Audit log
What audit logs are for, where to find them, and how to read entries in the Security pages.
Audit logs help you answer “who did what, and when?” for your workspace and your own account. They are not a full web server access log — they record defined security and product actions plus successful public API calls.
Two logs
| Team audit log | Personal audit log | |
|---|---|---|
| Scope | Activity on the current team | Your user account only |
| Location | Team → Security | Account → Security (profile menu) |
| Viewers | Owner and Admin only | You, when signed in |
| Examples | Invites, API keys, notifications, billing | Sign-in, MFA, password, email |
Members cannot open the team audit log. See Team roles and permissions.
For a short description of every action label you might see, use the audit log events knowledge base article.
Open the team audit log
- Select the team in the sidebar switcher.
- Go to Team → Security.
- Review the summary cards, then scroll to Audit Log History.
Use the table filter to search by action name. Pagination shows five rows per page by default.
Summary cards count total rows, team-creation-related rows, member-invite-related rows, and distinct IP addresses. Treat them as quick context, not a full analytics dashboard.
Open your personal audit log
- Open your profile menu and choose Security (or go to
/user/security). - Manage MFA at the top; your sign-in and account events appear in the table below.
Read a row
| Column | What it tells you |
|---|---|
| Action | The event type. The UI shows spaces instead of underscores (for example TEAM MEMBER INVITED). |
| IP Address | Client IP when the event was recorded. |
| User Agent | Browser or client summary. Click the cell for full browser, OS, and device details. |
| Metadata | Extra fields such as actioned_by, resource IDs, or API route details. |
| Created At | Timestamp in your local timezone. |
Actions that include FAILED in the name often appear with error-style badge coloring.
Metadata basics
Most team events include actioned_by (email of the signed-in user) and user_id. Notification and API key events include resource IDs such as channel_id or api_key_id. API REQUEST rows include method, path, status, and sometimes api_key_id.
Only successful /api/v1 responses create API REQUEST rows. Failed API calls are not listed here.
Retention
Team audit history length depends on your subscription (audit_retention_days). When retention is reached, older team rows are removed automatically.
There is no in-app export today. Contact support if you need bulk export for compliance.
Limits
- Refreshes are manual — the table does not live-update.
- Not every button click is logged — only the event types in the events reference.
Related articles
- Audit log events — what each action name means
- Team roles and permissions
- API key scopes
- Creating API keys