Skip to main content
Audit logs give account administrators a tamper-evident record of administrative actions taken across their organization. Access them from the left sidebar under your account name. Only account administrators can view audit logs. Each log entry captures: Audit log entries are read-only and cannot be modified or deleted.

​
Captured actions

Audit logs capture actions in these categories:
  • Credentials — connect, disconnect, rotate
  • Triggers — create, update, delete, activate, deactivate
  • Agents — install, uninstall, publish
  • Integrations — create, update, publish, delete
  • Members — invite, remove, role change
  • API keys — create, delete

​
Exporting logs

Click Export in the Audit Logs view to download a CSV of the currently filtered log entries. The audit log covers administrative actions. Two other records complete the picture of what agents did and at what cost:
  • The session event log records every LLM call, tool invocation, sub-task spawn, error, and lifecycle transition inside each session, including who interrupted a session and when.
  • Insights attributes token usage and spend to each workspace, agent, user, provider, and model.
See Security architecture for how these fit together.