Audit Log
Who did what in your organization, and how to filter and export the history.
The audit log records every administrative action taken in an organization: who did it, what it touched, when, and from which IP address. It is the record you reach for when a campaign disappears, a member’s role changes, or an API key shows up that nobody remembers creating.
Who can see it
Section titled “Who can see it”Owners and admins can open the audit log under Settings → Audit log. Members cannot. A custom team role can be given the Audit log permission from the role editor.
The audit log is part of the Pro and Team plans. Events are recorded for every organization from the start, so upgrading shows the full history immediately rather than an empty page.
What is recorded
Section titled “What is recorded”| Area | Actions |
|---|---|
| Organization | Created, updated (name, description, logo, spending defaults) |
| Members | Joined, left, removed, roles changed, spend limit set or cleared |
| Invitations | Sent, accepted, declined, revoked |
| Team roles | Created, updated, deleted |
| Projects | Created, updated, deleted, access restricted or opened |
| Campaigns | Created, updated, paused or resumed, deleted, for every tool |
| API keys | Created, updated, deleted |
| Integrations | Connected, disconnected |
| Security | SSO provider added, updated or removed; SSO domain verified; SSO enforcement on or off; two-factor on or off |
| Billing | Subscription started, plan changed, canceled, resumed |
| Support | An entitlement set or removed; billing details, a subscription or an order changed; a support session started or ended |
| Audit log | An export was downloaded |
Each row names the person who acted. Actions an AI assistant takes through the MCP connection are recorded under the person who connected it. Actions taken through an API key show the key instead of a person, and actions taken by the platform itself, such as a renewal from the billing provider, show as System. Actions our team takes for you show as Support: the log records that support acted, not which engineer. When a platform administrator signs in as one of your members during a support session, the start of that session is always recorded, its end is recorded when the administrator ends it, and every action taken during it is marked as taken on their behalf.
Team role and API key changes record the permissions granted and removed, so a widened grant is visible as such.
Deleting the organization is not recorded, because the record would be deleted with it.
Filtering and export
Section titled “Filtering and export”Filter by member, action, target type and date range. The filters live in the page address, so a filtered view can be shared as a link.
Export CSV downloads the current view, up to 50,000 rows, newest first. A file that hit that cap ends with a line starting # truncated; narrow the date range for the rest. Exports require the Exports feature on your plan, and every export is itself recorded in the log.