Audit Logs

Look up who did what across your organization — every user, agent, and system action in one filterable, exportable timeline

Audit Logs record user, agent, and system actions across your organization in a single timeline at Admin Settings → Audit Logs. Entries cannot be edited or deleted from the app, so the timeline stands as a reliable record for security and compliance reviews.

Availability

Access	Detail
Who can view	Organization Owner and Admin roles
Plans	Scale, Scale+, and Enterprise. On other plans the page shows an upgrade prompt instead of the timeline
Location	Admin Settings → Audit Logs
Scope	All workspaces in the organization

What is logged

Actions across the platform land in the timeline as they happen — connection changes, approval decisions, credential updates, billing events, user management, and activity from the Optimize, Review, Cyber, and Resolve modules. Each entry carries a category matching the surface it came from, so you can isolate one area quickly.

Event fields

The timeline shows one row per event; clicking a row opens a detail view with the full record.

Field	Contents
Timestamp	When the action happened
Actor	The user, agent, or system component that acted
Category	The surface the event came from — Connection, Approval, Security, Billing, and more
Event	The specific action taken
Severity	Low, Medium, High, or Critical
Summary	One-line description of what happened
Workspace	The workspace the action ran in
Resource	Type, name, and ID of the object acted on (detail view)
Incident ID	Link to the related Resolve incident, when one exists (detail view)
IP address	Where a user action originated (detail view)

Field values

Field	Values
Actor type	User — a person in your organization · Agent — an AI agent acting in a workspace · System — the platform itself
Severity	Low · Medium · High · Critical
Outcome	Success · Failure · Pending

Filters and search

Every filter narrows the timeline, the summary tiles, and any export you run.

Filter	Options
Search	Free-text match across events
Actor type	User, Agent, System
Category	Any event category
Severity	Low, Medium, High, Critical
Date range	Start and end dates

Above the table, summary tiles show Total Events, Success, Failures, and Agent Actions for the current filter set — a quick read on whether anything needs attention before you scroll.

Export

Click Export CSV to download the timeline as audit-trail.csv. The export respects your current filters, so narrow the timeline first to produce a scoped report for a security or compliance review.

Retention

Audit events are retained for 90 days by default; older entries are deleted automatically. Export to CSV before the window closes if you need a longer-lived record.

Related

Security & Authentication

Access control, SSO, and the role model that decides who reaches this page

Organizations

Manage organization settings, member roles, and workspaces