Audit logs

Manage → People & access → Audit log, visible to administrators.

What is recorded

Actions that change who can do what, or that affect other people:

• Members invited, removed, or given a different role
• API keys created and revoked
• Connectors created, deleted, or made global
• Access profiles changed
• Settings changed
• Agent sessions revoked

Each entry keeps who did it, what they did it to, and when.

Reading it

The log is shown newest first, 25 entries per page, with page controls under the table. The header shows which slice of the total you are looking at.

Export. The download button next to the refresh control hands you the entire trail as a CSV file, one row per entry, in the same newest-first order. Columns: created_at (UTC, RFC 3339), action, actor_email, actor_user_id, actor_api_key_id, target_type, target_id, detail (the full JSON payload the table summarises) and id. The same data is available to scripts at GET /api/orgs/current/audit-log?format=csv with an admin session; the JSON endpoint takes limit and offset for paging.

Authentication events

Sign-ins, failed sign-ins with the reason, sign-outs and password changes are recorded separately, with the source address. That includes sign-ins through an agent's OAuth page (an MCP client connecting for the first time), tagged with the client. That is what answers "was this account accessed, by whom, from where" after something goes wrong.

What is not recorded

Reading. Searches and content views are not in the audit log. Recording every read would produce an unusable volume of entries and a second copy of your content's access patterns, which is its own risk.

If you need read auditing for a compliance requirement, that is worth a conversation rather than an assumption.

Retention

Entries are never rewritten — the log is append-only by design. Audit entries and authentication events are kept for 365 days, then deleted by the worker's hourly retention sweep. Self-hosted, set RETENTION_AUDIT_LOG_DAYS and RETENTION_AUTH_EVENTS_DAYS to change that, or 0 to keep them forever. Export the CSV first if your policy needs a longer archive than you want to keep online.