Audit log

Every meaningful action in a workspace is recorded: who did it, what they did, to what, from which address, and when. Settings → Audit log shows the most recent entries.

What is recorded

Sign-ins and security changes, member and role changes, invitations, billing actions, API key creation and revocation, file uploads and deletions, webhook and role configuration, SSO and SCIM activity, policy changes, and data export or deletion requests.

Entries are append-only. Nobody, including owners, can edit or delete them from the interface.

Exporting

Pick a date range and choose Export CSV. The file has one row per entry with UTC timestamps and the actor's email resolved, and it streams, so a year of history downloads without trouble. Exports are themselves recorded in the log.

Streaming to your own tools

Two ways, depending on what you need.

Per event, with signatures. Subscribe a webhook endpoint to audit.recorded and every entry arrives as it happens, signed like any other webhook, with retries and redelivery.

Batched, to a collector. Under Stream to a collector on the audit page, set a URL and an Authorization header. Every five minutes new entries are POSTed as newline-delimited JSON. Splunk HEC, Datadog, Elastic and most SIEMs accept this shape directly:

https://http-inputs.example.splunkcloud.com/services/collector/raw
Authorization: Splunk 00000000-0000-0000-0000-000000000000

Delivery resumes from the last acknowledged entry, so a collector that is down for an hour catches up rather than losing events. The page has Send test to check credentials and Push now to flush without waiting.

The cursor starts when you add the collector: history is not replayed. Use the CSV export for what came before.

Retention

Entries are kept for as long as the deployment's retention setting says. If you need a longer record than that, stream to a collector you control.