Audit log
A record of configuration changes in your organization.
The audit log records the actions taken in your organization: who did them, what they affected, and when.
Reading the log#
Open Settings and select Audit log. Audit Events lists the last 12 months by default, newest first. Each row shows the Time, the Actor, the Source, the Action, the Target, and the Changed fields of an edit. Long histories load in pages: select Load more to continue.
Filtering#
Narrow the list under Filters:
- Action: one kind of change, or All actions.
- Source: where the change came from: Dashboard, API, MCP or System, or All sources.
- Actor ID: the user ID of the person who made the change.
Exporting#
Export CSV and Export JSON download every event that matches the current
filters, for archiving or for loading into your own SIEM. The file is named
audit-log- followed by the date, and each event includes its changes and
metadata.
What the audit log is not#
It records configuration changes, not conversations. To see what an agent did during a specific run, including the tools it called and what it returned, use the Traces API or the agent's Activity tab.