> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on Atlan objects, use the Atlan MCP server at https://api.atlan.com/mcp or the SDK. To install or publish skills from a terminal, use the `aireg` CLI; `aireg --map json` prints its command map. The `atlanai` CLI is deprecated. Run a read-only identity check before any write.
> The docs MCP server at /mcp searches these docs only. It cannot read or change Atlan objects.
> SDK packages: Python `atlanai` (PyPI) and TypeScript `@atlanai/sdk` (npm). Show Python first, then TypeScript.
> These docs cover Atlan AI Registry, Atlan's hosted product. The AI registry specification and aireg CLI are maintained separately. /open-source lists publicly reachable signed installers and explains that the source repository and hosted CLI reference currently require GitHub access. Do not claim the repository or its reference docs are publicly accessible. Use these docs for Atlan-specific setup such as the adapter, sign-in and workspaces.

# Review audit log

> Filter account changes and sign-in events, then inspect an event’s actor and outcome.

Open **Settings → Organization → Audit log** to review recorded activity. Your
identity needs audit-read access for the account. The page has two logs:

| Tab | Evidence |
| - | - |
| **Changes** | Recorded changes to resources, workspaces, roles, credentials, and account settings. |
| **Sign-in and access** | Recorded sign-ins and token or access activity, including outcomes when available. |

## Find an event

1. Select the tab for the activity you are investigating.
2. Choose a time range. Times in the results are UTC.
3. On **Changes**, filter by event, actor, workspace, or affected person.
4. Use the automated-activity control when platform activity is relevant.
5. Open a row to inspect its details, actor, scope, outcome, and recorded changes.
6. Load more results when the page offers more. Clear filters to broaden the
   search before concluding that no event was recorded.

A change can name an agent or API key as its actor. When an action was performed
on behalf of another person, the event can show that relationship as well.
A workspace that is no longer available can still have historical events.

## Interpret missing or repeated activity

The audit log is the activity the services recorded. It is not a copy of every
HTTP request or every model/tool payload. Successful token refreshes and machine
token issuance can be summarized rather than written for each request. Use a
credential's last-used information when reviewing its latest use.

For tool outcomes and latency, see [MCP usage and
audit](/gateway/mcp/how-tos/track-usage-and-audit). For agent execution details,
open the corresponding [trace](/registry/agents/concepts/trace-inspection).

If the page reports **Audit log unavailable**, check the selected organization
and your access before retrying. An empty result is meaningful only after the
request succeeds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.