Read the audit log
The audit log is an append-only record of privileged actions in your organization — who did what, to which resource, and when.
Where to find it: Governance → Audit logs
You need the View audit log permission (audit:view). Built-in Org Owner, Org Admin, and the free Auditor role include it; People Admin, Team Admin, Member, and Guest do not.
The log records meaningful changes and tool calls — not every page view.
What gets recorded
From the product surface, expect coverage across:
| Area | Examples of what’s captured |
|---|---|
| Membership & access | Invites, member role changes, removals, roles, teams, restrictions, SSO/SCIM changes |
| Connections | Connect, reconnect, transfer, delete (including transfers during offboarding) |
| Connectors | Custom connector authoring and related changes |
| Toolboxes | Create/update/share and related toolbox activity; synthetic tools |
| MCP | Client grants on the MCP endpoint, and mcp.tool_called (tool, connection, status, duration) |
| Assistant | Provider key changes and other assistant admin actions |
| Organization | Org/team/billing-class events |
| Logging | Observability destination configuration |
Each entry typically includes the actor, action, resource, time, and metadata you can open for full detail.
Categories in the UI
The Audit logs tab groups events for filtering:
| Category | What it groups |
|---|---|
| Authentication | Sign-in and account-security events |
| Assistant | Assistant-related actions |
| MCP | Your organization's MCP endpoint and tool calls |
| Toolboxes | Toolboxes and synthetic tools |
| Connections | Connections and connectors |
| Access | Members, invites, roles, SSO/SCIM, restrictions |
| Org | Organization, teams, billing-class events |
| Other | Anything that doesn’t match the above |
Find an event
- Open Governance → Audit logs.
- Use search for an action name, actor, resource, or metadata text.
- Narrow with the type filter (the categories above). Counts show how many loaded events fall in each bucket.
- Select a row for the full detail panel.
You'll know it worked when: You can explain what changed, who changed it, and when.
Beside the category filter you also get:
| Filter | Choices |
|---|---|
| Date range | All time, Last 24 hours, Last 7 days, Last 30 days |
| Action kind | Created, Updated, Deleted, Other |
| Actor | One member, searched by name or email |
Search and filters sync into the URL (q, category, range, actor, action), so you can bookmark or share a view. You can also export the filtered range. Refresh reloads the log from the server.
Forward events elsewhere
To send classified events (tool_call / auth / admin) to your own observability stack, configure destinations under Settings → Logging (permission logging:manage). Datadog delivery is supported; see Forward audit events.
Good to know
- The log is append-only and scoped to the current organization.
- MCP tool calls are audited even when they succeed — useful when investigating what an agent actually ran.
- Retention and which advanced logging features you get depend on your plan; workspace audit access itself is part of the standard Gold/Black workspace feature set.