Audit logs

The audit log records administrative activity across the organization in a single feed. Open it from Secure > Audit Logs in the dashboard.

Access requirements

Viewing the audit log requires the org:read scope, which both the Admin and Member default roles include. The page is oriented toward organization administrators reviewing account activity. Roles and scopes are managed in Roles & Permissions.

What the feed shows

Events list chronologically, grouped by date. Each row displays a color-coded action badge in resource:action form (like api_key:create, mcp:delete, or chat_session:access), the actor, a human-readable description of what changed, and a timestamp. Member-invite events show the role before and after the change, and rows that modified data include a Show diff control revealing exactly what changed.

Recent activity from this feed also appears on the organization home page.

Filtering and navigating

Dropdowns at the top scope the feed by Project, Action, and Actor, with Clear filters to reset; a UTC / Local toggle switches timestamp display. A search box covers the whole log.

The feed supports keyboard navigation: J and K move between events, G jumps to the first, Shift+G to the last, and / focuses search.

Asking questions with the assistant

An assistant answers natural-language questions over the feed — suggested prompts include “What changed recently?”, “Any security events?”, and “Who’s most active?” — instead of scanning rows manually.