trusted commercial privacy provider, so no marker was written |
-| mark_suspicious_ip_skipped_high_blast_radius | IP intelligence reports the address as a mobile, anycast, satellite, or education network, so no marker was written |
 | purge_asset | A stored media asset was purged |
 | purge_guild_emoji_asset | A guild emoji asset was purged |
 | purge_guild_sticker_asset | A guild sticker asset was purged |
+| queue_bulk_job | A bulk job was queued |
 | queue_message_shred | A message shred job was queued |
 | queue_refresh_index | A search index rebuild was requested |
+| reject_discovery_application | A discovery application was rejected |
 | reject_registration | A pending registration was rejected |
 | reload_guild | One guild was reloaded on the main Gateway |
+| reload_guilds | Many guilds were reloaded on the main Gateway |
+| remove_discovery_listing | A guild was removed from discovery |
 | remove_relationship | One relationship was removed from an account |
 | remove_relationships_by_category | Every relationship in one category was removed from an account |
 | remove_suspicious_email_domain | A domain was removed from the suspicious email domain list |
 | resend_verification_email | An email verification message was requested again for an account |
 | resolve_report | A report was updated or resolved |
+| revoke_admin_api_key | An Admin API key was revoked |
+| revoke_registration_url | A registration URL was revoked |
 | schedule_deletion | Account deletion was scheduled |
 | send_password_reset | A password reset message was requested for an account |
 | set_acls | The Admin ACL set of an account was replaced |
@@ -299,7 +391,9 @@ An operation records one of the following actions. The field is a free-form stri
 | system_dm.send | A system DM broadcast was created |
 | temp_ban | A temporary or permanent account ban was applied |
 | terminate_sessions | Every login session of an account was revoked |
+| test_smtp_connection | An SMTP connection test was run |
 | transfer_ownership<sup>1</sup> | Guild ownership or OAuth2 application ownership was transferred |
+| trigger_guild_archive | A guild archive was created |
 | trigger_user_archive | A user archive was created |
 | unban | An account ban was lifted |
 | unban_avatar_hash | An avatar hash was removed from the avatar blocklist |
@@ -310,9 +404,15 @@ An operation records one of the following actions. The field is a free-form stri
 | unban_profile_substring | A substring was removed from the profile substring blocklist |
 | unban_url | A URL was removed from the URL blocklist |
 | unban_url_domain | A domain was removed from the URL domain blocklist |
+| update_admin_api_key | An Admin API key was renamed or its ACLs were replaced |
+| update_discovery_categories | Guilds were moved to a discovery category |
+| update_discovery_listing | A discovery listing was edited |
 | update_features | Guild features were added or removed |
+| update_guild | A guild update with no field group was sent |
 | update_flags | Account flags were changed |
 | update_has_verified_phone | Verified phone state was changed |
+| update_instance_config | The instance configuration was updated |
+| update_limit_config | The limit configuration was replaced |
 | update_name | A guild name was changed |
 | update_premium_flags | Premium flags were changed |
 | update_settings | General guild settings were changed |
@@ -320,6 +420,7 @@ An operation records one of the following actions. The field is a free-form stri
 | update_vanity | A guild custom invite code was changed |
 | update_voice_region | A voice region was updated |
 | update_voice_server | A registered voice server was updated |
+| upload_branding_asset | An instance branding asset was uploaded or cleared |
 | verify_email | An email address was marked verified |
 
 <sup>1</sup> The same action name is recorded for two different resources, so `target_type` tells them apart
@@ -380,7 +481,7 @@ A successful Admin request from an account that is not a bot has no informationa
 
 ## List ACLs
 
-<RouteHeader method="GET" path="/v1/admin/acls" />
+<RouteHeader method="GET" path="/v1/admin/acls" auditReason />
 
 Returns every Admin permission string the instance recognises, in [ACL registry](#acl-registry) order. Requires `admin:authenticate`.
 
@@ -399,6 +500,10 @@ Returns every Admin permission string the instance recognises, in [ACL registry]
 | 200 | response body | ACL registry was returned |
 | 403 | [error response](#error-response) | Credential type is refused, or the account holds neither `admin:authenticate` nor `*` |
 
+### Side effects
+
+The operation records one [Admin audit entry](#admin-audit-entry-object) with action `list_admin_acls`, target type `admin_acl`, target ID `0`, and metadata key `acl_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -538,12 +643,10 @@ The registry is returned in this order by [List ACLs](#list-acls). A value outsi
 
 ## List audit log entries
 
-<RouteHeader method="GET" path="/v1/admin/audit-logs" />
+<RouteHeader method="GET" path="/v1/admin/audit-logs" auditReason />
 
 Returns a page of [Admin audit entry](#admin-audit-entry-object) objects with their resolved user, guild, and channel summaries. Requires `audit_log:view`.
 
