Read the audit log
The audit log is an append-only record of privileged actions in your organization — who did what, to which resource, and when.
Where to find it: Governance → Audit logs
You need the Read audit log permission (audit:read). Built-in Org Owner and Org Admin include it; Team Admin, Member, and Viewer do not.
The log records meaningful changes and tool calls — not every page view.
What gets recorded
From the product surface, expect coverage across:
| Area | Examples of what’s captured |
|---|---|
| Membership & access | Invites, member role changes, removals, roles, teams, restrictions, SSO/SCIM changes |
| Connections | Connect, reconnect, transfer, delete (including transfers during offboarding) |
| Connectors | Custom connector authoring and related changes |
| Toolboxes | Create/update/share and related toolbox activity; synthetic tools |
| MCP | Server lifecycle and mcp.tool_called (tool, connection, status, duration) |
| Assistant | Provider key changes and other assistant admin actions |
| Organization | Org/team/billing-class events |
| Logging | Observability destination configuration |
Each entry typically includes the actor, action, resource, time, and metadata you can open for full detail.
Categories in the UI
The Audit logs tab groups events for filtering:
| Category | What it groups |
|---|---|
| Assistant | Assistant-related actions |
| MCP | MCP servers and tool calls |
| Toolboxes | Toolboxes and synthetic tools |
| Connections | Connections and connectors |
| Access | Members, invites, roles, SSO/SCIM, restrictions |
| Org | Organization, teams, billing-class events |
| Other | Anything that doesn’t match the above |
Find an event
- Open Governance → Audit logs.
- Use search for an action name, actor, resource, or metadata text.
- Narrow with the type filter (the categories above). Counts show how many loaded events fall in each bucket.
- Select a row for the full detail panel.
You'll know it worked when: You can explain what changed, who changed it, and when.
Filters and search sync into the URL (q, category) so you can bookmark or share a view. Refresh reloads the log from the server.
Forward events elsewhere
To send classified events (tool_call / auth / admin) to your own observability stack, configure destinations under Settings → Logging (permission logging:manage). Datadog delivery is supported; see Forward audit events.
Good to know
- The log is append-only and scoped to the current organization.
- MCP tool calls are audited even when they succeed — useful when investigating what an agent actually ran.
- Retention and which advanced logging features you get depend on your plan; workspace audit access itself is part of the standard Gold/Black workspace feature set.