# Audit log

> A record of configuration changes in your organization.

Source: https://docs.runbear.io/administration/audit-log

Last updated: 2026-10-07

The audit log records the actions taken in your organization: who did them, what
they affected, and when.

> **Note**
>
> The audit log is part of the enterprise entitlement and is visible to Admins. If
> **Settings → Audit log** does not appear, your plan does not include it yet.

## Reading the log

Open **Settings** and select **Audit log**. **Audit Events** lists the last 12
months by default, newest first. Each row shows the **Time**, the **Actor**, the
**Source**, the **Action**, the **Target**, and the **Changed fields** of an edit.
Long histories load in pages: select **Load more** to continue.

## Filtering

Narrow the list under **Filters**:

- **Action**: one kind of change, or **All actions**.
- **Source**: where the change came from: **Dashboard**, **API**, **MCP** or
  **System**, or **All sources**.
- **Actor ID**: the user ID of the person who made the change.

## Exporting

**Export CSV** and **Export JSON** download every event that matches the current
filters, for archiving or for loading into your own SIEM. The file is named
`audit-log-` followed by the date, and each event includes its changes and
metadata.

## What the audit log is not

It records configuration changes, not conversations. To see what an agent did during
a specific run, including the tools it called and what it returned, use the
[Traces API](/api/traces.md) or the agent's **Activity** tab.

## Related

- [Members and roles](/administration/members-and-roles.md)
- [Tool approvals](/administration/tool-approvals.md)
- [Traces API](/api/traces.md)