Audit Logs
The audit log records security-relevant and configuration-relevant actions across your organization: sign-ins, membership changes, server and API key changes, and other administrative operations.
What is recorded
Section titled “What is recorded”Entries carry a source domain, a category, an operation, and a severity:
| Dimension | Values |
|---|---|
| Source domain | Authentication, tenants, servers, nodes, users, administration, system. |
| Category | Authentication, organization, membership, infrastructure, user, security, configuration. |
| Operation | Create, update, delete, invite, accept, reject, cancel, login, logout, verify, change, revoke, suspend, reactivate. |
| Severity | Info, warning, critical. Most events are info. |
Each entry identifies the actor, the resource that changed, and when it happened.
Who can view it
Section titled “Who can view it”The audit log requires the audit read permission. Owners and admins have it; members do not.
Viewing and filtering
Section titled “Viewing and filtering”Open Audit Logs from the organization sidebar. Entries are ordered by event time, newest first, and can be filtered by:
- Event type, source domain, or category.
- Actor.
- Resource type, ID, or name.
- Date range.
Pages are limited to 100 entries, with 20 shown by default.
Redaction
Section titled “Redaction”Sensitive values, such as full API keys, are redacted in the audit view. The entry still shows that the change happened, who made it, and when.
Retention
Section titled “Retention”Audit retention follows platform policy. Export the entries you need for compliance outside the dashboard if your policy requires longer retention.