Identity and access

Audit log

Who changed what in your organization, when and from where.

Cloud → Audit log (under Settings) shows your organization's events, newest first. Owners and admins can read it (audit:read).

An event


Action	What happened, such as `deployment.promote`.
Actor	Who did it: a person, a key, an agent, or the platform itself (for example the build pipeline marking a deployment ready).
Target	What it happened to, such as a project, deployment or key.
Details	A short summary, like the environments a variable applies to or the strategy a pull request was merged with.
From	The IP address and user agent of the request, when there was one.

Events never contain secret values: no environment variable values, keys, tokens, job inputs or invite links, and a connector's address is recorded without its query string.

Changes to your own account (password, passkeys) appear in every organization you belong to.

Find events

Filter by an activity (a single action or a whole category).
Filter by an actor or a target from any event's row.
Scroll to load older events.
Export JSON Lines downloads the matching events, newest first, up to 10,000 at a time. Narrow the filters to export older ones.

Retention

How long events are kept depends on your organization's plan; the page says how many days. Events older than that are deleted.

What's recorded

Projects

Action	Shown as
`project.create`	Created project
`project.update`	Updated project
`project.rename`	Renamed project
`project.transfer`	Transferred project
`project.delete`	Deleted project

Deployments

Action	Shown as
`deployment.start`	Started deployment of
`deployment.redeploy`	Redeployed
`deployment.promote`	Promoted to production
`deployment.rollback`	Rolled back production to
`deployment.ready`	Deployed
`deployment.failed`	Deployment failed
`deployment.canceled`	Deployment canceled

Environment variables

Action	Shown as
`env.update`	Set environment variable
`env.bulk_upsert`	Set environment variables for
`env.delete`	Removed environment variable

Domains

Action	Shown as
`domain.create`	Added domain
`domain.update`	Updated domain
`domain.delete`	Removed domain
`domain.dns`	Added DNS records in Cloudflare

Integrations

Action	Shown as
`integration.connect`	Connected integration
`integration.disconnect`	Disconnected integration

Storage and repositories

Action	Shown as
`resource.create`	Created database, bucket or repository
`resource.update`	Updated database, bucket or repository
`resource.link`	Linked database, bucket or repository
`resource.unlink`	Unlinked database, bucket or repository
`resource.delete`	Deleted database, bucket or repository

Pull requests

Action	Shown as
`pull.create`	Opened pull request
`pull.merge`	Merged pull request
`pull.close`	Closed pull request
`pull.reopen`	Reopened pull request
`pull.approve`	Approved pull request
`pull.unapprove`	Withdrew approval of pull request

Repositories

Action	Shown as
`repo.create`	Created repository
`repo.rename`	Renamed repository
`repo.protect`	Changed branch protection of
`repo.delete`	Deleted repository

Branches

Action	Shown as
`branch.create`	Created branch
`branch.delete`	Deleted branch
`branch.default`	Changed the default branch of

Web commits

Action	Shown as
`file.commit`	Committed to

Agents

Action	Shown as
`device.approve`	Approved agent
`device.deny`	Denied agent
`device.update`	Updated agent
`device.revoke`	Revoked agent
`device.host_request`	Asked for a new host
`device.host_approve`	Allowed a host for agent
`device.host_deny`	Denied a host for agent

Agent jobs

Action	Shown as
`job.create`	Queued agent job

Connectors

Action	Shown as
`connector.create`	Added connector
`connector.update`	Updated connector
`connector.delete`	Removed connector

Integrations

Action	Shown as
`integration.connect`	Connected integration
`integration.disconnect`	Disconnected integration

Docs

Action	Shown as
`page.create`	Created page
`page.update`	Updated page
`page.delete`	Moved page to trash
`page.restore`	Restored page

Context

Action	Shown as
`context.update`	Set context entry
`context.delete`	Deleted context entry

Members

Action	Shown as
`member.invite`	Invited
`member.invite_revoke`	Revoked invite for
`member.join`	Joined organization

Teams

Action	Shown as
`team.create`	Created team
`team.delete`	Deleted team
`team.member_add`	Added a member to team
`team.member_update`	Changed a member's role in team
`team.member_remove`	Removed a member from team

Keys

Action	Shown as
`key.create`	Created key
`key.revoke`	Revoked key

Action	Shown as
`account.password_change`	Changed password
`account.passkey_add`	Added passkey
`account.passkey_remove`	Removed passkey
`account.app_password_create`	Created app password
`account.app_password_revoke`	Revoked app password
`account.app_password_first_use`	First used app password
`account.exchange_device_remove`	Removed device
`account.exchange_grant_create`	Signed in Apple device
`account.exchange_grant_revoke`	Signed out Apple device
`account.exchange_grant_reuse`	Signed out Apple device after a reused refresh token
`account.exchange_signin_approve`	Approved a sign-in from another device
`account.exchange_signin_deny`	Denied a sign-in from another device

Mail

Action	Shown as
`mail.domain_create`	Added mail domain
`mail.domain_update`	Updated mail domain
`mail.domain_delete`	Removed mail domain
`mail.mailbox_create`	Created mailbox
`mail.mailbox_update`	Updated mailbox
`mail.mailbox_delete`	Deleted mailbox
`mail.alias_create`	Added alias
`mail.alias_delete`	Removed alias

Calendar

Action	Shown as
`calendar.create`	Created calendar
`calendar.update`	Updated calendar
`calendar.delete`	Deleted calendar
`calendar.import`	Imported events into calendar
`calendar.event_create`	Created event
`calendar.event_update`	Updated event
`calendar.event_delete`	Deleted event
`calendar.event_respond`	Responded to event
`calendar.itip`	Applied meeting mail to event

Contacts

Action	Shown as
`contacts.book_create`	Created address book
`contacts.book_update`	Updated address book
`contacts.book_delete`	Deleted address book
`contacts.import`	Imported contacts into address book
`contacts.create`	Created contact
`contacts.update`	Updated contact
`contacts.delete`	Deleted contact

Organizations (platform organization)

Action	Shown as
`org.create`	Created organization
`org.update`	Updated organization
`org.delete`	Deleted organization

Regions (platform organization)

Action	Shown as
`region.update`	Updated region

Locations (platform organization)

Action	Shown as
`location.update`	Updated location

Plans (platform organization)

Action	Shown as
`plan.update`	Updated plan

Models (platform organization)

Action	Shown as
`model.update`	Updated model

Planned

Sign-ins and failed sign-ins, connector tool calls, Git pushes and deployment expiry. Coming soon
A daily export of the log to storage. Coming soon

Audit log

On this page