What this audit checks
Authentication & access
- API token still valid (auth on /whoami)
- Token still has access to the configured doc (GET /docs/ succeeds, not 403/404)
- Tracker table resolvable in the doc and the status_column exists with mappable open / done values
- Doc ACL is not ‘anyone-with-link write’ (over-broad share - leak risk)
- Coda rate-limit headroom > 30% (per-token quota; 429 with Retry-After)
Tracker health
- Open row count vs 30-day baseline (sudden growth = drowning signal)
- Blocked-status row count + change WoW
- Oldest open row age via createdAt (>90 days = backlog rot)
- Rows with no status_column value (untriaged work)
- Status distribution skew (mostly one bucket = pipeline stall)
VortexIQ findings lifecycle (the stickiness test)
- Abandoned findings - VortexIQ-created rows, no edit (updatedAt) >14d
- Finding resolution rate over rolling 90d (target >75%)
- Avg time-to-fix for resolved findings
- Rows whose vortexiqFindingId was cleared/overwritten (loop broken - can no longer attribute)
- Regression rate - rows whose status reopened after reaching a done group
Team capacity
- Assignee-column values with >10 open rows (overload signal; only when an assignee column is configured)
- Assignees with zero resolved rows in 14d (parked work)
- Cycle-time degradation > 25% week-over-week (createdAt → updatedAt for resolved rows)
Cross-connector signals
- Critical findings from sibling connectors (shopify/bigcommerce/adobe/cybersource) older than 7 days with no Coda tracker row - coverage gap
- Coda rows referencing decommissioned/archived integrations - stale work
Data sources
GET https://coda.io/apis/v1/whoami- Token validity + account identityGET https://coda.io/apis/v1/docs/{docId}- Doc access + ownership/workspace attributionGET https://coda.io/apis/v1/docs/{docId}/tables/{tableId}- Table resolvability + rowCount + column mapping (status_column check)POST https://coda.io/apis/v1/docs/{docId}/tables/{tableId}/rows- Filtered backlog reads (open count, blocked, abandoned, by-assignee, by-status)GET https://coda.io/apis/v1/docs/{docId}/acl/permissions- Over-broad-share / ACL check