Read the audit log
The audit log is an append-only record of important actions in your organization. Each entry says who did what, to which resource, and when. The log records meaningful changes and tool calls, not every page view.
Where to find it: Governance → Audit log. If you cannot see the whole organization, the tab is named Your activity.
Before you start
Every member can open this tab. What you see depends on one permission.
| Your access | What you see |
|---|---|
View audit log (audit:view) |
Every event in the organization. Built-in Org Owner, Org Admin and Auditor roles include this permission. |
No audit:view |
The tab is named Your activity. You see what you did, plus what happened on connections you own or can edit, including tool calls other people made through them. This applies to People Admin, Team Admin, Member, Billing Admin, Guest and custom roles without the permission. |
You can also open the activity for one connection by choosing View activity on a connection you own or can edit.
Anyone who can edit a connection sees every member's tool calls made through that connection, not only their own. A person can edit a connection when they own it, or when it was shared with them at the Edit level, directly, through a team, or with the whole organization. This is intended: editing a connection includes seeing what happened on it. People who can only use or view a connection do not see other people's calls. If someone's access is removed, those rows disappear the next time the page loads.
If you own or can edit a very large number of connections, Your activity lists only what you did yourself, and says so. Open View activity on a connection to see everything on that one connection.
Find an event
- Open Governance → Audit log.
- Use the search box to match an action name, an actor, a resource, or text in an event's details.
- Narrow the list with the Event type filter. The counts show how many loaded events fall in each category.
- Select a row to open the full detail panel.
You will know it worked when you can explain what changed, who changed it, and when.
You can also narrow the list with these filters:
| Filter | Choices |
|---|---|
| Time range | All time, Last 24 hours, Last 7 days, Last 30 days |
| Action | Created, Updated, Deleted, Other |
| Actor | One member, found by name or email |
Search and filters are saved in the page address (q, category, range, actor, action), so you can bookmark or share a view. Choose Export current view as CSV to download the events that match your filters. Choose refresh to reload the log from the server.
What gets recorded
Each entry usually has an actor, an action, a resource, a time, and metadata that you can open for full detail.
| Area | Examples |
|---|---|
| Membership and access | Invites, member role changes, removals, roles, teams, restrictions, SSO and SCIM changes |
| Connections | Connect, reconnect, transfer and delete, including transfers during offboarding |
| Connectors | Custom connector authoring and related changes |
| Toolboxes | Create, update and share, and other toolbox activity, including synthetic tools |
| MCP | Client grants on the MCP endpoint, and mcp.tool_called (the tool, the connection, the status and the duration) |
| Organization | Organization, team and billing events |
| Logging | Changes to logging destinations |
The Event type filter groups events into these categories:
| Category | What it groups |
|---|---|
| Authentication | Sign-in and account-security events |
| MCP | Your organization's MCP endpoint and tool calls |
| Toolboxes | Toolboxes and synthetic tools |
| Files | Files that tools produce |
| Connections | Connections and connectors |
| Access | Members, invites, roles, SSO, SCIM and restrictions |
| Org | Organization, team and billing events |
| Other | Anything that does not match the categories above |
Forward events to your own tools
To send events to your own logging tools, set up a destination under Settings → Logging. You need Manage logging (logging:manage). Elaichi forwards events classified as tool_call, auth or admin. Logging destinations need the Black plan. To get it, contact support. Datadog delivery is supported. See Forward audit events.
What to know
- The log is append-only and covers the current organization only.
- Elaichi records MCP tool calls even when they succeed. This helps when you need to know what an AI client actually ran.
- You cannot edit or delete an event.