Skip to main content
The security audit log records security-sensitive activity across your organization: membership and role changes, credential lifecycle events, and denied access attempts. Use it for compliance reviews, incident investigations, and verifying that administrative changes happened when and how you expect.
The security audit log is available on the Enterprise plan. See subscription for plan details.

​
What is recorded

Each audit entry captures:
  • The event type
  • Who performed the action (the actor) and, where relevant, who it affected (the target)
  • When it happened
  • The source IP address
  • Event details, such as the name of the role or the key prefix involved
Entries are append-only: they cannot be edited or deleted, so the log is a reliable record of what actually happened.
Audit entries never contain secret material. API keys, webhook signing keys, and connector credentials are referenced by name or key prefix only.

​
Event reference

​
Access

​
Members and invitations

​
Roles

​
Credentials and integrations

​
Account security

​
Who can view the log

Viewing the audit log requires the Account.AuditLog.Read permission. Admins have it by default. To give other teammates read access, grant the permission to a custom role.

​
Filtering

You can narrow the log by:
  • Event types: one or more event types from the reference above
  • Actor: the user who performed the action
  • Target: the user the action affected
  • Date range: a from/to window
When investigating an incident, start with a date range around the time in question, then narrow by event type or actor once you see the surrounding activity.

​
Retention

Audit events are retained for 365 days and then removed automatically.