Audit log
The audit log records who did what in a workspace, and when. Each event carries only the detail keys listed for its action, so a secret can’t ride along.
What it records
Sign-ins and access
| Action | What happened | Details |
|---|
sso.signed_in | Someone signed in through the workspace’s SSO. joined says whether that made them a member. | joined |
sso.refused | An SSO sign-in was refused, with the reason. | reason |
sso.break_glass | An owner opened a workspace that requires SSO without an SSO session. Recorded once a day per person. | method |
sso.required | A member without an SSO session was turned away from a workspace that requires SSO. Recorded once a day per person. | method |
SSO settings
| Action | What happened | Details |
|---|
sso.connection_saved | The SSO connection was saved. | issuer, client_id |
sso.connection_tested | The SSO connection was tested with a sign-in. | issuer |
sso.connection_deleted | The SSO connection was deleted. | issuer |
sso.domain_added | An email domain was added for SSO. | domain |
sso.domain_verified | An email domain’s TXT record was verified. | domain |
sso.domain_check_failed | A check of an email domain’s TXT record failed. | domain |
sso.domain_removed | An email domain was removed. | domain |
sso.enforcement_changed | Requiring SSO was turned on or off. | on |
sso.joining_changed | Joining through SSO changed: the role new people get, or off. | role |
Members
| Action | What happened | Details |
|---|
member.invited | Someone was invited, with a role. | role |
member.invite_revoked | An invitation was revoked. | None |
member.joined | Someone joined, by an invitation or through SSO. | role, via |
member.role_changed | A member’s role changed. | from, to |
member.removed | A member was removed. | role |
member.left | A member left the workspace. | role |
Projects
| Action | What happened | Details |
|---|
project.created | A project was created. | None |
project.deleted | A project was deleted. | None |
project.version_uploaded | A version was added on the project page: uploaded, fetched from a URL, or the sample. | seq, source |
reference.changed | The hosted reference was published or unpublished, or its indexing or download setting changed. | change |
docs.changed | The docs site was published or unpublished, or its indexing changed. | change |
docs.branch_changed | The branch the docs site serves changed. | branch |
docs.build_deleted | A docs build was deleted. | build |
docs.domain_added | A custom domain was added to the docs site. | hostname |
docs.domain_removed | A custom domain was removed from the docs site. | hostname |
playground.changed | Try it, or its proxy, was turned on or off. | change |
playground.host_added | A host was added for the proxy. | host |
playground.host_verified | A proxy host was verified. | host, by |
playground.host_removed | A proxy host was removed. | host |
collection.created | A shared collection was created. | name |
collection.deleted | A shared collection was deleted. | name, requests |
collection.published | A shared collection was published to readers. | name, requests |
collection.unpublished | A shared collection was unpublished. | name |
collection.imported | A collection was imported. | name, requests |
collection.exported | A collection was exported. | name, format, requests |
Keys and credentials
| Action | What happened | Details |
|---|
key.created | A CI key was created. Only its shown prefix is recorded. | prefix, label |
key.revoked | A CI key was revoked. | None |
mcp.changed | A hosted MCP server setting changed, such as turning it on, pinning a version or its host. | change, value |
mcp.credential_set | The MCP server’s API credential was stored. Its kind and name are recorded, never its value. | kind, name |
mcp.credential_cleared | The MCP server’s API credential was removed. | None |
mcp.key_created | An MCP key was created. Only its shown prefix is recorded. | prefix, label, scoped |
mcp.key_revoked | An MCP key was revoked. | None |
mcp.oauth_changed | The MCP server’s sign-in changed, such as its identity provider, its mode or a claim rule. | change, value |
Billing
| Action | What happened | Details |
|---|
billing.plan_changed | The workspace’s plan changed. | from, to, source |
billing.subscription_cancelled | The subscription was cancelled. | by |
Workspace
| Action | What happened | Details |
|---|
workspace.renamed | The workspace was renamed. | from, to |
workspace.deleted | The workspace was deleted. | None |
The audit log
| Action | What happened | Details |
|---|
audit.exported | The audit log was exported. | from, to, format, rows |
Exporting it
Owners and admins export a range of up to 31 days from the audit settings page, as CSV or JSON Lines. The columns are at, actor_type, actor_id, actor_label, action, target_type, target_id, target_label, ip, country, details. JSON Lines carries the same fields and the event's id, with details as JSON. A CSV cell that a spreadsheet would run as a formula starts with a quote.
The response's x-content-sha256 header is the SHA-256 of the file, so you can tell whether a copy was changed after download.
How many rows one export holds depends on your plan: see Plans and limits.
How long it’s kept
Events are kept for your plan’s retention: see Plans and limits. No event is ever changed, and none younger than 30 days can be deleted, whatever runs against the database.
Where this comes from
app/enterprise/_lib/actions.tsapp/enterprise/_lib/export.tsapp/enterprise/_lib/filter.tsapp/enterprise/_lib/audit.tsmigrations/0015_enterprise.sql