-Reading the log records no entry of its own.
-
 ### Query parameters
 
 | Field | Type | Description |
@@ -552,6 +655,7 @@ Reading the log records no entry of its own.
 | admin_user_id? | snowflake | Return only entries recorded for this acting Admin |
 | target_type? | string | Return only entries recorded against this [audit target type](#audit-target-types) (1-64 characters) |
 | target_id? | string | Return only entries recorded against this target ID |
+| access? | string | `read` to return only read entries, `write` to return only write entries |
 | sort_by?<sup>2</sup> | string | `createdAt` or `relevance` (default `createdAt`) |
 | sort_order?<sup>2</sup> | string | `asc` or `desc` (default `desc`) |
 | limit? | integer | The maximum number of entries to return (1-200, default 50) |
@@ -581,13 +685,19 @@ Without an index, `q` is ignored, and a filtered page holds only the matches amo
 | 200 | response body | Audit page was returned |
 | 403 | [error response](#error-response) | Credential type is refused, or the account holds neither `audit_log:view` nor `*` |
 
+### Side effects
+
+The operation records one [Admin audit entry](#admin-audit-entry-object) with target type `audit_log` and target ID `0`. Its action is `search_audit_logs` when `q` is supplied and `list_audit_logs` otherwise. The metadata keys are `limit`, `offset`, `result_count` for the entries in this page, and `total`. The supplied filters add `filter_admin_user_id` and `access`, `filter_target_id` when `target_id` is a snowflake, and `filter_target_type` when `target_type` is lowercase letters and underscores. Any other `target_type` value adds `has_target_type_filter` instead. A search also records `sort_by` and `sort_order`. The query text is not recorded.
+
+The entry is written after the page is built, so it is never part of the page that recorded it.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the `admin:audit_log` bucket.
 
 ## Get audit log entry
 
-<RouteHeader method="GET" path="/v1/admin/audit-logs/{log_id}" />
+<RouteHeader method="GET" path="/v1/admin/audit-logs/{log_id}" auditReason />
 
 Returns one [Admin audit entry](#admin-audit-entry-object) object with the same resolved summaries the listing returns. Requires `audit_log:view`.
 
@@ -605,6 +715,10 @@ Returns one [Admin audit entry](#admin-audit-entry-object) object with the same
 | 403 | [error response](#error-response) | Credential type is refused, or the account holds neither `audit_log:view` nor `*` |
 | 404 | [error response](#error-response) | No entry has that identifier and the request returns `NOT_FOUND` |
 
+### Side effects
+
+The operation records one [Admin audit entry](#admin-audit-entry-object) with action `get_audit_log`, target type `audit_log`, the read entry's ID as target ID, and no metadata. A 404 records nothing.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the shared `admin:audit_log` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/instance.mdx b/fluxer_docs/src/content/docs/admin-api/instance.mdx
index f34f6d087..043be6b50 100644
--- a/fluxer_docs/src/content/docs/admin-api/instance.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/instance.mdx
@@ -494,7 +494,7 @@ Display metadata for one [limit key](/http-api/instance/#limit-keys), which an e
 
 ## Get instance configuration
 
-<RouteHeader method="GET" path="/v1/admin/instance/config" />
+<RouteHeader method="GET" path="/v1/admin/instance/config" auditReason />
 
 Returns the [instance configuration](#instance-configuration-object) object. Requires `instance:config:view`, or a session credential until setup is marked complete.
 
@@ -504,13 +504,17 @@ Returns the [instance configuration](#instance-configuration-object) object. Req
 | --- | --- | --- |
 | 200 | [instance configuration](#instance-configuration-object) object | Configuration was returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_instance_config`, target type `instance_config`, target ID `0`, and metadata keys `registration_url_count` and `pending_registration_count`. Before setup is complete, a session credential holding no Admin ACL records the entry with its own account as the acting Admin.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Update instance configuration
 
-<RouteHeader method="PATCH" path="/v1/admin/instance/config" />
+<RouteHeader method="PATCH" path="/v1/admin/instance/config" auditReason />
 
 Applies a merge patch to the stored configuration and returns the resulting [instance configuration](#instance-configuration-object) object. Requires `instance:config:update`, or a session credential until setup is marked complete.
 
@@ -583,7 +587,7 @@ Fluxer publishes a `gateway_rollout` change to the Gateway cluster. Premium mode
 
 Initial setup completes on the first update that sets `app_public.setup.configured` to true from a session credential whose account holds neither `admin:authenticate` nor the wildcard. That update grants the account the wildcard Admin ACL and marks the deployment as bootstrapped.
 
-The operation records no Admin audit entry of its own.
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `update_instance_config`, target type `instance_config`, and target ID `0`. The metadata key `sections` lists the names of the non-null top-level sections in the body, comma-separated in alphabetical order, and is absent when the body supplies none. The update that completes initial setup and grants the wildcard ACL also records `granted_acls` as `*`. No value from the body is recorded. A request that fails part way records no entry.
 
 ### Rate limit
 
@@ -591,7 +595,7 @@ The operation records no Admin audit entry of its own.
 
 ## Create branding asset
 
-<RouteHeader method="POST" path="/v1/admin/instance/config/branding-assets" />
+<RouteHeader method="POST" path="/v1/admin/instance/config/branding-assets" auditReason />
 
 Uploads an image, stores its [Media Proxy](/media-proxy/overview/) URL in the selected branding slot, and returns the resulting [instance configuration](#instance-configuration-object) object. Requires `instance:config:update`, or a session credential until setup is marked complete.
 
@@ -619,13 +623,15 @@ Uploads an image, stores its [Media Proxy](/media-proxy/overview/) URL in the se
 
 The stored image is served through the Media Proxy. Non-JPEG images are re-encoded to strip metadata and JPEG images are re-encoded at quality 100. The previously referenced image is not deleted.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `upload_branding_asset`, target type `instance_config`, target ID `0`, and metadata keys `kind` and `cleared`. `cleared` is `true` when the request cleared the slot.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the `admin:user:modify` bucket.
 
 ## Create SMTP test
 
-<RouteHeader method="POST" path="/v1/admin/instance/config/smtp-tests" />
+<RouteHeader method="POST" path="/v1/admin/instance/config/smtp-tests" auditReason />
 
 Opens a connection to the supplied SMTP server, authenticates against it, and reports the outcome as an [SMTP test result](#smtp-test-result-object) object without storing anything. Requires `instance:config:update`, or a session credential until setup is marked complete.
 
