Skip to main content
The audit log records every significant action in your organization: project creation, API key generation, member role changes, guardrail updates, and billing changes. Each entry is timestamped and linked to the user or API key that performed the action.

​
Accessing the audit log

Go to Platform → Audit in the sidebar. You need the owner or admin role to view the audit log.

​
What gets logged

​
Audit entry fields

Each entry contains:

​
Actor types

Every entry is attributed to exactly one of three actor types: If the underlying user or project has since been deleted, the entry still shows the id it was recorded against rather than going blank, so history is never silently erased.
Filter the audit log by a specific actor’s id with the actorId query parameter on GET /v1/orgs/:orgId/audit (and the project-scoped equivalent). It targets the true actor — a user, apiKey (project id), or system row — which is more precise than the legacy userId filter for anything that isn’t a person.

​
Filtering

Filter audit entries by actor, event type, resource, and date range. Use the event type filter to focus on a specific category — for example, filter by api_key.* to see all key management activity.

​
Exporting

Click Export to download a CSV of the current filtered view. Exports include all fields and are suitable for compliance reviews. The CSV’s columns, in order:
actor_type is appended as the last column rather than placed next to actor, so a script parsing the CSV by column position keeps working unchanged. POST /v1/orgs/:orgId/audit/export (and the project-scoped equivalent) also accepts the same actorId filter described above, in addition to the existing userId filter.
Audit log retention matches your plan’s data retention period. On Scale, audit logs are retained for 1 year. On Team, 90 days. Upgrade your plan if you need longer retention for compliance.

​
Automated export

For continuous compliance logging, set up a webhook that fires on audit events. See Webhooks for configuration.

​
Evidence packs build on this log

Membership and role-change entries from this log are what back the CC6.1 access-control section of a generated SOC 2 control evidence document, and guardrail/prompt/agent-lifecycle entries back its change-management (CC8.1) section. See Evidence Packs to generate an audit-ready document instead of exporting this log by hand.

​
Next steps

  • Security — data handling, encryption, and access controls
  • Organizations — team member roles and permissions
  • Evidence Packs — generate audit-ready documents from this log and other recorded platform data