> For the complete documentation index, see [llms.txt](https://docs.kognitos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kognitos.com/guides/administration/audit-log.md).
# Audit Log
Review a record of every action performed across your organization.
## Overview
The **audit log** is an organization-wide record of the actions people and automations perform in Kognitos. Every entry captures what happened, who did it, where it happened, and when. Entries are read-only: once an action is recorded, it is never changed or removed.
Use the audit log to answer questions such as who published an automation, who updated the credentials on a connection, who resolved an exception, or who removed a user from a workspace. You can also export the log as a CSV file to attach to a security review or hand to an auditor.
To open it, click your name or profile avatar in the bottom-left corner to open the user menu, then select **Audit log**.
## What the Audit Log Records
Events are grouped into categories. The table below lists each category with examples of the actions it covers.
| Category | Example Events |
| ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Organization and workspace administration** | Organization updated; workspace created, updated, or deleted; user invited; invite accepted or revoked; user removed from a workspace; role assigned, changed, or removed |
| **Authentication and security** | API key created, API key revoked |
| **Automation lifecycle** | Automation created, renamed, duplicated or forked, deleted, activated, or deactivated; draft updated |
| **Automation definition changes** | Automation outputs changed |
| **Versioning and publishing** | Version created, version restored, publish started, publish succeeded, publish failed |
| **Triggers** | Trigger created, enabled, disabled, or deleted; schedule trigger fired |
| [**Integrations**](/guides/platform/integrations.md) **and connections** | Connection created, updated, or removed; credentials updated |
| **Run lifecycle** | Run started, paused, resumed, canceled, completed, or re-run |
| **Exceptions and run intervention** | Exception raised, classified, assigned, or resolved; retry selected; skip selected; manual value provided |
| [**Troubleshooting guide**](/guides/platform/automations/troubleshooting-guide.md) | Guide entry created, approved, deprecated, or deleted; resolution saved from an exception |
| **Approval & governance actions** | Guide approval granted, guide approval rejected |
| **Data access & exports** | File downloaded, audit log exported |
{% hint style="info" %}
The set of recorded actions grows as the platform grows. If you need an action recorded that you do not see here, contact your Kognitos account team.
{% endhint %}
## Reading the Audit Log
The newest events appear first. Each row shows:
* **Event** - the action that was recorded, with the specific operation beneath it
* **Type** - the category the event belongs to
* **Actor** - who performed the action
* **Location** - the automation and workspace the event applies to
* **Time** - when the action happened, in your local time zone
The **Actor** column shows one of the following:
* The email address of the person who performed the action
* **Personal Access Token**, when the action came through the REST API using an [API key](/guides/api-reference/api-keys.md)
* **Service** or **System**, when the platform performed the action on its own, such as a schedule trigger firing or a run completing
## Filtering Events
Use the controls above the table to narrow the log:
* **Event type** - one or more categories
* **Actors** - one or more users in your organization
* **Location** - one or more workspaces
* **Date range** - a start and end date, both included
Selecting several values in one control matches any of them. Adding a second control narrows the results further. Click **Reset** to clear every filter.
Move through the log with **Previous** and **Next**. Changing a filter returns you to the first page.
## Viewing Event Details
Click **View details** on any row to open the event details panel, which shows:
* **Actor** - the person or system that performed the action
* **Time** - when the action happened
* **Automation** - the automation the event applies to
* **Workspace** - the workspace the event applies to
* **Event type** - the category the event belongs to
Events that carry extra context also show a table of metadata keys and values, such as the source that started a run or the reason it was paused. Hover over a row and click the copy icon to copy a value.
## Exporting the Audit Log
Export the log as a CSV file when you need evidence for a security review, a compliance audit, or an internal investigation.
{% stepper %}
{% step %}
#### Narrow the Export
Apply the filters you want. The export includes every event that matches your current filters, not only the page on screen. With no filters applied, it includes the whole log you have access to.
{% endstep %}
{% step %}
#### Download the File
Click **Export**. Kognitos prepares the file and your browser downloads it.
{% endstep %}
{% endstepper %}
The file holds one row per event, with these columns:
```
event_id, event_time, org_id, workspace_id, category, event_type, action,
actor_user_id, actor_display_name, actor_email, actor_type, actor_pat_id,
resource_name, status, credits_delta, source_service,
before_json, after_json, metadata
```
Timestamps are written in RFC 3339 format, and the `before_json`, `after_json`, and `metadata` columns hold JSON.
{% hint style="warning" %}
A single export is limited to **100,000 events**. If your filters match more than that, the export fails and nothing is downloaded. Narrow the date range and export in batches.
{% endhint %}
{% hint style="info" %}
The download link is valid for 15 minutes. Every export is itself recorded in the audit log, so you can always see who took a copy and when.
{% endhint %}
## Who Can See What
Access to the audit log follows your [Roles & Permissions](/guides/administration/roles-and-permissions.md). Two people can both open the audit log and see a different set of events:
* **Org Admin** - every event in the organization, across all workspaces
* **Workspace Admin** - events in the workspaces they administer, including membership and role changes in those workspaces
* **Automation Author** - events in their workspaces covering automations, runs, triggers, connections, exceptions, and guides
* **Automation Operator** and **IT / Integrator** - no access
Organization-level events that do not belong to a single workspace, such as invitations and role changes made in [Organization Settings](/guides/administration/user-options/organization-settings.md) or API key activity, are visible only to an Org Admin.
If you open the audit log without access, Kognitos tells you that you do not have permission to view it. Ask an Org Admin for a role that includes access.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.kognitos.com/guides/administration/audit-log.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.