See who changed what in the organization
Read the audit log — which changes of settings it records, who may open it and how to find an entry.
3 min read
The audit log is the history of changes in an organization: what was changed, by whom and when. This page is about the audit log page of the console.
Where the log is
Open Settings, then Audit log. The log is one for the whole organization. It does not follow the project chosen in the header.
The log opens for a person who has the management:read permission and reaches every project of the organization. A member with the role Owner or Admin always does. A member with the role Developer or Finance does when their project access is All projects. An API key cannot read the log: the API answers 403 with the code project_access_restricted.
What is recorded
An entry is written for every change of settings that succeeded, whether it was made in the console or through the API.
| Where | What is recorded |
|---|---|
| Organization and projects | The organization is updated, a project is created or updated |
| Members and invitations | The role or the access of a member is changed, a member is removed, an invitation is sent, resent or revoked |
| API keys | A key is created, rotated or revoked |
| Policies, webhooks and alert rules | One is created, updated or deleted |
| Connections | A connection is created, updated, deleted, enabled, disabled or checked, its limits are set, it is paused or its pause is lifted |
| Provider pools | A pool is created, updated or deleted, a connection is added to a pool, updated in it or removed from it |
| AI flows | A flow is created, updated, validated, published or rolled back, its draft is saved, it is bound to an operation or unbound from it |
| Approvals | A request is approved or rejected |
| Budgets | A budget is created, changed or archived |
| Customers | A customer is added, blocked, unblocked or deleted, the settings of an account are saved, credits are topped up, charged or adjusted, a credit price is set |
An entry holds the method and the path of the request, never its body. A secret does not get into the log.
What is not recorded
A request that only reads.
A change that was refused or that failed.
What your application sends to run flows: the requests to a flow and the model calls they make. They are on Operations.
The acknowledgement of an alert.
What a person does with their own account: signing in and out, changing the password or the e-mail, ending sessions, switching the organization or the project, creating or leaving an organization, accepting or declining an invitation.
Read an entry
The newest entries are at the top.
| Column | What it shows |
|---|---|
| Action | What was done, in words, with the code of the action under it |
| Resource | The kind of thing that was changed and its id, shortened |
| Who | The name of the member, or the API key that made the change |
| IP address | The address the request came from |
| When | The time of the change |
Press a row to open the entry in full. It adds the whole id of the resource, whether a person or an API key acted, the method and the path of the request, and the id of the entry itself. An id is copied by pressing it.
Find an entry
All actions and All resources narrow the log to one action or to one kind of resource.
The period is All time, Today, Last 7 days, Last 30 days or Custom range… with two dates. A day starts and ends by the clock of your browser.
The search field looks only through the rows that are already loaded. Press Show more to load older entries, and the search covers them too.
Refresh reads the log again.
Where to go next
Members and invitations — the roles, and what project access is.
Manage API keys — the keys whose changes the log records.
Error codes — every code of the API, what it means and what to do about it.