The audit log

The audit log records administrative actions in the workspace: who did them, what they touched, and what changed. It lives at Settings, Audit log and is admin only.

What is recorded

Actions are named <area>.<thing>.<verb>. The ones written today include:

• Members and invitations: workspace.member.updated, workspace.member.removed, workspace.invitation.issued, workspace.invitation.resent, workspace.invitation.revoked, workspace.invitation.accepted, workspace.realm_user.created, and the two MCP access actions.
• Credentials: api_key.created, api_key.revoked, api_key.deleted.
• Security: security.allowlist.updated, session.revoked.
• Helpdesk: ticket.updated, helpdesk.team.deleted.
• Integrations and agents: integration.connected, integration.disconnected, and the agent lifecycle actions.

Each entry carries the actor, the actor type, the action, the target type and id, a metadata blob and the time it happened.

Reading it

Entries are newest first. Filters combine with AND:

Paging is by limit and offset. The default page is 100 entries and the maximum is 500.

Diffs

Each entry can carry a before and an after payload. They are left out of the list by default because they are large, so the list stays quick. Open a single entry to get its full diff.

What the log is not

It is not a complete record of everything that happens to a ticket. Ticket work has its own timeline on the ticket itself: replies, notes, status changes, assignments, tag changes, merges, SLA breaches, CSAT requests and time logs are all there, with who did each one. The audit log is the workspace-administration view.

Entries are never edited or removed through this API. There is no delete and no export button in the product today. To pull the log out, read GET /v1/workspace/audit-events and page through it. See the API reference.

Next

• Security
• Members and roles
• API keys