Skip to main content

Overview

The Audit Log provides a record of security and administrative actions taken across your organization. It tracks who did what, when, and to which resource. Organization administrators can access the audit log from the Settings page under the Audit Log tab.

Viewing the Audit Log

From the left sidebar, click on Settings, then select the Audit Log tab. Each entry in the log includes:
  • Time: When the action occurred
  • Actor: The user or system that performed the action
  • Action: What was done (e.g., “Created role”, “Provisioned user”)
  • Category: The area the action belongs to (e.g., Auth, RBAC, SCIM)
  • Resource: The resource that was affected, along with its type and ID
Click any row to open a detail panel with the full event information, including the actor’s ID, auth method, IP address, and any additional metadata. The audit log supports several ways to narrow down events:
  • Search: Free-text search across actor email, action, category, resource type, resource ID, and event details
  • Category filter: Filter by category (e.g., Authentication, SCIM Provisioning, Roles & Permissions)
  • Action filter: Filter by specific action. When a category is selected, only actions relevant to that category are shown
  • Date range: Filter by time window (Today, Last 7 Days, Last 30 Days, Last 90 Days)
Filters can be combined. For example, you can search for a specific user’s email while filtering to the SCIM category and the last 7 days.

Categories and Actions

Authentication

Actions related to user login, logout, and identity provider configuration.
ActionDescription
Logged inUser successfully authenticated
Logged outUser ended their session
Login failedAuthentication attempt was rejected
Generated magic linkA magic link login email was sent
Created OIDC providerA new OIDC identity provider was configured
Updated OIDC providerAn existing OIDC provider’s settings were changed
Deleted OIDC providerAn OIDC provider was removed
Added OIDC provider to orgAn OIDC provider was linked to the organization
Removed OIDC provider from orgAn OIDC provider was unlinked from the organization

Member Management

Actions related to adding or removing organization members.
ActionDescription
Invited memberAn invitation was sent to a new user
Member joinedA user accepted an invitation and joined the organization
Removed memberA member was removed from the organization

Roles & Permissions

Actions related to roles, role assignments, permissions, service accounts, and API keys.
ActionDescription
Created roleA new role was created
Updated roleA role’s configuration was changed
Deleted roleA role was removed
Assigned roleA role was assigned to a member
Unassigned roleA role was removed from a member
Granted permissionA permission was added to a role
Revoked permissionA permission was removed from a role
Created service accountA new service account was created
Deleted service accountA service account was removed
Created API keyAn API key was generated
Revoked API keyAn API key was revoked
Rotated API keyAn API key was rotated

Connectors

Actions related to data source connectors.
ActionDescription
Created connectorA new connector was added
Updated connectorA connector’s configuration was changed
Deleted connectorA connector was removed

Organization Settings

Actions related to organization-level configuration.
ActionDescription
Updated org settingsOrganization settings were modified
Deleted organizationThe organization was deleted
Switched organizationA user switched to a different organization
Created sibling organizationA new sibling organization was created

API Access Keys

Actions related to API access keys used for programmatic access.
ActionDescription
Created API access keyA new API access key was generated
Updated API access keyAn API access key was modified
Deleted API access keyAn API access key was removed

Secrets

Actions related to organization secrets.
ActionDescription
Created secretA new secret was added
Updated secretA secret was modified
Deleted secretA secret was removed

SCIM Provisioning

Actions related to SCIM-based user and group provisioning. Token and OAuth client management actions are performed by organization administrators through the UI. User and group provisioning actions are performed automatically by your identity provider via the SCIM API.
ActionDescription
Created SCIM tokenA new SCIM bearer token was generated
Revoked SCIM tokenA SCIM bearer token was revoked
Created SCIM OAuth clientA new SCIM OAuth client was created
Revoked SCIM OAuth clientA SCIM OAuth client was revoked
Provisioned userA user was provisioned (or reactivated) via SCIM
Updated userA user’s attributes were updated via SCIM
Deprovisioned userA user was deactivated via SCIM
Created groupA group was created via SCIM
Updated groupA group’s membership or name was updated via SCIM
Deleted groupA group was removed via SCIM

Data Retention

Audit log entries are retained and available for querying as long as your organization is active. The log is automatically refreshed every 30 seconds while the tab is open, and pauses when the browser tab is not visible.