Skip to main content
The Audit log is a who-did-what record of actions taken in your organization: nodes started or deleted, API keys created or revoked, members added or removed, sign-ins, role changes, and more. Each entry names the actor, the action, the target it was performed on, and when it happened. Use it for compliance reviews, security investigations, and “who changed this?” questions.

​
Open the audit log

In the Dashboard sidebar, open Audit log. This page shows the organization-wide feed and is available to Admins and Owners (and platform admins). If you’re a Member, you don’t have the sidebar link — you see the events you triggered under My recent activity on your profile page instead. See Manage your account.

​
Audit log vs other activity views

The Dashboard surfaces a few activity views that are easy to confuse:

​
What each entry shows

Open any row to see its full detail panel: a one-line summary, the resolved actor and target, and any extra metadata captured with the action (for example a changed field, a role change, or an invitation’s email). Sensitive values such as secrets and API-key material are never stored in an entry. Where an action needed your explicit authorization, the entry records that you gave it. Accepting a node upgrade step that wipes a role’s data captures both the version change and the acknowledgement — see Update a node’s version. Entries are append-only. There is no edit, delete, or dismiss — an audit entry only ever has a creation time, never a lifecycle. Use the filter bar at the top of the log to narrow what you see. Each filter is multi-select and the URL updates as you go, so a filtered view is shareable:
  • Action — filter by action type.
  • Actor — pick one or more users.
  • Target — pick one or more nodes, executors, API keys, or other targets.
  • Category — group by domain: Auth, Security, Organization, Resources, Failures, Other.
  • Level — Info, Success, Warn, or Error.
  • Date — on, before, after, or a from/to range.
There’s also a free-text Search activity… box that matches across the action, actor, target, and entry details. You can group the table by day, actor, target, category, or level, and Load more to page through older entries.

​
Export to CSV

The full-page log has an Export CSV button that downloads the currently visible rows as a CSV (file name audit.csv). The export columns are: Created, Action, Category, Level, Actor, Target, Event ID. Export is available on the full Audit log page only. The My recent activity view on your profile is a personal slice, not a compliance artefact, so it has no export.

​
Who sees what

Visibility is enforced for every request: The My recent activity view is always scoped to you, regardless of role, and the Actor column is hidden there since every entry is your own.

​
What gets audited

Actions are grouped into categories. Everything currently written to the log:
  • Resources — node.created, node.updated, node.deleted, node.start.requested, node.stop.requested, node.tags.changed, node.group.changed, executor.tags.changed, executor.group.changed, alert_channel.created, alert_channel.updated, alert_channel.deleted, alert_rule.created, alert_rule.updated, alert_rule.deleted.
  • Security — rpc_key.issued, rpc_key.activated, rpc_key.revoked, user.role.changed.
  • Organization — organization.created, organization.updated, organization.member.added, organization.member.removed, organization.member.suspended, organization.member.restored, organization.ownership.transferred, invitation.sent, invitation.resent, invitation.link.generated, invitation.accepted, invitation.revoked.
  • Auth — session.signed_in, session.signed_out, user.password.changed, user.password.reset_requested, user.password.reset_completed, user.session.terminated.
  • Other — user.registered, user.email.verified, user.profile.updated, executor_key.created, executor_key.revoked, executor_key.claimed, executor_key.activated, tag.created, tag.renamed, tag.color.changed, tag.deleted, incident.acknowledged.
  • Failures — authz.denied (an action was blocked because the actor lacked permission).
The set grows as new actions ship. An action the Dashboard doesn’t yet recognize still appears, with a generated label.

​
Permissions

  • Read the organization audit log — Owners and Admins (and platform admins).
  • Export the audit log to CSV — same as read.
  • Read your own activity under My recent activity — every signed-in user, scoped to themselves.
  • No role can edit, delete, or dismiss an audit entry — the log is append-only.