Audit Log

Review a record of every action performed across your organization.

Overview

The audit log is an organization-wide record of the actions people and automations perform in Kognitos. Every entry captures what happened, who did it, where it happened, and when. Entries are read-only: once an action is recorded, it is never changed or removed.

Use the audit log to answer questions such as who published an automation, who updated the credentials on a connection, who resolved an exception, or who removed a user from a workspace. You can also export the log as a CSV file to attach to a security review or hand to an auditor.

To open it, click your name or profile avatar in the bottom-left corner to open the user menu, then select Audit log.

What the Audit Log Records

Events are grouped into categories. The table below lists each category with examples of the actions it covers.

Category	Example Events
Organization and workspace administration	Organization updated; workspace created, updated, or deleted; user invited; invite accepted or revoked; user removed from a workspace; role assigned, changed, or removed
Authentication and security	API key created, API key revoked
Automation lifecycle	Automation created, renamed, duplicated or forked, deleted, activated, or deactivated; draft updated
Automation definition changes	Automation outputs changed
Versioning and publishing	Version created, version restored, publish started, publish succeeded, publish failed
Triggers	Trigger created, enabled, disabled, or deleted; schedule trigger fired
Integrations and connections	Connection created, updated, or removed; credentials updated
Run lifecycle	Run started, paused, resumed, canceled, completed, or re-run
Exceptions and run intervention	Exception raised, classified, assigned, or resolved; retry selected; skip selected; manual value provided
Troubleshooting guide	Guide entry created, approved, deprecated, or deleted; resolution saved from an exception
Approval & governance actions	Guide approval granted, guide approval rejected
Data access & exports	File downloaded, audit log exported

The set of recorded actions grows as the platform grows. If you need an action recorded that you do not see here, contact your Kognitos account team.

Reading the Audit Log

The newest events appear first. Each row shows:

• Event - the action that was recorded, with the specific operation beneath it

• Type - the category the event belongs to

• Actor - who performed the action

• Location - the automation and workspace the event applies to

• Time - when the action happened, in your local time zone

The Actor column shows one of the following:

• The email address of the person who performed the action

• Personal Access Token, when the action came through the REST API using an API key

• Service or System, when the platform performed the action on its own, such as a schedule trigger firing or a run completing

Filtering Events

Use the controls above the table to narrow the log:

• Event type - one or more categories

• Actors - one or more users in your organization

• Location - one or more workspaces

• Date range - a start and end date, both included

Selecting several values in one control matches any of them. Adding a second control narrows the results further. Click Reset to clear every filter.

Move through the log with Previous and Next. Changing a filter returns you to the first page.

Viewing Event Details

Click View details on any row to open the event details panel, which shows:

• Actor - the person or system that performed the action

• Time - when the action happened

• Automation - the automation the event applies to

• Workspace - the workspace the event applies to

• Event type - the category the event belongs to

Events that carry extra context also show a table of metadata keys and values, such as the source that started a run or the reason it was paused. Hover over a row and click the copy icon to copy a value.

Exporting the Audit Log

Export the log as a CSV file when you need evidence for a security review, a compliance audit, or an internal investigation.

1

Narrow the Export

Apply the filters you want. The export includes every event that matches your current filters, not only the page on screen. With no filters applied, it includes the whole log you have access to.

2

Download the File

Click Export. Kognitos prepares the file and your browser downloads it.

The file holds one row per event, with these columns:

event_id, event_time, org_id, workspace_id, category, event_type, action,
actor_user_id, actor_display_name, actor_email, actor_type, actor_pat_id,
resource_name, status, credits_delta, source_service,
before_json, after_json, metadata

Timestamps are written in RFC 3339 format, and the before_json, after_json, and metadata columns hold JSON.

A single export is limited to 100,000 events. If your filters match more than that, the export fails and nothing is downloaded. Narrow the date range and export in batches.

The download link is valid for 15 minutes. Every export is itself recorded in the audit log, so you can always see who took a copy and when.

Who Can See What

Access to the audit log follows your Roles & Permissions. Two people can both open the audit log and see a different set of events:

• Org Admin - every event in the organization, across all workspaces

• Workspace Admin - events in the workspaces they administer, including membership and role changes in those workspaces

• Automation Author - events in their workspaces covering automations, runs, triggers, connections, exceptions, and guides

• Automation Operator and IT / Integrator - no access

Organization-level events that do not belong to a single workspace, such as invitations and role changes made in Organization Settings or API key activity, are visible only to an Org Admin.

If you open the audit log without access, Kognitos tells you that you do not have permission to view it. Ask an Org Admin for a role that includes access.