@@ -653,13 +659,15 @@ A test that runs to completion answers 200 whether or not the server accepted th
 
 No configuration is written and the supplied credentials are discarded when the request completes. The connection, greeting, and socket each have a ten-second deadline.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `test_smtp_connection`, target type `instance_config`, target ID `0`, and metadata keys `port`, `secure`, and `ok`. The host, username, password, and failure text are not recorded.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the `admin:user:modify` bucket.
 
 ## Create registration URL
 
-<RouteHeader method="POST" path="/v1/admin/instance/registration-urls" />
+<RouteHeader method="POST" path="/v1/admin/instance/registration-urls" auditReason />
 
 Issues a registration URL an Admin can hand out while the registration mode is `closed` or `approval`, and returns a [registration URL creation](#registration-url-creation-object) object. Requires `instance:config:update`.
 
@@ -686,7 +694,9 @@ The returned `code` is the same value as `registration_url.id`, and every [Get i
 
 ### Side effects
 
-A newly issued URL has a use count of zero, no revocation time, and the acting Admin as its issuer. It is the first entry of `registration.urls` on the next configuration read. The operation records no Admin audit entry and changes no account.
+A newly issued URL has a use count of zero, no revocation time, and the acting Admin as its issuer. It is the first entry of `registration.urls` on the next configuration read. The operation changes no account.
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `create_registration_url`, target type `registration_url`, target ID `0`, and metadata key `approval_required`, plus `max_uses` when the body sets it. The label is not recorded. The entry has no registration URL identifier, because the identifier is the bearer code.
 
 ### Rate limit
 
@@ -694,7 +704,7 @@ A newly issued URL has a use count of zero, no revocation time, and the acting A
 
 ## Revoke registration URL
 
-<RouteHeader method="DELETE" path="/v1/admin/instance/registration-urls/{registration_url_id}" />
+<RouteHeader method="DELETE" path="/v1/admin/instance/registration-urls/{registration_url_id}" auditReason />
 
 Revokes one registration URL so it can no longer be redeemed and returns the resulting [instance configuration](#instance-configuration-object) object. Requires `instance:config:update`.
 
@@ -718,7 +728,9 @@ An account that registered through the URL keeps its access, membership, and dec
 
 ### Side effects
 
-The URL records its revocation time and stays in the configuration response afterwards. The operation records no Admin audit entry and changes no account.
+The URL records its revocation time and stays in the configuration response afterwards. The operation changes no account.
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `revoke_registration_url`, target type `registration_url`, target ID `0`, and no metadata, including for an identifier that names no registration URL. The entry has no registration URL identifier, because the identifier is the bearer code.
 
 ### Rate limit
 
@@ -748,7 +760,7 @@ Approves or rejects one pending registration and returns the resulting [instance
 | --- | --- | --- |
 | 200<sup>1</sup> | [instance configuration](#instance-configuration-object) object | The decision was applied |
 
-<sup>1</sup> An account that no longer exists still answers 200. The pending registration is removed, no trait is written, and no audit entry is recorded
+<sup>1</sup> An account that no longer exists still answers 200. The pending registration is removed and no trait is written
 
 :::caution[Decisions apply even without a pending entry]
 Both decisions remove the pending registration, but the endpoint does not require the account to be in that list. Rejecting writes the `registration_rejected` trait. A later approval can clear it again. The trait can also be changed through [Set user traits](/admin-api/users/#set-user-traits).
@@ -760,7 +772,7 @@ Approval removes both the `registration_pending_approval` trait and the `registr
 
 When the stored pending registration list fails validation, the request fails before Fluxer changes the account. A failure after Fluxer writes the account traits leaves those traits written and can leave the entry in the pending list. Check the account traits and the pending list before retrying.
 
-One Admin audit entry with the action `approve_registration` or `reject_registration` targets the account, records the audit reason, and has no metadata.
+One Admin audit entry with the action `approve_registration` or `reject_registration` targets the account and records the audit reason. It has no metadata, except for an account that no longer exists, whose entry has the metadata key `account_found` set to `false`.
 
 ### Rate limit
 
@@ -768,7 +780,7 @@ One Admin audit entry with the action `approve_registration` or `reject_registra
 
 ## Get limit configuration
 
-<RouteHeader method="GET" path="/v1/admin/limit-config" />
+<RouteHeader method="GET" path="/v1/admin/limit-config" auditReason />
 
 Returns the [limit configuration response](#limit-configuration-response-object) object. Requires `instance:limit_config:view`.
 
@@ -782,13 +794,15 @@ Returns the [limit configuration response](#limit-configuration-response-object)
 
 The response reflects the configuration in force on the node that serves the request, so two nodes can report different values while a change propagates.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_limit_config`, target type `limit_config`, target ID `0`, and metadata key `rule_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Replace limit configuration
 
-<RouteHeader method="PUT" path="/v1/admin/limit-config" />
+<RouteHeader method="PUT" path="/v1/admin/limit-config" auditReason />
 
 Replaces the stored limit configuration with the supplied document and returns the resulting [limit configuration response](#limit-configuration-response-object) object. Requires `instance:limit_config:update`.
 
@@ -821,7 +835,7 @@ On a self-hosted deployment whose premium mode is `everyone`, Fluxer drops the `
 
 Each rule's `modifiedFields` is then recomputed and the merged document replaces the stored one. Every API node adopts the new configuration. Clients observe it through the published [limit configuration](/http-api/instance/#limit-configuration-object).
 
