Observer Docs

Security-relevant changes in the console are recorded in an audit log scoped to the organization. Open it from Settings > Audit log. The log is append-only: entries cannot be edited or deleted.

Categories

Each action starts with a prefix that names the area it belongs to.

Prefix	Surface
`agent.*`	Agent create, key rotation, revoke, delete, and snooze.
`page.*`	Status page access changes, settings, theme and layout changes, custom CSS, custom domain state, imports, and delete through the API.
`metric.*`	Metric definition create, update, delete, and snooze; status changes (`metric.status.flip`); manual status writes (`metric.status.set_manually`); heartbeat URL rotation.
`slo.*`	SLO create, update, delete, publish, exclusion windows, and manual evaluation.
`customer.*`	Customer create, update, delete, page access grants, access links, SLO overrides, and SLA terms and statements.
`incident.*`	Incident create, update, message, resolve, delete, and the auto-incident draft, publish, and dismiss actions; classification (`incident.classified`) and evidence exports (`incident.evidence_exported`, with the export’s digest).
`maintenance.*`	Maintenance create, publish, update, start, complete, and cancel.
`notification.*`	Alert destination create, update, delete, and test (`notification.integration_`); delivery redelivery (`notification.redelivered`); inbound sources, their rules and secrets (`notification.intake_`).
`org.*`	Organization rename, report schedules, deletion requests, plan subscription changes (`org.subscription.*`), and turning AI assist off or on (`org.ai_assist_disabled`, `org.ai_assist_enabled`).
`member.*`	Invitations sent and revoked (`member.invited`, `member.invite_revoked`), members removed by an admin (`member.removed`), a member leaving (`member.left`), and role changes (`member.role_changed`).
`service.*`	Service delete through the API, and metrics added to or removed from a service.
`subscriber.*`	Status page subscribers removed by an admin (`subscriber.admin_revoked`).
`change_source.*`	Change source create and delete.
`api_key.*`	Org API key create and revoke.
`oauth.*`	MCP OAuth approvals (`oauth.consent_approved`, `oauth.grant_created`).
`audit_log.*`	Audit log exports (`audit_log.exported`).
`report.*`	Uptime and incident report downloads (`report.downloaded`).
`support_*`	Support access grants and support requests.

Page access changes

Changing who can view a status page records page.access_changed. The metadata.mode field holds the new access mode: public, password, sso (Google, Microsoft or OIDC sign-in), ip_allowlist, jwt, or customer_scoped. The audit log shows it as “Set access mode on page to mode”.

Event shape

Each row carries:

id: opaque identifier.
org_id: the organization the event scopes to.
actor_type and actor_user_id: who performed the action (a user, an agent, or the system).
action: dotted action string (for example agent.rotate, slo.updated).
target_type and target_id: the resource the action affected.
metadata: action-specific JSON payload.
ip and user_agent: the request’s client address and browser, when available.
created_at: timestamp.

Filtering

Filter by action, target type, actor, and IP address.

Export

On the Business plan and above, export the log as CSV or read it through the API. See Export the audit log.

Retention

Audit log entries are kept for 90 days, then deleted. Longer retention on Business and Enterprise is rolling out; see Export the audit log.

Quickstart

Concepts

Guides

Notifications

MCP server

CLI

Reference

Troubleshooting

Audit log events

Categories

Page access changes

Event shape

Filtering

Export

Retention

​Categories

​Page access changes

​Event shape

​Filtering

​Export

​Retention

Categories

Page access changes

Event shape

Filtering

Export

Retention