> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ingestly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security audit log

> Review a permanent record of security-sensitive activity in your Ingestly organization.

The security audit log records security-sensitive activity across your organization: membership and role changes, credential lifecycle events, and denied access attempts. Use it for compliance reviews, incident investigations, and verifying that administrative changes happened when and how you expect.

<Note>The security audit log is available on the **Enterprise** plan. See [subscription](/admin/subscription) for plan details.</Note>

## What is recorded

Each audit entry captures:

* The event type
* Who performed the action (the actor) and, where relevant, who it affected (the target)
* When it happened
* The source IP address
* Event details, such as the name of the role or the key prefix involved

Entries are append-only: they cannot be edited or deleted, so the log is a reliable record of what actually happened.

<Note>Audit entries never contain secret material. API keys, webhook signing keys, and connector credentials are referenced by name or key prefix only.</Note>

## Event reference

### Access

| Event             | Recorded when                                         |
| ----------------- | ----------------------------------------------------- |
| Permission denied | A user was denied access to a permission-gated action |

### Members and invitations

| Event                 | Recorded when                                            |
| --------------------- | -------------------------------------------------------- |
| Invitation sent       | An invitation to join the organization was sent          |
| Invitation revoked    | A pending invitation was revoked                         |
| Member roles changed  | A member's roles were changed                            |
| Member removed        | A member was removed from the organization               |
| User disabled         | A user account was disabled                              |
| User enabled          | A user account was re-enabled                            |
| Ownership transferred | Organization ownership was transferred to another member |

### Roles

| Event                    | Recorded when                       |
| ------------------------ | ----------------------------------- |
| Role created             | A custom role was created           |
| Role updated             | A custom role was updated           |
| Role deleted             | A custom role was deleted           |
| Role permissions changed | A role's permission set was changed |

### Credentials and integrations

| Event                         | Recorded when                          |
| ----------------------------- | -------------------------------------- |
| API key created               | An API key was created                 |
| API key scopes changed        | An API key's scopes were changed       |
| API key deleted               | An API key was deleted                 |
| Webhook signing key generated | A webhook signing key was generated    |
| Webhook signing key rotated   | A webhook signing key was rotated      |
| Webhook signing key deleted   | A webhook signing key was deleted      |
| Connector credentials rotated | A connector's credentials were rotated |
| Connector deleted             | A connector was deleted                |

### Account security

| Event                | Recorded when                                      |
| -------------------- | -------------------------------------------------- |
| MFA enrolled         | A user enrolled in multi-factor authentication     |
| MFA unenrolled       | A user unenrolled from multi-factor authentication |
| Organization deleted | The organization was deleted                       |

## Who can view the log

Viewing the audit log requires the `Account.AuditLog.Read` permission. Admins have it by default. To give other teammates read access, grant the permission to a [custom role](/admin/roles-and-permissions#creating-a-custom-role).

## Filtering

You can narrow the log by:

* **Event types**: one or more event types from the reference above
* **Actor**: the user who performed the action
* **Target**: the user the action affected
* **Date range**: a from/to window

<Tip>When investigating an incident, start with a date range around the time in question, then narrow by event type or actor once you see the surrounding activity.</Tip>

## Retention

Audit events are retained for 365 days and then removed automatically.