Skip to main content

​
Audit Logs

Audit logs require Enterprise.
Audit logs record every sensitive action taken in your workspace: who did what, when, and from where. Use them for security reviews, compliance reporting, and incident investigations.

​
What Audit Logs Track

Each log entry includes:
  • Who: the user who performed the action
  • What: the specific action taken
  • When: timestamp of the action
  • Details: additional context (e.g., which role was changed, which secret was rotated)

​
Review Audit Logs

1

Open the Audit Logs page

Go to Settings > Audit Logs in your workspace.
2

Filter by action type, user, or time range

Use the filters at the top of the page to narrow results:
  • Action type: select one or more categories (access changes, role changes, exports, etc.)
  • User: filter to a specific team member
  • Time range: set a start and end date
3

Investigate unexpected changes

Click on any log entry to expand its details. Review the full context of the action: who initiated it, what was changed, and the before/after state.

​
What to Watch Closely

These categories require immediate attention when unexpected entries appear:

Access & role changes

Unauthorized role escalations or unknown members being added. Verify that every change was intentional and approved.

Secret modifications

API keys created or rotated outside of normal schedules. Confirm the change was made by the right person for the right reason.

Export actions

Unexpected ZIP downloads or GitHub pushes, especially to unfamiliar repositories. Verify the export was authorized.

Organization settings

Changes to SSO, billing, or workspace-level configuration. These affect every member of the workspace.
Audit log data is retained according to your Enterprise plan’s retention policy. Export logs periodically if you need long-term archival beyond your retention window.

​
Troubleshooting