Skip to navigation
ObserveLogs

Audit trail

Every privileged action in your Workforce organization, with who, what, when, and from where

The audit trail records every administrative change in your organization, plus a few reads such as log searches. Model requests and tool calls aren’t audit events; see Tool call logs and LLM calls.

Open Settings → Audit trail. You need the View audit trail permission. Filter by date, event type, and user, and click a row for the field-level diff on updates.

Fields on an audit entry

FieldWhat it holds
event_typeWhat was done, such as ROLE_UPDATED
event_descriptionA summary, with a change summary on updates
created_atWhen it was recorded, in UTC
user_name / user_emailWho acted, or empty for system events such as SCIM
role_nameTheir role at the time
Resource type and IDWhat was changed
SourceWeb dashboard, API, or system
ip_addressThe actor’s IP
url / methodThe HTTP path and verb
request_bodyThe request body, omitted for auth-adjacent actions

Entries are never modified. Secret fields show as changed in update diffs.

Event catalog

Use these values as the event_type filter.

AreaEvents
Sign-in and MFALOGIN_SUCCESS, LOGIN_FAILED, LOGOUT, MFA_ENABLED, MFA_DISABLED, MFA_DEVICE_CHANGED, MFA_VERIFICATION_FAILED, MFA_ADMIN_RESET, MFA_REQUIRED_ENABLED, MFA_REQUIRED_DISABLED
Members and rolesUSER_INVITED, USER_INVITATION_ACCEPTED, USER_INVITATION_CANCELLED, USER_CREATED, USER_UPDATED, USER_ENABLED, USER_DISABLED, USER_PASSWORD_RESET, ROLE_CREATED, ROLE_UPDATED, ROLE_DELETED
Single sign-onSSO_PROVIDER_CREATED, SSO_PROVIDER_UPDATED, SSO_PROVIDER_DELETED, SSO_LOGIN_REQUIRED_ON, SSO_LOGIN_REQUIRED_OFF
SCIM provisioningSCIM_TOKEN_CREATED, SCIM_TOKEN_REVOKED, SCIM_USER_PROVISIONED, SCIM_USER_UPDATED, SCIM_USER_REACTIVATED, SCIM_USER_DEPROVISIONED, SCIM_USER_ACCESS_UPDATED, SCIM_GROUP_CREATED, SCIM_GROUP_UPDATED, SCIM_GROUP_DELETED, SCIM_GROUP_ACCESS_UPDATED, SCIM_DEFAULT_ACCESS_UPDATED
Access requestsSCIM_TOOL_ACCESS_REQUEST_CREATED, SCIM_TOOL_ACCESS_REQUEST_APPROVED, SCIM_TOOL_ACCESS_REQUEST_DENIED, SCIM_TOOL_ACCESS_REQUEST_REVOKED, SCIM_TOOL_ACCESS_REQUEST_CANCELED
Keys and tokensPRODUCTION_API_KEY_CREATED, PRODUCTION_API_KEY_REVOKED, PRODUCTION_API_KEY_REGENERATED, TEST_API_KEY_CREATED, TEST_API_KEY_REGENERATED, TEST_API_KEY_REVOKED, TEST_API_KEY_DELETED, PERSONAL_ACCESS_TOKEN_GENERATED, PERSONAL_ACCESS_TOKEN_ROTATED, PERSONAL_ACCESS_TOKEN_REVOKED
ConnectorsCONNECTOR_IMPORTED, CONNECTOR_UPDATED, CONNECTOR_DELETED, CONNECTOR_AUTH_SCOPE_RULE_CREATED, CONNECTOR_AUTH_SCOPE_RULE_UPDATED, CONNECTOR_AUTH_SCOPE_RULE_DELETED, APPLICATION_CREDENTIAL_CREATED, APPLICATION_CREDENTIAL_UPDATED, APPLICATION_CREDENTIAL_DELETED
