Audit Logs
Track administrative actions across your organization with a complete, immutable activity trail.
Audit Logs provide a complete record of who did what, when, and on what resources across your organization. Essential for compliance, security audits, and operational transparency.
Audit Logs are available on every plan. Only organization owners and admins can open them.
Accessing Audit Logs
Navigate to Settings → Access Control → Audit Log.
You’ll see a chronological list of all administrative events with:
- Actor — Who performed the action (name, or email if no name is set)
- Action — What they did (color-coded by type)
- Timestamp — When it happened (with relative time display)
- Details — Click any row to see full context
What Gets Tracked
Audit Logs capture 100+ event types across all administrative areas:
Member Management
- Member invited, invite accepted, invite revoked
- Role changed, member offboarded, member reactivated
- Workspace member added, removed, permissions updated
App Lifecycle
- App created, deleted, duplicated, moved
- App published, rolled back, version restored
- App settings updated
Billing & Subscriptions
- Subscription changed, cancelled
- Top-up settings updated, notification settings updated
- Stripe Connect initiated, disconnected
Integrations & Connections
- OAuth connected, disconnected
- Channel configured (WhatsApp, Slack, Email, Discord, GitHub)
- MCP integration created, updated, deleted
- Phone number purchased, released
- Custom domain and sender domain events
Knowledge & AI
- Knowledge source created, deleted, linked, unlinked
- Agent links created, deleted
- Voice clones created, deleted
Organization Settings
- Workspace created, updated, deleted
- Whitelabel configuration changes
- Consumer monetization (packages created, updated, deleted)
Filtering Events
Use the action dropdown (default All Actions) to filter by a specific event type. Events are color-coded:
| Color | Meaning | Examples |
|---|---|---|
| Green | Creates, invites, connections | Member invited, app created, integration connected |
| Blue | Updates, changes | Role changed, settings updated |
| Red | Deletions, removals | Member offboarded, app deleted, integration disconnected |
Event Details
Each row shows the actor (or “System” for automated events) and, if applicable, the target user (e.g., the invited member). Click any event row to expand full details:
| Field | What It Shows |
|---|---|
| Resource | Type and ID of the affected resource (workspace, app, domain, etc.) |
| Timestamp | Exact date and time, in your local time |
| Details | Action-specific details as JSON (previous values, new values, reasons, etc.) |
The actor’s IP address is not shown in the list, but it is included in each entry returned by the API (ipAddress).
Example: Role Changed
Actor: admin@company.com
Action: member.role_changed
Target: team@company.com
Details:
Previous role: member
New role: adminAPI Access
Query audit logs programmatically:
GET /api/organization/rbac/members/audit-logQuery parameters:
| Parameter | Description | Example |
|---|---|---|
action | Filter by event type | member.invited |
targetUserId | Filter by affected user | UUID |
since | Filter by date | 2026-03-15 |
limit | Results per page (default 50, max 100) | 50 |
offset | Pagination offset | 0 |
Use Cases
| Scenario | What to Look For |
|---|---|
| Security audit | Filter for member.offboarded, member.role_changed, oauth.connected |
| Billing investigation | Filter for subscription.changed, billing.topup_now events |
| Compliance review | Page through the full activity trail from a start date with the API (since, limit, offset) |
| Incident response | Review actions from a specific date onward (API since parameter) |
| Onboarding verification | Track invite acceptance and permission grants |