Browsing the record
Filter the record of who did what, and stream it to a destination you own on Enterprise.
Every reveal is written down with who, what, and when. Audit Log is where you read that record, newest first. Every write and every change to a credential, a member or a plan lands there too.
Filtering
Three filters sit above the list:
- the action
- the actor
- a date range
All three live in the address bar, so a filtered view is a link you can send somebody.
Entries are grouped into six families for the eye: Secret, Machine, Member, Billing, Integration, Other. The list loads more as you scroll rather than numbering pages.
The action filter does not list everything
The action picker holds the actions the console knows how to name. Several actions the workspace writes are missing from it.
| Missing from the picker | What wrote it |
|---|---|
member.invited | Sending an invitation |
member.invite_resent | Sending it again |
member.invite_revoked | Withdrawing it |
member.removed | Removing somebody |
role.created, role.updated, role.deleted | The Roles pages |
role.assigned, role.unassigned | Changing a member's role, or a grant on a project |
Find these by narrowing to the actor and the date, then exporting and searching the file. Picking an action name the list does not carry is not possible, so do not go looking for one.
Taking a copy away
Export downloads the range you are looking at as a CSV, newest first, capped at 5,000 rows. A range that holds more comes back marked truncated, carrying the most recent 5,000, so narrow by date before you export.
It needs audit:export, which is separate from audit:read, so you can let somebody look without letting them walk out with the file.
How long entries are kept
| Plan | Kept for |
|---|---|
| Free | 7 days |
| Pro | 90 days |
| Enterprise | Set by your contract |
Enterprise is skipped by the job that prunes, because a window written into a contract is not something a job can read.
Streaming it somewhere you own
An owner on Enterprise can connect a destination at the bottom of this page. Batches are signed NDJSON delivered at least once, so deduplicate on event_id and watch sequence for a gap. Delivery follows activity rather than a clock, so a batch trails the events behind it by minutes.
The endpoint has to be HTTPS. The signing secret is shown once when you connect and once when you rotate it.
Rotating the signing secret is a hard cutover. One secret is stored, so update your receiver before the next batch lands.
A destination that keeps failing is stopped, and restarting it is something you do rather than something that happens on its own. A stopped stream holds its backlog and goes out from where the sequence stopped.
The hold on pruning belongs to an enabled destination: while one is connected, the prune job refuses to delete past what it has delivered. Once the auto-disable stops it, that workspace prunes on its ordinary schedule again, which is when a long outage starts costing you entries.
Stream the record has the receiver end of this.
What each action needs
| Action | Needs | Confirm it is you | Recorded as |
|---|---|---|---|
| Browse and filter | audit:read | No | not recorded today |
| Load more entries | audit:read | No | not recorded today |
| Export a range | audit:export | No | not recorded today |
| Connect a destination | Owner, on Enterprise | Yes | audit.sink_connected |
| Rotate the signing secret | Owner, on Enterprise | Yes | audit.sink_secret_rotated |
| Restart a stopped stream | Owner, on Enterprise | Yes | audit.sink_resumed |
| Disconnect it | Owner, on Enterprise | Yes | audit.sink_disconnected |
The four stream actions carry no permission slug. Being the workspace owner is the gate, alongside the plan and a recent challenge.
Next: approve a reveal.