-The operation records no Admin audit entry.
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `update_limit_config`, target type `limit_config`, target ID `0`, and metadata keys `rule_count`, `changed_rule_count`, and `trait_definition_count`, each taken from the stored document. `changed_rule_count` is the number of rule identifiers added, removed, or stored with different filters or limits, compared with the configuration the serving node held before the write.
 
 ### Rate limit
 
@@ -829,7 +843,7 @@ The operation records no Admin audit entry.
 
 ## Create heap snapshot
 
-<RouteHeader method="POST" path="/v1/admin/system/heap-snapshots" />
+<RouteHeader method="POST" path="/v1/admin/system/heap-snapshots" auditReason />
 
 Writes a V8 heap snapshot of the API process that serves the request and returns the file. Requires `system:heap_snapshot`.
 
@@ -855,7 +869,7 @@ A deployment behind a load balancer needs several attempts to reach a particular
 
 ### Side effects
 
-No configuration is changed and no Admin audit entry is recorded.
+No configuration is changed. The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `create_heap_snapshot`, target type `system`, target ID `0`, and metadata key `size_bytes`, after the snapshot is written and before the file is sent. A snapshot that fails to write records no entry.
 
 ### Rate limit
 
diff --git a/fluxer_docs/src/content/docs/admin-api/jobs.mdx b/fluxer_docs/src/content/docs/admin-api/jobs.mdx
index 88621305f..ea0e30dcd 100644
--- a/fluxer_docs/src/content/docs/admin-api/jobs.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/jobs.mdx
@@ -8,7 +8,7 @@ import RouteHeader from '@/components/RouteHeader.astro';
 
 These routes list recorded background jobs and request cancellation. Create jobs through [Queue bulk job](/admin-api/bulk-jobs/#queue-bulk-job), [Create system DM broadcast](/admin-api/system-dms/#create-system-dm-broadcast), [Refresh search index](/admin-api/search-indexes/#refresh-search-index), or an [archive](/admin-api/archives/) request.
 
-Reads require `jobs:view` and cancellation requires `jobs:cancel`. Every operation on this page shares the `admin:jobs:view` bucket.
+Reads require `jobs:view` and cancellation requires `jobs:cancel`. Every operation on this page shares the `admin:jobs:view` bucket. The three reads record no [Admin audit entry](/admin-api/#admin-audit-entry-object), and cancellation records one.
 
 :::note[Job updates vary by task]
 Mention processing, link previews, and every scheduled task except `syncDisposableEmailDomains`, `syncUrlBlocklists` and `syncFileShaBlocklists` run with no job record and never appear here. A job also runs with no record when Fluxer fails to write that record. When a later write of status, progress or attempts fails, Fluxer logs the failure and the job continues, so the stored values can be behind the real run. Use the [archive routes](/admin-api/archives/) to track archive progress and failures.
@@ -160,6 +160,10 @@ Supply all three cursor parameters together or omit all three. An incomplete or
 | 200 | response body | The job page was returned |
 | 400 | [error response](/admin-api/#error-response) | `INVALID_FORM_BODY` because a query parameter is invalid |
 
+### Side effects
+
+The operation records no [Admin audit entry](/admin-api/#admin-audit-entry-object).
+
 ### Rate limit
 
 600 requests per minute for each authenticated user, on the `admin:jobs:view` bucket.
@@ -184,6 +188,10 @@ This operation has no filters or pagination. The stored status and progress can
 | --- | --- | --- |
 | 200 | response body | The active jobs were returned |
 
+### Side effects
+
+The operation records no [Admin audit entry](/admin-api/#admin-audit-entry-object).
+
 ### Rate limit
 
 600 requests per minute for each authenticated user, on the `admin:jobs:view` bucket.
@@ -215,13 +223,17 @@ Returns one [Admin job](#admin-job-object) object. Requires `jobs:view`.
 
 A 404 response uses this single-field body rather than the standard error response. A missing or expired record does not mean the work never ran.
 
+### Side effects
+
+The operation records no [Admin audit entry](/admin-api/#admin-audit-entry-object).
+
 ### Rate limit
 
 600 requests per minute for each authenticated user, on the `admin:jobs:view` bucket.
 
 ## Cancel job
 
-<RouteHeader method="PUT" path="/v1/admin/jobs/{job_id}/cancellation" />
+<RouteHeader method="PUT" path="/v1/admin/jobs/{job_id}/cancellation" auditReason />
 
 Requests cooperative cancellation of a job and reports whether the request was recorded. Requires `jobs:cancel`.
 
@@ -249,6 +261,8 @@ Returns false for a missing or terminal job. Repeating a request for a queued or
 
 Sets `cancel_requested` to true for a queued or running job. `sendSystemDm`, `syncDisposableEmailDomains`, `bulkBanFileShas`, `bulkDeleteMessagesForUsers`, and the tasks queued by [Bulk jobs](/admin-api/bulk-jobs/) check for the request while they run and stop at the next check. Other tasks run to the end. Completed work is not undone. A status of `cancelled` means the task stopped because of the request.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `cancel_job`, target type `bulk_job`, target ID equal to `job_id`, and metadata key `cancelled`. The entry uses target type `bulk_job` for every task type, and Fluxer records it when `cancelled` is false too.
+
 ### Rate limit
 
 600 requests per minute for each authenticated user, on the `admin:jobs:view` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/messages.mdx b/fluxer_docs/src/content/docs/admin-api/messages.mdx
index 96fe84be9..3e720f0e7 100644
--- a/fluxer_docs/src/content/docs/admin-api/messages.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/messages.mdx
@@ -139,7 +139,7 @@ A job identifier that never existed reports `not_found` too, so the two are indi
 
 ## List channel messages
 
-<RouteHeader method="GET" path="/v1/admin/channels/{channel_id}/messages" />
+<RouteHeader method="GET" path="/v1/admin/channels/{channel_id}/messages" auditReason />
 
 Returns one page of [Admin message](#admin-message-object) objects for one channel. Requires `message:lookup`.
 
