Back to Home

Audit logs

Audit logs record the important things that happen inside your Organization — who changed what, and when. They are available on the Business plan and above.

Audit entries are scoped to the Organization. Only Organization owners can view the audit log; other roles (including admin) do not see it. Personal, account-level events (such as a user's own login that is not tied to an Organization) are not exposed in another party's Organization audit view.

What is recorded

Audit logs cover the categories below. The exact set of event types grows over time as features are added.

CategoryExamples
Authentication & accessSign-in, sign-out, failed sign-in, permission denied, account locked.
MembersInvitations sent / accepted / revoked, members added or removed, role changes, member lock / unlock.
OrganizationCreation, settings changes, ownership transfer, deletion request / confirm / cancel.
Teams & schedulesTeam create / update / delete, schedule changes, maintenance windows, on-call handovers.
Resource configurationWebhook, routing rule, transformation rule, and bundle-settings changes and rollbacks.
Integrations (MCP)MCP connection create / update / delete and tool calls.

Severity

Each entry carries a severity so you can scan for the important ones:

SeverityMeaning
INFORoutine reads and normal activity.
NOTICECreates and updates.
WARNINGSecurity-relevant events, such as failed sign-ins or credential changes.
CRITICALHigh-impact actions, such as deletions.

Reviewing audit logs

As an Organization owner, open the Audit view for your Organization in the console. From there you can:

  • Filter by event type.
  • Filter by date range.
  • Narrow down by the actor (the user who performed the action).

Each entry includes context such as the actor, the time, and request metadata (for example, the source IP and a request identifier) to help you trace an action.

Related