Platform
Audit Log
The Audit Log is a reverse-chronological record of changes made in your organization — who acted, what they acted on, when, and whether the action succeeded, was denied, or errored.
Find it under Govern → Audit Log in the organization sidebar.
Plan availability
Viewing and exporting the Audit Log is an Enterprise plan feature. Events are recorded for your organization regardless of plan, so when the log becomes available it opens onto the history your organization has already accumulated rather than an empty table.
Reading the Log
Each row shows the time of the event, the action, the actor, the target, and the outcome. Actions, module names, and target types are shown exactly as they are recorded, so the value you see is the value you can filter on or query in a SIEM after exporting.
Denied and Error outcomes are badged so you can scan for them without reading every line. Actor names are captured at the time of the event, so a renamed or removed user still shows who acted.
Expand a row to see the field-level diff for the change — old value on the left, new value on the right — alongside the detail that has no column of its own: module, event ID, target ID, source IP, trace ID, and user agent. A field that was never set is shown as —, and one explicitly set to an empty string as (empty).
Filtering
The toolbar lets you narrow the log by module, action, actor, and target type, and by outcome using the All / Success / Denied / Error buttons. The search box does a substring match on actor and target labels.
The dropdowns only offer values that actually appear in the selected time range, so a filter never returns an empty result.
The time range selector sits in the page header and defaults to the last 30 days. Widen it to reach older events — the log retains more than the default window shows.
Every filter and the time range live in the URL, so a filtered view is a link you can share or bookmark. The first page loads up to 100 events; use Load more to append the next page.
Exporting
Export CSV downloads the full filtered match set — not just the rows currently on screen — as audit-log-YYYY-MM-DD.csv. The file includes every column the log records, timestamps in ISO-8601 UTC, and the field-level diff, so it can be correlated with other logs in a spreadsheet or SIEM.
Very large exports are capped. When that happens the file still downloads and a warning tells you how many events it contains; narrow the time range or filters to export the rest.
Export is separately permissioned. If you can read the log but not export it, the button isn't shown — ask an organization administrator if you need it.