# Audit log

The audit log records who did what in a workspace, and when. Each event carries only the detail keys listed for its action, so a secret can’t ride along.

## What it records

### Sign-ins and access

| Action | What happened | Details |
| --- | --- | --- |
| `sso.signed_in` | Someone signed in through the workspace’s SSO. `joined` says whether that made them a member. | `joined` |
| `sso.refused` | An SSO sign-in was refused, with the reason. | `reason` |
| `sso.break_glass` | An owner opened a workspace that requires SSO without an SSO session. Recorded once a day per person. | `method` |
| `sso.required` | A member without an SSO session was turned away from a workspace that requires SSO. Recorded once a day per person. | `method` |

### SSO settings

| Action | What happened | Details |
| --- | --- | --- |
| `sso.connection_saved` | The SSO connection was saved. | `issuer`, `client_id` |
| `sso.connection_tested` | The SSO connection was tested with a sign-in. | `issuer` |
| `sso.connection_deleted` | The SSO connection was deleted. | `issuer` |
| `sso.domain_added` | An email domain was added for SSO. | `domain` |
| `sso.domain_verified` | An email domain’s TXT record was verified. | `domain` |
| `sso.domain_check_failed` | A check of an email domain’s TXT record failed. | `domain` |
| `sso.domain_removed` | An email domain was removed. | `domain` |
| `sso.enforcement_changed` | Requiring SSO was turned on or off. | `on` |
| `sso.joining_changed` | Joining through SSO changed: the role new people get, or off. | `role` |

### Members

| Action | What happened | Details |
| --- | --- | --- |
| `member.invited` | Someone was invited, with a role. | `role` |
| `member.invite_revoked` | An invitation was revoked. | None |
| `member.joined` | Someone joined, by an invitation or through SSO. | `role`, `via` |
| `member.role_changed` | A member’s role changed. | `from`, `to` |
| `member.removed` | A member was removed. | `role` |
| `member.left` | A member left the workspace. | `role` |

### Projects

| Action | What happened | Details |
| --- | --- | --- |
| `project.created` | A project was created. | None |
| `project.deleted` | A project was deleted. | None |
| `project.version_uploaded` | A version was added on the project page: uploaded, fetched from a URL, or the sample. | `seq`, `source` |
| `reference.changed` | The hosted reference was published or unpublished, or its indexing or download setting changed. | `change` |
| `docs.changed` | The docs site was published or unpublished, or its indexing changed. | `change` |
| `docs.branch_changed` | The branch the docs site serves changed. | `branch` |
| `docs.build_deleted` | A docs build was deleted. | `build` |
| `docs.domain_added` | A custom domain was added to the docs site. | `hostname` |
| `docs.domain_removed` | A custom domain was removed from the docs site. | `hostname` |
| `playground.changed` | Try it, or its proxy, was turned on or off. | `change` |
| `playground.host_added` | A host was added for the proxy. | `host` |
| `playground.host_verified` | A proxy host was verified. | `host`, `by` |
| `playground.host_removed` | A proxy host was removed. | `host` |
| `collection.created` | A shared collection was created. | `name` |
| `collection.deleted` | A shared collection was deleted. | `name`, `requests` |
| `collection.published` | A shared collection was published to readers. | `name`, `requests` |
| `collection.unpublished` | A shared collection was unpublished. | `name` |
| `collection.imported` | A collection was imported. | `name`, `requests` |
| `collection.exported` | A collection was exported. | `name`, `format`, `requests` |

### Keys and credentials

| Action | What happened | Details |
| --- | --- | --- |
| `key.created` | A CI key was created. Only its shown prefix is recorded. | `prefix`, `label` |
| `key.revoked` | A CI key was revoked. | None |
| `mcp.changed` | A hosted MCP server setting changed, such as turning it on, pinning a version or its host. | `change`, `value` |
| `mcp.credential_set` | The MCP server’s API credential was stored. Its kind and name are recorded, never its value. | `kind`, `name` |
| `mcp.credential_cleared` | The MCP server’s API credential was removed. | None |
| `mcp.key_created` | An MCP key was created. Only its shown prefix is recorded. | `prefix`, `label`, `scoped` |
| `mcp.key_revoked` | An MCP key was revoked. | None |
| `mcp.oauth_changed` | The MCP server’s sign-in changed, such as its identity provider, its mode or a claim rule. | `change`, `value` |

### Billing

| Action | What happened | Details |
| --- | --- | --- |
| `billing.plan_changed` | The workspace’s plan changed. | `from`, `to`, `source` |
| `billing.subscription_cancelled` | The subscription was cancelled. | `by` |

### Workspace

| Action | What happened | Details |
| --- | --- | --- |
| `workspace.renamed` | The workspace was renamed. | `from`, `to` |
| `workspace.deleted` | The workspace was deleted. | None |

### The audit log

| Action | What happened | Details |
| --- | --- | --- |
| `audit.exported` | The audit log was exported. | `from`, `to`, `format`, `rows` |

## Exporting it

Owners and admins export a range of up to 31 days from the audit settings page, as CSV or JSON Lines. The columns are `at`, `actor_type`, `actor_id`, `actor_label`, `action`, `target_type`, `target_id`, `target_label`, `ip`, `country`, `details`. JSON Lines carries the same fields and the event's `id`, with `details` as JSON. A CSV cell that a spreadsheet would run as a formula starts with a quote.

The response's `x-content-sha256` header is the SHA-256 of the file, so you can tell whether a copy was changed after download.

How many rows one export holds depends on your plan: see [Plans and limits](../get-started/plans-and-limits#enterprise).

## How long it’s kept

Events are kept for your plan’s retention: see [Plans and limits](../get-started/plans-and-limits#enterprise). No event is ever changed, and none younger than 30 days can be deleted, whatever runs against the database.

## Where this comes from

- `app/enterprise/_lib/actions.ts`
- `app/enterprise/_lib/export.ts`
- `app/enterprise/_lib/filter.ts`
- `app/enterprise/_lib/audit.ts`
- `migrations/0015_enterprise.sql`