The audit log is an append-only record of authentication and administrative activity in your workspace — logins, role changes, invitations, SSO changes, and more. Use it to investigate incidents, review access changes, and meet compliance requirements.
Find the audit log in Admin Settings → System → Audit log. It requires administrator privileges.
Audit log table with events, actors, and targets

​
Reading the log

Each entry has:
ColumnDescription
WhenTimestamp of the event
EventThe event type, shown as a color-coded badge
ActorThe user (email) who performed the action
TargetThe affected resource — a user, SSO provider, workspace, team, or identity
Click the chevron on a row to expand its full details envelope.

​
Finding events

  • Search across the log.
  • Filter by event type.
  • Sort by Newest or Oldest.
The list loads more entries as you scroll.

​
Events that are recorded

The audit log captures authentication and admin events, including:
  • Authentication — auth.login.success, auth.login.failure, auth.logout
  • SSO — sso.provider.created, sso.provider.updated, sso.provider.deleted
  • Users & roles — user.role.changed, user.invitation.accepted, user.deactivated, user.detached_from_provider

​
Stream events to your SIEM

To forward these events to your security tooling in near real time, configure destinations in the SIEM export destinations panel on this page.

SIEM export

Stream audit events to a webhook, Splunk, or Datadog.

Activity log

Your personal and agent activity history.