@@ -187,13 +187,17 @@ The response has no cursor member. Page further by sending the ID of the oldest
 
 A channel that does not exist returns an empty `messages` array with `has_more` false, so this operation never answers 404.
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `list_channel_messages`, the target type `channel`, and the channel ID as the target. Its metadata keys are `limit`, `result_count` for the messages in this page, and `has_more`. A supplied `before` or `after` cursor is added under the same key.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the shared `admin:message:operation` bucket.
 
 ## Get message
 
-<RouteHeader method="GET" path="/v1/admin/channels/{channel_id}/messages/{message_id}" />
+<RouteHeader method="GET" path="/v1/admin/channels/{channel_id}/messages/{message_id}" auditReason />
 
 Returns the requested message together with the messages surrounding it, as one array of [Admin message](#admin-message-object) objects, oldest first. Requires `message:lookup`.
 
@@ -232,6 +236,10 @@ Returns the requested message together with the messages surrounding it, as one
 
 An unknown message returns 200 with the window surrounding the position the missing ID would have occupied, so this operation never returns `UNKNOWN_MESSAGE`. An unknown channel returns 200 with an empty `messages` array.
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `get_message`, the target type `message`, and the message ID as the target. Its metadata keys are `channel_id`, `context_limit`, `result_count` for the messages returned, and `found`, which is `true` when the requested message is in `messages` and `false` otherwise.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the shared `admin:message:operation` bucket.
@@ -281,7 +289,7 @@ One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with t
 
 ## Search messages
 
-<RouteHeader method="GET" path="/v1/admin/messages" />
+<RouteHeader method="GET" path="/v1/admin/messages" auditReason />
 
 Searches the message index of one channel, or resolves one message in that channel by message ID or by attachment identity. Requires `message:lookup`.
 
@@ -345,13 +353,23 @@ With no message search service configured the search mode returns an empty `mess
 A hit whose message no longer exists is dropped from the page and excluded from `total`.
 :::
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `search_messages`. Its metadata key `mode` is `message` for a `message_id` lookup, `attachment` for an attachment lookup, and `search` otherwise, and `result_count` is the number of messages returned.
+
+- A `message_id` lookup has the target type `message` and the message ID as the target. It adds `channel_id`, `context_limit`, and `found`, which is `true` when the message is in `messages`.
+- An attachment lookup has the target type `channel` and the channel ID as the target. It adds `attachment_id`, `context_limit`, and `found`, which is `true` when the attachment resolved. A resolved attachment also adds `message_id`.
+- A search has the target type `channel` and the channel ID as the target. It adds `limit` and `total`, and `has_query` as `true` when `q` is supplied.
+
+The query text and the filename are not recorded. A 400 records nothing.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the shared `admin:message:operation` bucket.
 
 ## Get message shred job
 
-<RouteHeader method="GET" path="/v1/admin/messages/shreds/{job_id}" />
+<RouteHeader method="GET" path="/v1/admin/messages/shreds/{job_id}" auditReason />
 
 Returns one [message shred status](#message-shred-status-object) object. Requires `message:shred`.
 
@@ -371,6 +389,10 @@ Shred jobs are created by [Shred user messages](/admin-api/users/#shred-user-mes
 | --- | --- | --- |
 | 200 | [message shred status](#message-shred-status-object) object | Job state was returned, including `not_found` for an unknown or expired job |
 
+### Side effects
+
+One [Admin audit entry](/admin-api/#admin-audit-entry-object) is recorded with the action `get_message_shred_status`, the target type `message_shred`, and the target ID `0`. Its metadata keys are `job_id` and `status`, which is the returned job state.
+
 ### Rate limit
 
 100 requests per minute for each authenticated user, on the shared `admin:message:operation` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/reports.mdx b/fluxer_docs/src/content/docs/admin-api/reports.mdx
index 6c5c1398d..7e60b008a 100644
--- a/fluxer_docs/src/content/docs/admin-api/reports.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/reports.mdx
@@ -254,7 +254,7 @@ A report resolution is the reduced view [Update report](#update-report) returns.
 
 ## List reports
 
-<RouteHeader method="GET" path="/v1/admin/reports" />
+<RouteHeader method="GET" path="/v1/admin/reports" auditReason />
 
 Returns a page of [Admin report](#admin-report-object) objects without message context. Requires `report:view`.
 
@@ -313,13 +313,17 @@ An instance with no search backend returns 403 `FEATURE_TEMPORARILY_DISABLED` on
 | 200 | response body | Report page was returned |
 | 403 | [error response](/admin-api/#error-response) | No search backend is configured for the instance and the request returns `FEATURE_TEMPORARILY_DISABLED` |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `search_reports`, target type `report`, and target ID `0` on both branches. The metadata keys are `limit`, `offset`, `result_count` for the reports in this page, and `total`. The search branch adds `sort_by` and `sort_order`. A supplied `q` adds `has_query` with the value `true`, and the query text is not recorded. The supplied filters add `status`, `report_type`, `reported_user_id`, `reported_guild_id`, and `reported_channel_id` under their own names, `reporter_id` as `reporter_user_id`, `guild_context_id` as `context_guild_id`, and `resolved_by_admin_id` as `resolved_by_admin_user_id`. `category` is not recorded. A 403 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get report
 
-<RouteHeader method="GET" path="/v1/admin/reports/{report_id}" />
+<RouteHeader method="GET" path="/v1/admin/reports/{report_id}" auditReason />
 
 Returns one [Admin report detail](#admin-report-detail-object) object, which adds the captured message context and the live state of those messages. Requires `report:view`.
 
