Skip to main content
Open Settings → Organization → Audit log to review recorded activity. Your identity needs audit-read access for the account. The page has two logs:

​
Find an event

  1. Select the tab for the activity you are investigating.
  2. Choose a time range. Times in the results are UTC.
  3. On Changes, filter by event, actor, workspace, or affected person.
  4. Use the automated-activity control when platform activity is relevant.
  5. Open a row to inspect its details, actor, scope, outcome, and recorded changes.
  6. Load more results when the page offers more. Clear filters to broaden the search before concluding that no event was recorded.
A change can name an agent or API key as its actor. When an action was performed on behalf of another person, the event can show that relationship as well. A workspace that is no longer available can still have historical events.

​
Interpret missing or repeated activity

The audit log is the activity the services recorded. It is not a copy of every HTTP request or every model/tool payload. Successful token refreshes and machine token issuance can be summarized rather than written for each request. Use a credential’s last-used information when reviewing its latest use. For tool outcomes and latency, see MCP usage and audit. For agent execution details, open the corresponding trace. If the page reports Audit log unavailable, check the selected organization and your access before retrying. An empty result is meaningful only after the request succeeds.