Skip to main content

​
Read

Admins open Settings → Audit log, or find Audit log in the command palette. Each event shows time, actor, action and target. Filter by UTC date range and by group: members, tokens, policies, exports or billing. Members see an admins-only message. GET /v1/org/audit-log, admin, returns your organization’s events oldest first by (timestamp, id). JSON: { success, data: { entries, count, has_more, next_cursor } }. Each entry has id, timestamp, actor, action, resource, resource_id, agent_id and details; secrets in details are masked. Page until has_more is false, with the same filters on every page.

​
Export

Download CSV fetches every matching page. CSV has the entry fields as columns, in that order, with compact JSON details and RFC 4180 quoting. Special characters are quoted, and cells starting with =, +, - or @ get an apostrophe. Receipt exports follow the same cell rules. Paging headers are X-Next-Cursor and X-Has-More. A download holds the events that existed when its first page was read, even without until, so its own export events are left out. Earlier export events stay in. Each CSV page records one org.audit_log_exported event with the filters and count only. Reads share the receipt export rate limit. On 429, wait for Retry-After and retry the same page; the console does this for you.

​
Data retention

Admins set Settings → Data retention to Keep everything (the default) or 30 to 3650 days, with a preview before saving. Old tool inputs and results, messages, transcripts, goal outputs and artifacts are deleted daily. Receipts, credits, financial audit records, signed evidence and unfinished work stay.