Audit logs
The audit log is your organization’s record of administrative actions: who did something, what they did, which resource it touched, when, and from where. It answers questions such as “who revoked the key our worker was using?”, “when did this person become an administrator?” or “who removed the saved card?”.
Entries are written by the platform as the actions happen. Nobody, including owners, can edit or delete them from the Console.
Who can read it
| Role | Access |
|---|---|
| Primary owner, Owner, Administrator | Yes |
| Custom role whose group grants Analytics at view level or higher | Yes |
| Developer | No |
The page is at Settings → Audit Logs, in the Security group. Members without access do not see it in the menu.
What an entry contains
| Field | Meaning |
|---|---|
| Timestamp | When the action happened |
| Action | A dotted name for what happened, such as api_key.revoked |
| User | The member who did it |
| Resource type and ID | What was affected, such as an API key and its ID |
| IP address | Where the request came from, when known |
| Details | Extra context for some actions; for example, a new key’s name, kind and prefix |
Audit entries never contain API key secrets. A created key is identified by its name and its first few characters only.
Actions you will see
These are the actions most relevant to API work. Your log may include others from features your organization uses.
| Area | Action | Recorded when |
|---|---|---|
| API keys | api_key.created | A key is created. Details include its name, kind and prefix. |
| API keys | api_key.revoked | A key is revoked |
| Members | member.joined | Someone accepts an invitation |
| Members | member.change_role | A member’s role changes |
| Sessions | session.killed | A signed-in session is ended from the Console |
| Billing | billing.payment_method_attached | A card is saved |
| Billing | billing.payment_method_detached | A saved card is removed |
| Security | ip.banned, ip.unbanned | An IP address is blocked or unblocked |
| Single sign-on | sso.provider_created, sso.provider_updated, sso.provider_deleted | An identity provider is configured |
| Directory sync | scim.user.created, scim.user.updated, scim.user.deactivated, scim.user.deleted | Your identity provider changes a user |
| Directory sync | scim.group.created, scim.group.updated, scim.group.deleted | Your identity provider changes a group |
| Settings | settings.policies_updated | Organization policies change |
| Integrations | integration.connected, integration.disconnected | A third-party integration is connected or removed |
Find an entry
Open the log
Go to Settings → Audit Logs with the right organization selected. The newest entries come first.
Filter
Type an action name, for example api_key.revoked, and pick a From and To date. Select Filter to apply. The action filter matches the full action name exactly, so api_key on its own does not find api_key.revoked.
Page through results
Results load 50 at a time.
Underneath, the log can also be narrowed by the member who acted and by resource type, and a page can hold up to 100 entries.
Common investigations
| Question | Filter on |
|---|---|
| Who revoked a key? | Action api_key.revoked, around the time requests started failing with 401 revoked_api_key |
| Which keys did a departing teammate create? | Action api_key.created, then match the user |
| When did someone get admin rights? | Action member.change_role |
| Who removed the payment method before auto-reload stopped? | Action billing.payment_method_detached |
Export
Select Export CSV to download every entry that matches the current filters, not only the page on screen. The file has these columns:
Timestamp,User ID,Action,Resource Type,Resource ID,IP AddressOne export holds at most 10,000 rows. If more match, the Console tells you how many were left out; narrow the date range and export again in pieces.
Values in the export that a spreadsheet could read as a formula are quoted, so opening the file in a spreadsheet is safe.
Retention
Export entries you need to keep for compliance on a regular schedule rather than relying on them staying in the Console indefinitely.
Programmatic access
The audit log is read from the Console only. There is no API-key endpoint for it, so a scheduled export is currently a manual task.