Overview
The Audit Log provides a record of security and administrative actions taken across your organization. It tracks who did what, when, and to which resource. Organization administrators can access the audit log from the Settings page under the Audit Log tab.Viewing the Audit Log
From the left sidebar, click on Settings, then select the Audit Log tab. Each entry in the log includes:- Time: When the action occurred
- Actor: The user or system that performed the action
- Action: What was done (e.g., “Created role”, “Provisioned user”)
- Category: The area the action belongs to (e.g., Auth, RBAC, SCIM)
- Resource: The resource that was affected, along with its type and ID
Filtering and Search
The audit log supports several ways to narrow down events:- Search: Free-text search across actor email, action, category, resource type, resource ID, and event details
- Category filter: Filter by category (e.g., Authentication, SCIM Provisioning, Roles & Permissions)
- Action filter: Filter by specific action. When a category is selected, only actions relevant to that category are shown
- Date range: Filter by time window (Today, Last 7 Days, Last 30 Days, Last 90 Days)
Search operators
Combine terms to require all of them, and use double quotes for phrases. Search runs across the full audit history, together with the selected filters.
For example,
from:jbm changed:"org settings" finds organization settings events from an actor whose email contains jbm. To find a specific setting, use its field name: from:jbm changed:allow_llm_data_retention. The changed-field search covers both change summaries and older events that record a setting name. It can only find changes recorded in an event’s details.
Dots, underscores and hyphens in event and field names can be entered as spaces. Unrecognized operators remain ordinary search text. To search for a literal phrase, including a colon, quote the entire phrase, e.g. "from:jbm".
Searches support up to 32 terms and 4096 bytes. Longer queries return a validation error.