Skip to main content
The audit log records every security-relevant action in your organization. It is append-only: entries cannot be edited or deleted, and they leave the log only through retention or when the organization is deleted. On the Business plan and above you can export it, from the console as CSV or through the API.

​
Download CSV from the console

Open Settings > Audit log. The filter strip above the table sets which entries the file holds:
  • From: entries at or after this date (UTC), included.
  • Before: entries before this date (UTC), not included.
  • Action: an exact action (page.created) or a prefix ending in . (page.).
Select Apply. The table and the count next to the button show the same entries the file will hold, for example “84 entries match”. Then select Export CSV. The file follows the same rules as the API’s since, until and action parameters, and an invalid filter is refused instead of exporting the whole log. The table’s other filters (target, actor, IP) do not apply to the file. Entries come newest first. A file holds at most 100,000 rows. When more entries match, the button reads Export newest 100,000 as CSV, the file holds the newest 100,000, and its name ends in -first-100000.csv. To export the rest, split the export into smaller date ranges with From and Before, or read the full log through the API. Each download is itself recorded in the audit log as audit_log.exported. The CSV has these columns: id, created_at, actor_type, actor_user_id, actor_email, action, target_type, target_id, ip, user_agent, metadata (JSON). Cells that start with =, +, - or @ are prefixed with ', so a spreadsheet never runs them as a formula.

​
Read it through the API

Create an API key with the read:audit scope under Settings > API keys, then call GET /audit-log. From an MCP client, the tool is listAuditLog.
Entries come newest first. Each response has items and next_cursor. Keep requesting with cursor set to next_cursor until it is null:

​
Retention

Longer retention on Business and Enterprise is rolling out. Until it is enabled for your organization, entries are kept for 90 days on every plan.
When a plan change shortens retention, older entries are kept for another 30 days before they are removed. Export what you need to keep before then.