Browsing the record
Filter, page, open and export the audit record in the console, and stream it to a destination on Enterprise or with the streaming add-on.
Path: Audit Log (/audit). We list entries newest first. What lands an entry and what one entry holds: the audit log.
Filters
Filter by action, actor and date range. Type dates as YYYY-MM-DD, in UTC. Filters live in the address bar, so a filtered view is a shareable link. We color entries by family: Secret, Machine, Member, Billing, Integration, Other.
A page holds 25, 50 or 100 entries and steps older or newer by timestamp, not row count.
We record every read of the record; if we cannot, you get a load error, not unrecorded entries.
Entry details
Select a row to open the entry.
| Part | What you see |
|---|---|
| Opens | Who acted, from which IP and client, what it touched, and its metadata |
| Actor | A member, a machine identity, Directory sync or SSO connection when your directory or identity provider made the change, or System when we acted on our own (a scheduled job, a callback or a payment webhook) |
| Link | The address bar gains ?entry=<id>. Opening that link reads the one entry, and we record it as audit.read with the entry's id |
| Past retention | A link to an entry past your retention window opens nothing and says so |
The action picker lists every action we record in your workspace's log.
| Where | What |
|---|---|
| Recorded here | A sign-in to this workspace (account.signed_in), and a break-glass entry past its SSO requirement (org.break_glass_login) |
| Kept elsewhere | Sign-in attempts, refused sign-ins, sign-outs and changes to your own sign-in methods: we keep them in a separate authentication record, not in this log |
Connected apps record these, in the Integration family. The actor is the person who connected the app. Entries name keys, never values.
| Label | Action | When |
|---|---|---|
| Connect App | app.connected | The person chose Allow and the app collected its grant |
| Change App Keys | app.keys_changed | The person saved new keys with Change keys |
| Issue App Credential | app.exchanged | The app traded its grant for a short-lived credential |
| App Read Secrets | app.read | The app read the environment. Names the keys whose values it received, or the names it listed |
| Revoke App Credential | app.credential_revoked | The app revoked one of its own pck_ credentials. The connection stays |
| Disconnect App | app.revoked | The connection ended. reason: user (the person), app (the app), grant_reuse (a replaced grant came back), expired (unused for 90 days) or ineligible (the environment, the person's access or the workspace's sign-in policy no longer allows it) |
Export
Export CSV, top right of Audit Log, downloads your current range as CSV, newest first, capped at 5,000 rows. For a larger range we mark the file truncated and keep the newest 5,000. Export needs audit:export, separate from audit:read.
Retention
| Plan | We keep entries for |
|---|---|
| Free | 14 days |
| Pro | 180 days |
| Enterprise | Set by contract; we never prune it automatically |
We do not prune Enterprise, since the prune job cannot read a contract window.
Stream to a destination
Streaming, top right of Audit Log. On Enterprise, or with the audit log streaming add-on on Free and Pro. Owner only. The Streaming fact beside Kept for shows the stream's state and its last delivery.
| Property | Value |
|---|---|
| Destination | A webhook (HTTPS only), Datadog, Splunk HEC or Amazon S3 |
| Format | Webhook: signed NDJSON batches. Datadog and Splunk: their own intake formats. S3: one NDJSON object per batch |
| Delivery | At least once: deduplicate on event_id, watch sequence for gaps |
| Timing | Follows activity, not a clock; a batch trails its events by minutes |
| Credential | Webhook: a signing secret, shown once on connect and on rotate. Datadog and Splunk: your key, replaced on this page. S3: your IAM role, assumed under your External ID |
Rotating the signing secret is a hard cutover. We store one secret, so update your receiver before the next batch lands.
If your destination keeps failing, we stop the stream until an owner restarts it, then resume the held backlog from where sequence stopped.
While a destination is enabled, we never prune past what we delivered. Once auto-disable stops the stream, pruning resumes, so a long outage loses entries from then.
Receiver setup: stream the audit log.
Required permissions
Slugs: roles and permissions. Step-up: security and MFA.
| Action | Needs | Step-up | Recorded as |
|---|---|---|---|
| Browse, filter, turn a page, open an entry link | audit:read | No | audit.read |
| Export a range | audit:export | No | audit.exported |
| Connect a destination | Owner, streaming on your plan | Yes | audit.sink_connected |
| Rotate the signing secret | Owner, streaming on your plan | Yes | audit.sink_secret_rotated |
| Restart a stopped stream | Owner, streaming on your plan | Yes | audit.sink_resumed |
| Disconnect | Owner, streaming on your plan | Two-factor and fresh | audit.sink_disconnected |
Stream actions carry no slug: owner, plan and step-up are the gate.
Next: approve a reveal.