Audit Log
The audit log gives Admins and Owners a chronological record of security-relevant activity across the organization: who signed in, who changed a role, who revealed a secret variable, and more. You'll find it under Settings → Audit Log (in the Security group of the settings sidebar), described as "Track security events and secret variable access across your organization."
The audit log is available on the Pro plan and up — on lower plans the page shows an upgrade card. Viewing it requires the org:manage-members permission, which Admins and Owners have.
The page has two tabs: Security and Variables.
Security tab
The Security tab lists organization-wide security events in a table with five columns: Time, Actor (the user's email), Event, Result (success or failure), and Target (the affected entity, where applicable).
Events are grouped into eight categories:
| Category | Events |
|---|---|
| Authentication | Login, Logout, Token Refresh |
| API Keys | API Key Created, API Key Revoked, API Key Used |
| User & Members | User Invited, User Removed, User Onboarded, Role Changed, Member Left |
| Organization | Org Created, Org Updated, Org Deleted |
| Domains | Domain Added, Domain Verified, Domain Verification Failed, Domain Removed, Domain SSO Enforced, Domain SSO Unenforced |
| SSO | Single sign-on configuration and sign-in events |
| SCIM | Directory-sync provisioning events |
| Data | Data Export, Data Import |
Filtering
- Event type — the dropdown at the top filters to one of the eight categories (or All event types).
- Actor email — type an email into Filter by email... and click Filter (or press Enter) to see only that user's activity.
The entry count next to the filters shows how many events match. Results are paginated at 25 entries per page with Previous/Next buttons. If nothing matches your filters, the table shows "No entries match the selected filters."
Export
On the Enterprise plan an Export button sits at the end of the filter row. It downloads the currently filtered Security events — the same event-type and actor-email filters you have applied — as either Export as CSV or Export as JSON. The file is named audit-logs-<date>.<format>. On lower plans the button is hidden.
Variables tab
The Variables tab is a dedicated trail for secret variable operations — useful for answering "who saw this credential, and when?". Each row shows the Time, User, Action, Variable Key, Scope, and the IP Address the request came from.
Six actions are recorded:
| Action | Logged when someone... |
|---|---|
| Revealed | displays a secret variable's value in the UI |
| Created | creates a secret variable |
| Updated | changes a secret variable |
| Unsecured | turns off a variable's secret flag, so its value is plain text from then on |
| Deleted | deletes a secret variable |
| Exported | exports data containing secret variables |
Unsecured is highlighted in red in the list — it is the one action that changes how a value is protected rather than just who has seen it. It is recorded for all three scopes: organization, project (environment) and personal variables.
The Scope column tells you where the variable lives: Organization, Project, or Personal. Use the action dropdown to filter to a single action type; pagination works the same as on the Security tab (25 entries per page). See Variables for how secret variables work.
Retention
How long Security events are kept before the automatic cleanup removes them depends on your plan:
| Plan | Retention |
|---|---|
| Free, Starter, Pro | 30 days |
| Enterprise | 365 days |
A note below the table restates this: "Entries older than {n} days are deleted automatically based on your plan.", where {n} matches your current plan.
Related
- Variables — the secret variables the Variables tab tracks
- API Keys — key creation, revocation, and usage all appear in the log
- Members & Invitations — membership changes recorded as User & Members events
- Single Sign-On — enforce how the sign-ins in this log happen