@@ -338,6 +342,10 @@ The operation answers even when the report search index is unavailable. Reporter
 | 200 | [Admin report detail](#admin-report-detail-object) object | Report was returned |
 | 404 | [error response](/admin-api/#error-response) | Report does not exist and the request returns `UNKNOWN_REPORT` |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_report`, target type `report`, the report ID as target ID, and metadata keys `report_type` and `status` with the integer values of the report. The attachment download URLs are not recorded. A 404 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/search-indexes.mdx b/fluxer_docs/src/content/docs/admin-api/search-indexes.mdx
index c9992a3ee..cbb29f63a 100644
--- a/fluxer_docs/src/content/docs/admin-api/search-indexes.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/search-indexes.mdx
@@ -183,6 +183,10 @@ Returns the [search index refresh progress](#search-index-refresh-progress-objec
 Each write of the progress record renews a one-hour lifetime, so a completed or failed outcome stays readable for one hour after its final update.
 :::
 
+### Side effects
+
+The operation records no [Admin audit entry](/admin-api/#admin-audit-entry-object).
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/users.mdx b/fluxer_docs/src/content/docs/admin-api/users.mdx
index 57e8561ed..a79c2ad9b 100644
--- a/fluxer_docs/src/content/docs/admin-api/users.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/users.mdx
@@ -10,7 +10,7 @@ These routes read and edit any account on the instance. An account has more fiel
 
 Each mutable field group has its own route, its own [ACL](/admin-api/#acl-registry), and its own [audit action](/admin-api/#audit-actions), so there is no combined update.
 
-A read records no audit entry and reads no audit reason. [List user sessions](#list-user-sessions) and [List user WebAuthn credentials](#list-user-webauthn-credentials) are the exceptions. `POST /v1/admin/users/{user_id}/avatar-block` addresses a user path but belongs to [Blocklists](/admin-api/blocklists/#block-a-users-current-avatar).
+Every operation on this page records an [Admin audit entry](/admin-api/#admin-audit-entry-object), reads included. [Get current Admin user](#get-current-admin-user) is the exception and records nothing. `POST /v1/admin/users/{user_id}/avatar-block` addresses a user path but belongs to [Blocklists](/admin-api/blocklists/#block-a-users-current-avatar).
 
 :::caution[A missing PII ACL nulls the protected fields]
 A caller without `user:view:email` receives a null `email`. A caller without `user:view:dob` receives a null `date_of_birth`, and a caller without `user:view:ip` receives null `last_active_ip`, `last_active_ip_reverse`, and `last_active_location`. The read still succeeds, so a null field is no evidence that the account has none.
@@ -449,7 +449,7 @@ One recorded change to the account's email address, phone verification state, or
 
 ## List users
 
-<RouteHeader method="GET" path="/v1/admin/users" />
+<RouteHeader method="GET" path="/v1/admin/users" auditReason />
 
 Lists and searches accounts. Requires `user:lookup`, and `user:view:email` or `user:view:ip` for the selectors marked below. The response has an array of [Admin user](#admin-user-object) objects and a total.
 
@@ -502,6 +502,12 @@ A `q` value that is entirely digits also resolves that exact account ID and plac
 
 <sup>1</sup> A selector that matches nothing returns an empty `users` array and a `total` of zero
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `search_users`, target type `user`, and target ID `0`. The metadata keys are `selector`, `result_count` for the accounts in `users`, and `total`. `selector` is the honoured selector, one of `user_id`, `resolve`, `email`, `last_active_ip`, or `search` for the indexed search.
+
+The `user_id` selector adds `user_id_count` for the number of IDs supplied, and `user_id` when exactly one ID was supplied. The `last_active_ip` and `search` selectors add `limit` and `offset`. The indexed search adds `has_query` as `true` when `q` is not blank. The `resolve`, `email`, `last_active_ip`, and `q` values are not recorded. A failed request records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -527,13 +533,17 @@ Every Admin credential holds `admin:authenticate`, so every account that can rea
 | 200 | response body | Current Admin was returned |
 | 403 | [error response](/admin-api/#error-response) | Credential type is refused, or the account does not hold `admin:authenticate` |
 
+### Side effects
+
+The operation records no [Admin audit entry](/admin-api/#admin-audit-entry-object).
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get user
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}" auditReason />
 
 Returns one account as a single-element array. Requires `user:lookup`.
 
@@ -561,6 +571,10 @@ Returns one account as a single-element array. Requires `user:lookup`.
 
 An account with a pending or completed deletion is still returned, with its lifecycle state visible through `pending_deletion_at`, `deletion_reason_code`, and `deletion_public_reason`.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_user`, target type `user`, the path `user_id` as target ID, and a metadata key `found`. `found` is `true` when `users` has the account and `false` when it is empty.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -1516,7 +1530,7 @@ Fluxer emails the account holder when the account has an email address. The emai
 
 ## List user guilds
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}/guilds" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}/guilds" auditReason />
 
 Lists the guilds the account is a member of, in ascending guild ID order. Requires `user:list:guilds`. Both cursors apply to the account's own sorted membership list.
 
