Audit log
Review workspace changes and export the recorded activity.
Audit Log records account and configuration actions. Use Activity for email outcomes and the webhook delivery log for HTTP calls.
Open the log
Open Settings → Audit Log in the workspace you want to review. Entries are listed newest first.
| Column | What it shows |
|---|---|
| Time | When the recorded action occurred, displayed in your browser's local time. |
| User | The recorded name of the person who performed the action. |
| Action | The operation, such as create, rotate or change_role. |
| Resource type | The kind of item affected. |
| Resource | The recorded name or identifier label for that item. |
Names are captured with the entry. A later rename doesn't mean an older entry will display the new name.
Understand recorded actions
| Area | Examples |
|---|---|
| Domains | Creating, updating, verifying or deleting a domain. |
| Credentials | Creating, rotating or revoking a credential. |
| Team and invitations | Inviting a user, revoking an invitation, changing a role or removing a member. |
| Roles | Creating, updating or deleting a custom role. |
| Workspace settings | Updating workspace settings. |
| Webhooks | Configuration changes and actions such as enable, disable or replay. |
| Authentication | Recorded login, logout, workspace-selection or account-update actions. |
The log is a record of supported actions, not a recording of every screen visit or a complete before-and-after snapshot. An entry doesn't establish an email delivery result. A missing entry alone is not proof that no action occurred.
Filter entries
- Use All actions to choose an action.
- Use All resource types to choose the affected resource type.
- Review the matching entries; each selection updates the list.
- Clear either selector to remove that filter.
For example, choose rotate and credential to investigate a changed secret, or change_role and team_member to review access changes. The selectors list supported actions and resource types; a selection can have no matching entries in your workspace.
The screen shows up to 50 entries at a time and currently has no free-text, user or date search controls. Use filters and CSV export when you need to inspect more records.
Export CSV
Click Export CSV after applying your filters. Export requires a separate permission from viewing the log.
The file includes timestamp, user name, email and recorded role, action, resource type, resource ID and name, metadata, and IP address where available. Exported timestamps use UTC; account for that difference when comparing them with the screen's local times.
Exports contain up to the newest 10,000 matching entries. They aren't an unlimited archive. Treat the file as workspace information: it can contain member addresses, IP addresses and action metadata.
Retention and access
Audit entries are retained for 90 days and are automatically cleaned up after that period. Export relevant records before they age out if you need a longer history.
Owner, Admin and Analyst built-in roles can view and export the log. Custom roles can be granted View audit log and Export audit log separately. If the page or export button is missing, ask an administrator to review Roles and permissions.
Investigate a change
Identify the resource and action, note the time, and check the recorded user. Then inspect the resource's current configuration to establish its present state. For an unresolved issue, share the relevant row or filtered export with support, omitting unrelated information.
- Review access and credential changes when investigating an unexpected configuration.
- Include the time zone when discussing an entry with teammates.
- Store exported logs where only the appropriate team can access them.