Skip to main content

Audit logs: see who changed what (and filter or export them)

What the audit log records, how long it is kept, how to search and filter it, and the newer person/date filters and spreadsheet export.

Written by Liam Radford

The audit log is a record of who changed what, and when in your workspace. Open Settings > Audit logs (you need View audit logs).

What it records

Changes such as: documents created, updated or deleted, session changes, wall posts, containers, logbook entries (create, redact, delete), policy actions, notices approved or denied, activity adjustments and quotas, recommendations, Discord integration changes, ownership transfers, role and permission changes (it names each permission added or removed), user additions and removals, and API key creation and deletion (never the key itself).

Each entry has the action, the person who did it, what it was about and the time. Choose an entry to expand its details.

How long it is kept

Entries are kept for 30 days. Older entries are removed. If you need a longer record, export regularly (newer settings) or use a Discord webhook to copy the audit log to a channel (see "Post workspace activity to a Discord channel (Discord integration and webhooks)").

Find an entry

  • Search the box at the top.

  • Filter by action from the action list (it also lets you search for an action).

  • Move through pages at the bottom.

Newer: filter by person and date, and export

Workspaces with the newer settings tools can also:

  • Filter by person (type a user ID, or part of a username of someone in your workspace),

  • Filter by date range (from and to, up to 400 days),

  • Export the entries that match, as a spreadsheet (the newest 5,000). The export is itself recorded in the log ("Audit Log Export"). Cells that a spreadsheet could treat as a formula are made plain text.

If you type something that is not a valid date you are told how to write it (year-month-day, such as 2026-11-28).

Who sees it

Only people with View audit logs. Everything everyone has done is in it, including other admins, so give this permission carefully.

Related articles

  • Permission reference (4 of 4): workspace settings and administration

  • Post workspace activity to a Discord channel (Discord integration and webhooks)

  • Settings map: where everything is and who can open it

Did this answer your question?