The audit log is a record of what happened in your organization and its teams: who changed a setting, added a domain, set up single sign-on, made a key or asked a question, and when. You can filter it, export it for your security team, choose how long it's kept and stop events being deleted while you need them.
We're rolling the audit log out to organizations gradually. If you don't see Audit log in Settings, then Organization, it isn't on for your organization yet and you see the shorter Activity list instead. Contact us if you'd like it.
Who can see it
Only owners and admins of one of the organization's teams can open the audit log, signed in on the website. Members never see it. Where your organization has service accounts, an admin's API key or connected app with the audit:read scope can read and export it too, and so can a service account with that scope.
Changing how long events are kept, placing a legal hold and releasing one need a fresh check that it's you. Choose Confirm it's you when asked. The check lasts 10 minutes.
What's recorded
- Your organization: renaming it, domains added, verified, failing or removed, policy changes and people joining through auto-join.
- Single sign-on: setting it up and changing it, tests, turning it on, off, required or not required, accounts linked, sessions it ended, and break-glass owners added, removed or used. See Single sign-on for your organization.
- Provisioning and security policies: SCIM tokens made, replaced and revoked, roles by group, people your identity provider added, changed, turned off or removed, and each step of ending their access, security policy changes, sessions an admin ended and new team owners. See Provisioning and security policies.
- Each team: questions asked and canceled, credits bought, API keys made and revoked, people invited, joining, leaving or changing role, monthly limits and connected apps.
- The audit log itself: exports, retention changes, events deleted by retention, and legal holds placed or released.
Each event says who did it: a person, a person's API key or connected app, a service account, 50heads itself (such as the daily domain check), or your identity provider through SCIM. That includes each team's events: when your identity provider adds someone to a team or removes them, the team's event says SCIM, not 50heads. Changes made in Settings, then Organization, and changes to a team's people (invitations, roles, limits, removals) also record the address they came from. Older events don't have one.
Events can't be changed. They're deleted only when they're older than your retention period, and never while a legal hold keeps them.
What's never recorded
- Secrets: passwords, SCIM tokens, single sign-on client secrets, API keys, sign-in links and tickets, and one-time codes. If one ever reached an event, it would be removed before it's stored and again before it's shown.
- Anything that identifies the people who answer your questions. The log shows what your team asked, never who answered.
Filter the log
Choose From and To dates, a Person, a Type and a Team, then Show events. Person lists everyone in your organization's teams, the same people as People, not only the team you're using. The list shows 50 events at a time, newest first. Show older goes further back. Clear filters shows everything again.
Types group related events: organization and policies, domains, people, single sign-on, provisioning (SCIM), questions, credits, keys and connections, and the audit log itself.
Export it
Export JSONL and Export CSV download the events that match your filters, oldest first, up to 1,000,000 events in a file. Every export is itself recorded in the log.
- JSONL has one event per line, as a JSON object. It suits a SIEM or a script.
- CSV has one row per event and opens in a spreadsheet.
| CSV column | What it holds |
|---|---|
id |
The event's own reference |
at |
When it happened, in UTC |
organization_id |
Your organization |
workspace_id |
The team it happened in, or empty for organization-wide events |
source |
organization or workspace (a team's own log) |
actor_type |
person, system (50heads), scim, api_key (a person's key), oauth (a person's connected app) or service_account |
actor_id |
The person's 50heads reference, or the service account's, when there is one |
actor_name |
Their name or email address |
action |
What happened, such as domain.verified or sso.enforced |
subject |
What it happened to: a domain, an email address, a key's name |
data |
Details, as JSON |
ip |
The address the change came from, when recorded |
A spreadsheet can treat a cell that starts with =, +, - or @ as a formula. So that no event can run anything, those cells start with a single quote (') in the CSV. The JSONL file keeps the text exactly as it was.
How long events are kept
Events are kept for six years unless you change it. You can choose 1 year, 2 years, 6 years or 10 years, or any number of days in between. The shortest is one year (365 days) and the longest is ten years (3,650 days).
- Until you choose a period, it covers the organization's own events. Once you choose one, it covers each team's events too.
- A clean-up runs once a day. It deletes events older than your period, except what a legal hold keeps.
- If you shorten the period, we tell you which events will go and ask before saving. They're deleted in the next daily clean-up, within a day, and can't be brought back.
- Each clean-up that deletes something adds an event saying how many it deleted.
Shortening the period never touches anything we must keep to pay people who answer or to look into fraud.
Legal holds
A legal hold stops events being deleted, whatever your retention period, until you release it. Use one when you must keep records for a legal matter or an investigation.
- Under Legal holds, choose Place a legal hold.
- Give a reason, such as a matter reference. Every admin who can see the audit log can read it.
- Choose what to keep: Everything, Chosen teams or Chosen people. You can choose anyone in your organization's teams.
- Choose Place hold.
A hold on chosen teams keeps the events in those teams. Organization-wide events, such as domain changes, are kept by Everything or by a hold on the person who made them. You can have up to 50 active holds. Release ends a hold; events it kept are deleted in the next daily clean-up if they're past your retention period. Released holds stay in the list.