Audit log
A tamper-evident record of every security-relevant action on your project.
Each project has an append-only log of who did what, when, and from where. Every entry is chained to the previous one with a SHA-256 hash, so a missing or altered entry can be detected.
Admins read it in the dashboard under Audit Logs. To pull it into Splunk, Datadog or any other SIEM, see the SIEM integration guide.
Availability
The audit log is available on:
- Self-hosted deployments running the Enterprise edition. On with no further configuration. The Community edition image does not include the audit log, and its endpoints answer
404. - SaaS projects on an enterprise plan.
Other projects don't record audit events, and the audit endpoints answer 403.
Only admins of a project can read its audit log or manage its export tokens. Members don't see the Audit Logs page at all.
What gets recorded
One entry per business action, no matter how many rows it touched.
| Family | Examples |
|---|---|
| Auth | user.login, user.login_failed, user.sso_login, user.password_changed, user.2fa_enabled |
| Membership | instance.member_added, instance.member_removed |
| Project | instance.renamed, instance.retention_changed, instance.deletion_requested, instance.deleted |
| Credentials | audit_export_token.created, audit_export_token.revoked, mcp_token.revoked, api_key.used, api_key.auth_failed |
| Configuration | ios_configuration.updated, android_configuration.updated, web_configuration.updated, redirect.updated, domain.updated |
| Custom domains | custom_domain.created, custom_domain.verified, custom_domain.deleted |
| Data | link.created, link.updated, link.deleted, export.link_data, export.usage_data |
| Billing | enterprise_subscription.created, subscription.changed |
| System | retention.deletion_ran, quota.disabled, quota.restored |
Each entry carries the actor (user, api_key, admin_key, scim_token, or system), the credential channel it came through (password, sso:google_oauth2, sso:microsoft_graph, sso:oidc for enterprise SSO, scim, mcp_token, api_key…), the target, a before/after diff where one applies, plus IP, user agent, and request ID.
The audit log is project-wide, not per-environment. Production and Test share one chain, because most of what it records (membership, billing, retention) isn't environment-specific.
What you can rely on
- Completeness. The entry is written in the same database transaction as the action itself. An audited action cannot succeed without its record.
- Append-only. Entries are never updated or deleted, not even when the project is deleted.
- Ordering.
sequenceis a gap-free per-project counter, and the only cursor you need. - Integrity. Every entry stores the previous entry's hash, forming a chain you can verify independently.
Secrets are filtered
Credentials never reach the log. Values such as API keys, push certificates, and client secrets are replaced with [FILTERED] in the changes diff, so an entry records that a secret changed without recording the secret.
Reading it in the dashboard
Open Audit Logs from the sidebar. Filter by action, actor email and date range. Click a row to open the full entry, including the before/after diff and its position in the hash chain.