Audit Log

The Audit page (/audit) records every consequential action in your organization — who did it, what changed, and when. It's your accountability trail for security reviews and compliance.

What's logged

Audit events span the actions that matter for governance:

• API keys — create, update, rotate, delete
• Members — invite, accept, role change, remove
• Teams — create, update, delete
• Organization — deletion
• Budgets — create and changes
• Guardrails — update, delete
• Plan tier — changes
• Settings — router settings, data policy
• Profile — updates and password changes

Reading an event

Each row shows:

Open an event to see a field-level diff — unchanged values are dimmed and changed values are highlighted, so you can see exactly what moved.

Filtering and export

Filter by action category (API Keys, Members, Teams, Organization, Budgets, Guardrails, Plan, Settings, Data Policy, Profile, Password) and by date range. Export the trail to CSV for offline review.

Forwarding to a SIEM

For continuous monitoring, you can register a Splunk HEC, Datadog Events API, or generic-webhook destination (owner/admin only). This is currently in beta: configured destinations today receive privileged-access events only — full org audit-trail streaming is still in development, so don't rely on it as your complete audit feed yet. In the meantime, scheduled CSV/JSON exports are the reliable way to get the full trail into an external system.

Next steps

• Team Management — The member and role actions audited here
• Settings — The settings changes that generate audit events
• API Key Management — Key lifecycle events appear in the audit log

FAQ

Who in my organization can view the audit log?

Only organization owners and admins can open the Audit page. Members and viewers don't have access — the audit trail is treated as sensitive compliance data, so the same owner/admin gate applies to viewing, exporting, and configuring SIEM forwarding.

What actions actually get recorded?

Consequential, governance-relevant changes: API key lifecycle (create, update, rotate, delete), member actions (invite, accept, role change, remove), team create/update/delete, organization deletion, budget create/change, guardrail update/delete, plan tier changes, router and data-policy settings, and profile updates including password changes. Routine read-only activity isn't audited.

Can I see exactly what changed in an event?

Yes. Open any event to see a field-level diff — unchanged values are dimmed and changed values are highlighted, so you can see precisely what moved from before to after. Each row also shows the timestamp, action, actor, and affected resource.

Can I edit or delete entries to clean up the trail?

No, and that's by design. The audit trail is append-only — entries are written by the system and cannot be modified or removed from the dashboard, which is what makes it a trustworthy accountability record for security and compliance reviews.

How long are audit events retained?

Audit events are retained for 18 months, then purged automatically — a window sized to cover a SOC 2 Type II audit period plus a buffer. The retention window is shown as a chip on the Audit page. Custom retention windows aren't configurable today.

Can I export the audit trail?

Yes. Owners and admins can export to CSV (JSON is also supported) for offline review or to hand to an auditor. The export honors whatever action-category and date-range filters you've applied, so you can scope it down before downloading.

How do I narrow the log down to what I'm looking for?

Filter by action category — API Keys, Members, Teams, Organization, Budgets, Guardrails, Plan, Settings, Data Policy, Profile, or Password — and by date range. Combine a category with a date range to isolate, say, all key changes in the last week.

Can I stream audit events into my SIEM?

This is currently in beta. You can configure a Splunk HEC, Datadog Events API, or generic-webhook destination (owner/admin only), but configured destinations today receive privileged-access events only — full org audit-trail streaming is still in development, so don't rely on it as your complete audit feed yet. In the meantime, scheduled CSV/JSON exports are the reliable way to get the full trail into an external system.

Does the audit log affect my bill, budgets, or rate limits?

No. The audit log is part of the platform for every plan tier — recording, viewing, and exporting audit events don't consume credits, don't count against your budgets, and don't touch your RPM/TPM limits. It does record budget and plan-tier changes, but the logging itself has no cost.

Does the audit log capture the prompts and responses of my LLM calls?

No — the audit log tracks configuration and governance actions (who changed what in your org), not the content of your inference traffic. For request-level details like model, status, and token usage, use the Request Logs surface, and control how much request content is retained through your data policy settings.