Audit log
What the workspace audit trail records, how to filter and export it, and the two gaps in coverage worth knowing.
The audit log under Compliance records who did what in the workspace. Owners and admins can read it; nobody can edit it.
What is recorded
Entries carry a timestamp, the action, the actor, and the target. Actions are grouped into categories — Security and Workspace — and each has a plain label. Examples of what appears:
| Action | Label | Category |
|---|---|---|
auth.login | Signed in | Security |
auth.login_google | Signed in with Google | Security |
workspace.member.invited | Invited a teammate | Workspace |
billing.plan_changed | Plan changed | Workspace |
knowledge.source_deleted | Deleted a knowledge source | Workspace |
api_key.issued | Issued an API key | Workspace |
Alongside those sit the 2FA events, the GDPR export and erasure records, and workspace settings changes — retention, handoff SLA, lead auto-assign, and AI disclosure.
Sign-ins are account-level, but the trail is workspace-scoped: one login writes one Security row per active workspace membership.
Filtering and export
Filter by category and search by text. Export CSV downloads the same filtered view, so the file matches what you were looking at. The export is capped, and the response says when it was truncated — narrow the filter rather than assuming the file is complete.
CSV exports are written to be safe to open in a spreadsheet, so a value that looks like a formula cannot execute.
Two gaps to know
- Account deletion is not durably in this trail. The row would be written to
a workspace that is deleted moments later, so it is cascade-removed. Evidence of account deletion lives in the confirmation email, and in the platform trail for admin-initiated cases.
- There is no `2fa.disabled` action, because 2FA cannot be disabled — only
reset behind a password or a single-use email link. A reset is what you will find instead.
Impersonation
Platform-admin impersonation is recorded, so a support session by evoriqa staff is visible in the trail rather than looking like your own activity.
Where to go next
Last updated