@@ -1556,13 +1570,17 @@ Lists the guilds the account is a member of, in ascending guild ID order. Requir
 
 The response has no paging state. Derive the next cursor from the last returned guild ID, and treat a short page as the end of the list.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_user_guilds`, target type `user`, the path `user_id` as target ID, and the metadata keys `limit`, `with_counts`, and `guild_count` for the guilds returned. A supplied cursor adds `before_guild_id` or `after_guild_id`. A failed request records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## List user direct message channels
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}/dm-channels" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}/dm-channels" auditReason />
 
 Lists the direct message channels the account has taken part in. Requires `user:list:dm_channels`. The read does not open, reopen, or acknowledge a channel for the target account.
 
@@ -1606,13 +1624,17 @@ The group branch ignores `before`, `after`, and `limit`, and returns every group
 
 The response has no paging state. Derive the next cursor from the last returned channel ID.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_user_dm_channels`, target type `user`, the path `user_id` as target ID, and the metadata keys `type` and `channel_count` for the channels returned. A `dm` request also records `limit`, and `before_channel_id` or `after_channel_id` when a cursor is supplied. A 404 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## List user applications
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}/applications" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}/applications" auditReason />
 
 Lists the OAuth2 applications the account owns. Requires `application:lookup` or `application:list:by_owner`, the same pair [List applications](/admin-api/applications/#list-applications) accepts.
 
@@ -1637,13 +1659,17 @@ Lists the OAuth2 applications the account owns. Requires `application:lookup` or
 | 200 | response body | The applications were returned |
 | 404 | [error response](/admin-api/#error-response) | `UNKNOWN_USER`, because the account does not exist |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_user_applications`, target type `user`, the path `user_id` as target ID, and a metadata key `application_count`. A 404 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## List user relationships
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}/relationships" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}/relationships" auditReason />
 
 Lists the friends, friend requests, and blocked accounts of the account, split into one array for each [relationship category](#relationship-categories). Requires `user:list:relationships`.
 
@@ -1673,6 +1699,10 @@ The operation accepts no cursor, category filter, or limit, and returns every ca
 | 200 | response body | The relationships were returned |
 | 404 | [error response](/admin-api/#error-response) | `UNKNOWN_USER`, because the account does not exist |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_user_relationships`, target type `user`, the path `user_id` as target ID, and the metadata keys `friend_count`, `incoming_request_count`, `outgoing_request_count`, and `blocked_count`. A 404 records nothing.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -1778,8 +1808,8 @@ The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-obje
 
 Lists the account's active and terminated authentication sessions. Requires `user:list:sessions`. IP, reverse DNS and location fields also require `user:view:ip`.
 
-:::caution[Listing sessions writes an audit entry]
-The `X-Audit-Log-Reason` header value is stored on the recorded entry.
+:::caution[Listing sessions records an audit entry]
+The entry stores the `X-Audit-Log-Reason` value whether or not the caller holds `user:view:ip`, so a listing with redacted addresses is recorded too.
 :::
 
 ### Path parameters
@@ -1867,8 +1897,6 @@ The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-obje
 
 Lists the passkeys and security keys registered on the account, as a bare JSON array. Requires `user:update:mfa`, the same ACL as [Disable user MFA](#disable-user-mfa).
 
-Like [List user sessions](#list-user-sessions), this read records an audit entry and stores the `X-Audit-Log-Reason` value on it.
-
 ### Path parameters
 
 | Field | Type | Description |
@@ -2120,7 +2148,7 @@ No [User Update](/gateway/events/#user-update) is emitted, unlike every other mu
 
 ## Create user archive
 
-<RouteHeader method="POST" path="/v1/admin/users/{user_id}/archives" />
+<RouteHeader method="POST" path="/v1/admin/users/{user_id}/archives" auditReason />
 
 Creates an asynchronous archive of the account's data and returns the created [archive](/admin-api/archives/#archive-object) object. Requires `archive:trigger:user`.
 
@@ -2155,13 +2183,15 @@ Fluxer creates the archive record and queues a build job, so the response return
 
 No Gateway Dispatch is emitted.
 
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `trigger_user_archive`, target type `user`, the path `user_id` as target ID, and the metadata keys `archive_id` for the created archive and `include_attachments` as `true` or `false`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## List user change log
 
-<RouteHeader method="GET" path="/v1/admin/users/{user_id}/change-log" />
+<RouteHeader method="GET" path="/v1/admin/users/{user_id}/change-log" auditReason />
 
 Lists the identity and contact field changes recorded for the account, newest first. Requires `user:view:contact_log`. Email values also require `user:view:email`.
 
@@ -2201,6 +2231,10 @@ Lists the identity and contact field changes recorded for the account, newest fi
 
 Without `user:view:email`, an `email` entry is still returned with both value fields replaced by the literal string `[redacted]`, so the fact and the time of the change stay visible while the addresses do not.
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_user_change_log`, target type `user`, the path `user_id` as target ID, and the metadata keys `limit` and `entry_count` for the entries returned. A supplied `page_token` adds `has_page_token` as `true`, and the cursor value is not recorded.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
diff --git a/fluxer_docs/src/content/docs/admin-api/voice.mdx b/fluxer_docs/src/content/docs/admin-api/voice.mdx
index 5502a8c25..393623343 100644
--- a/fluxer_docs/src/content/docs/admin-api/voice.mdx
+++ b/fluxer_docs/src/content/docs/admin-api/voice.mdx
@@ -167,7 +167,7 @@ The limit is read when a channel is first placed and the server is pinned for it
 
 ## List voice regions
 
-<RouteHeader method="GET" path="/v1/admin/voice/regions" />
+<RouteHeader method="GET" path="/v1/admin/voice/regions" auditReason />
 
 Returns every [Admin voice region](#admin-voice-region-object) object in ascending display name order. Requires `voice:region:list`.
 
