Observe

Audit Trail

Every admin action, captured and exportable.

The Audit Trail records every admin action taken in your Agent Handler organization. Member invitations, role changes, API key rotations, OAuth credential edits, security rule changes, Tool Pack edits - anything that mutates configuration or access. It’s the artifact your security review will ask for, and the evidence you’ll pull when you need to know who changed what and when.

Different from the Tool Call Logs (which capture agent activity) and the API Request Logs (which capture your backend’s calls). The Audit Trail is specifically about administrative actions on the dashboard or via the management API.

What’s captured

For each event:

  • Event type. What was done (role.updated, api_key.regenerated, tool_pack.created, etc.).
  • Actor. The dashboard user (or the API key) that performed the action.
  • Resource. What was changed - Registered User ID, Tool Pack ID, rule ID, member ID.
  • Before/after diff. For updates, the specific fields that changed and their old and new values.
  • Source. Web dashboard, API, or system (for automated actions like SCIM-driven changes).
  • IP address of the actor, when available.
  • Timestamp.

Event catalog

The full set, grouped by area.

Members and access

EventFires when
member.invitedAdmin invites a new member
member.joinedInvited member accepts and logs in for the first time
member.role_changedA member’s role is updated
member.removedA member is removed from the org
role.created / role.updated / role.deletedCustom role lifecycle
mfa.enabled / mfa.disabled / mfa.resetMember MFA changes
sso.configured / sso.required / sso.disabledSSO configuration changes
scim.token_regeneratedSCIM token rotated

API keys and credentials

EventFires when
api_key.createdTest API key generated
api_key.regeneratedProduction key rotated
api_key.deletedTest key deleted
allowed_origin.added / allowed_origin.removedCallback origin changes
application_credential.added / application_credential.updated / application_credential.deletedBYO OAuth app changes

Configuration

EventFires when
tool_pack.created / tool_pack.updated / tool_pack.deletedTool Pack lifecycle
tool_pack_connector.added / removedConnectors added or removed from a pack
tool_description_override.created / updated / deletedPer-pack Tool Description Overrides
tool_input_override.created / updated / deletedPer-pack input schema overrides
Connector.enabled / Connector.disabledOrg-level Connector enablement

Security rules

EventFires when
standard_rule.updatedDefault entity rule action or threshold changed
custom_rule.created / updated / deletedCustom Regex Rule lifecycle
rule_override.created / updated / deletedPer-tool-pack rule overrides

Webhooks

EventFires when
webhook.subscription_created / updated / deletedOutbound webhook lifecycle
webhook.signing_secret_rotatedVerification key rotated

Where to view it

Settings → Audit Trail. The default view is the last 7 days, all events. The filter bar supports event type, actor, resource type, date range, and source.

Click any row to open the event detail with the full diff. For events that touched multiple fields, every field’s old and new value is shown side by side.

Investigation flow

“Who changed this?” Filter by resource type and ID. The Audit Trail shows every event against that resource in chronological order with the actor on each row.

“What did this person do?” Filter by actor. You’ll see everything that member touched across resources - useful when offboarding, before revoking access.

Exporting

The Export button produces CSV of whatever filter is currently applied. For compliance reviews where you need to show a 12-month window, set the date filter and export.

The CSV includes:

  • Event ID
  • Timestamp (ISO 8601, UTC)
  • Event type
  • Actor email and ID
  • Resource type and ID
  • Source (dashboard, API, system)
  • Diff (JSON-encoded before/after for update events)

For automated forwarding to a SIEM or data warehouse, the audit-trail export endpoint is documented in the API reference.

Retention

90 days on standard plans. 1 year on Business. Custom on Enterprise. Beyond your retention window, exported CSVs are the path to long-term storage.

If your compliance requirements need longer retention than your plan provides, schedule periodic exports via the API and store them in your own systems.

What it doesn’t capture

The Audit Trail covers admin actions on the management plane - mutations, not reads. It doesn’t include tool calls (see Tool Call Logs), backend API requests (see API Request Logs), or the OAuth-flow steps that lead up to a credential.created event. For the full picture, combine the three streams.

Next

Manage who on your team can do what with Team and roles.