Employee connectionsCREDENTIAL_CREATED, CREDENTIAL_UPDATED, CREDENTIAL_DELETED, WORKFORCE_CREDENTIAL_UPSERTED, WORKFORCE_CREDENTIAL_DELETED (also used for model provider credentials)
EmployeesREGISTERED_USER_CREATED, REGISTERED_USER_UPDATED, REGISTERED_USER_DELETED
Tool PacksTOOL_PACK_CREATED, TOOL_PACK_UPDATED, TOOL_PACK_DELETED
Security rulesSECURITY_RULE_CREATED, SECURITY_RULE_UPDATED, SECURITY_RULE_DELETED
Model accessWORKFORCE_BLOCKLIST_RULE_CREATED, WORKFORCE_BLOCKLIST_RULE_UPDATED, WORKFORCE_BLOCKLIST_RULE_DELETED
RoutingWORKFORCE_ROUTING_POLICY_CREATED, WORKFORCE_ROUTING_POLICY_UPDATED, WORKFORCE_ROUTING_POLICY_DELETED, WORKFORCE_GROUP_ROUTING_UPDATED, WORKFORCE_EMPLOYEE_ROUTING_UPDATED
ModelsWORKFORCE_MODEL_CONTROLS_UPDATED, WORKFORCE_MODEL_COMPRESSION_UPDATED, WORKFORCE_GROUP_MODELS_UPDATED, WORKFORCE_MODEL_MIGRATION_CREATED, WORKFORCE_MODEL_MIGRATION_UPDATED
BudgetWORKFORCE_GROUP_BUDGET_UPDATED
Employee keysWORKFORCE_EMPLOYEE_KEY_REVEALED, WORKFORCE_EMPLOYEE_KEY_ROTATED
EvalsEVAL_RUN_STARTED
SkillsSKILL_DRAFTED, SKILL_SUBMITTED, SKILL_APPROVED, SKILL_REJECTED, SKILL_PUBLISHED, SKILL_UNPUBLISHED, SKILL_REPUBLISHED, SKILL_ENABLED, SKILL_DISABLED, SKILL_DELETED, SKILL_EDITED, SKILL_RETRIEVED
KnowledgeSYNCED_KNOWLEDGE_SOURCE_CONNECTED, SYNCED_KNOWLEDGE_SOURCE_DISCONNECTED
InsightsINSIGHT_ACTION_EXECUTED, INSIGHT_ACTION_DISMISSED
WebhooksOUTBOUND_WEBHOOK_CREATED, OUTBOUND_WEBHOOK_UPDATED, OUTBOUND_WEBHOOK_DELETED, OUTBOUND_WEBHOOK_VERIFICATION_KEY_REFRESHED, INBOUND_WEBHOOK_SETTINGS_UPDATED
Log accessTOOL_CALL_LOGS_SEARCHED, TOOL_CALL_LOG_DETAIL_VIEWED, API_LOGS_SEARCHED, API_LOG_DETAIL_VIEWED, WORKFORCE_LLM_LOGS_SEARCHED, WORKFORCE_LLM_LOG_DETAIL_VIEWED, WORKFORCE_LLM_LOG_PAYLOAD_VIEWED, WORKFORCE_SECURITY_ALERTS_SEARCHED, AUDIT_LOG_EXPORTED
Chat sessionsCHAT_SESSION_CREATED, CHAT_SESSION_ENDED
OrganizationWORKFORCE_ACTIVATED, WORKFORCE_LOG_PAYLOADS_UPDATED, ORGANIZATION_CLAIMED, ORGANIZATION_CLAIM_REISSUED
BillingBILLING_PAYMENT_METHOD_ADDED, BILLING_PAYMENT_METHOD_UPDATED, BILLING_PLAN_CHANGED, BILLING_SUBSCRIPTION_CANCELLED, ORG_SWITCHED_TO_EMPLOYEES_PRO, BILLING_USER_SNAPSHOT_SUBMITTED

Export the audit trail

Export downloads a CSV of the current filtered view and records AUDIT_LOG_EXPORTED.

Data retention

Audit events, tool call logs, and violation records are kept for 90 days, including for deprovisioned employees. For longer, export on a schedule or stream logs to a SIEM.