@@ -191,13 +191,17 @@ Returns every [Admin voice region](#admin-voice-region-object) object in ascendi
 | --- | --- | --- |
 | 200 | response body | The regions were returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_voice_regions`, target type `voice_region`, target ID `0`, and metadata keys `include_servers` and `result_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get voice region
 
-<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}" />
+<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}" auditReason />
 
 Returns one [Admin voice region](#admin-voice-region-object) object. Requires `voice:region:list`.
 
@@ -231,6 +235,10 @@ Returns one [Admin voice region](#admin-voice-region-object) object. Requires `v
 | --- | --- | --- |
 | 200 | response body | A lookup was done, whether or not it resolved |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_voice_region`, target type `voice_region`, target ID `0`, and metadata keys `region_id`, `include_servers`, and `found`. An unknown region records `found` as `false`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
@@ -380,7 +388,7 @@ One [Admin audit entry](/admin-api/#admin-audit-entry-object) with the action `d
 
 ## List voice servers
 
-<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}/servers" />
+<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}/servers" auditReason />
 
 Returns every [Admin voice server](#admin-voice-server-object) object registered in one region. Requires `voice:server:list`.
 
@@ -404,13 +412,17 @@ Returns every [Admin voice server](#admin-voice-server-object) object registered
 | --- | --- | --- |
 | 200 | response body | The servers were returned |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `list_voice_servers`, target type `voice_server`, target ID `0`, and metadata keys `region_id` and `result_count`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
 
 ## Get voice server
 
-<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}/servers/{server_id}" />
+<RouteHeader method="GET" path="/v1/admin/voice/regions/{region_id}/servers/{server_id}" auditReason />
 
 Returns one [Admin voice server](#admin-voice-server-object) object. Requires `voice:server:list`.
 
@@ -435,6 +447,10 @@ Returns one [Admin voice server](#admin-voice-server-object) object. Requires `v
 | --- | --- | --- |
 | 200 | response body | A lookup was done, whether or not it resolved |
 
+### Side effects
+
+The operation records one [Admin audit entry](/admin-api/#admin-audit-entry-object) with action `get_voice_server`, target type `voice_server`, target ID `0`, and metadata keys `region_id`, `server_id`, and `found`. A pair that resolves to no server records `found` as `false`.
+
 ### Rate limit
 
 200 requests per minute for each authenticated user, on the `admin:lookup` bucket.
diff --git a/packages/schema/src/contracts/search/SearchDocumentTypes.ts b/packages/schema/src/contracts/search/SearchDocumentTypes.ts
index a974a96e4..cc2eb1370 100644
--- a/packages/schema/src/contracts/search/SearchDocumentTypes.ts
+++ b/packages/schema/src/contracts/search/SearchDocumentTypes.ts
@@ -191,6 +191,8 @@ export interface AuditLogSearchFilters {
 	targetType?: string;
 	targetId?: string;
 	action?: string;
+	actions?: Array<string>;
+	excludeActions?: Array<string>;
 	sortBy?: 'createdAt' | 'relevance';
 	sortOrder?: 'asc' | 'desc';
 }
diff --git a/packages/schema/src/domains/admin/AdminSchemas.ts b/packages/schema/src/domains/admin/AdminSchemas.ts
index 0a8f002ff..9a7c3c860 100644
--- a/packages/schema/src/domains/admin/AdminSchemas.ts
+++ b/packages/schema/src/domains/admin/AdminSchemas.ts
@@ -93,6 +93,14 @@ const AuditLogSortByEnum = createNamedStringLiteralUnion(
 	],
 	'Field to sort audit logs by',
 );
+const AdminAuditAccessEnum = createNamedStringLiteralUnion(
+	[
+		['read', 'read', 'An entry recorded by an operation that only reads data'],
+		['write', 'write', 'An entry recorded by an operation that changes data or triggers work'],
+	],
+	'Whether the recorded operation read data or changed it',
+);
+export type AdminAuditAccess = z.infer<typeof AdminAuditAccessEnum>;
 const ReportSortByEnum = createNamedStringLiteralUnion(
 	[
 		['createdAt', 'createdAt', 'Sort by creation timestamp'],
@@ -133,6 +141,9 @@ export const ListAdminAuditLogsQuery = z.object({
 	admin_user_id: SnowflakeType.optional().describe('Filter by admin user who performed the action'),
 	target_type: createStringType(1, 64).optional().describe('Filter by target entity type'),
 	target_id: z.string().optional().describe('Filter by target entity ID (user, channel, role, invite code, etc.)'),
+	access: AdminAuditAccessEnum.optional().describe(
+		'Only return entries recorded by reads or only entries recorded by writes',
+	),
 	sort_by: AuditLogSortByEnum.default('createdAt'),
 	sort_order: SortOrderEnum.default('desc'),
 	limit: createQueryIntegerType({defaultValue: 50, minValue: 1, maxValue: 200}).describe(
@@ -1044,6 +1055,7 @@ export const AdminAuditLogResponseSchema = z.object({
 	related_guilds: z.record(SnowflakeStringType, AdminAuditLogGuildSummarySchema),
 	related_channels: z.record(SnowflakeStringType, AdminAuditLogChannelSummarySchema),
 	action: createStringType(1, 256),
+	access: AdminAuditAccessEnum,
 	audit_log_reason: createStringType(1, 4000).nullable(),
 	metadata: z.record(createStringType(1, 256), createStringType(0, 4000)),
 	created_at: z.string(),