> ## Documentation Index
> Fetch the complete documentation index at: https://docs.use.observer/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log events

> Categories of administrative events recorded in the audit log.

Security-relevant changes in the console are recorded in an audit log scoped
to the organization. Open it from **Settings** > **Audit log**. The log is
append-only: entries cannot be edited or deleted.

## Categories

Each action starts with a prefix that names the area it belongs to.

| Prefix | Surface |
| - | - |
| `agent.*` | Agent create, key rotation, revoke, delete, and snooze. |
| `page.*` | Status page access changes, settings, theme and layout changes, custom CSS, custom domain state, imports, and delete through the API. |
| `metric.*` | Metric definition create, update, delete, and snooze; status changes (`metric.status.flip`); manual status writes (`metric.status.set_manually`); heartbeat URL rotation. |
| `slo.*` | SLO create, update, delete, publish, exclusion windows, and manual evaluation. |
| `customer.*` | Customer create, update, delete, page access grants, access links, SLO overrides, and SLA terms and statements. |
| `incident.*` | Incident create, update, message, resolve, delete, and the auto-incident draft, publish, and dismiss actions; classification (`incident.classified`) and evidence exports (`incident.evidence_exported`, with the export's digest). |
| `maintenance.*` | Maintenance create, publish, update, start, complete, and cancel. |
| `notification.*` | Alert destination create, update, delete, and test (`notification.integration_*`); delivery redelivery (`notification.redelivered`); inbound sources, their rules and secrets (`notification.intake_*`). |
| `org.*` | Organization rename, report schedules, deletion requests, plan subscription changes (`org.subscription.*`), and turning AI assist off or on (`org.ai_assist_disabled`, `org.ai_assist_enabled`). |
| `member.*` | Invitations sent and revoked (`member.invited`, `member.invite_revoked`), members removed by an admin (`member.removed`), a member leaving (`member.left`), and role changes (`member.role_changed`). |
| `service.*` | Service delete through the API, and metrics added to or removed from a service. |
| `subscriber.*` | Status page subscribers removed by an admin (`subscriber.admin_revoked`). |
| `change_source.*` | Change source create and delete. |
| `api_key.*` | Org API key create and revoke. |
| `oauth.*` | MCP OAuth approvals (`oauth.consent_approved`, `oauth.grant_created`). |
| `audit_log.*` | Audit log exports (`audit_log.exported`). |
| `report.*` | Uptime and incident report downloads (`report.downloaded`). |
| `support_*` | Support access grants and support requests. |

### Page access changes

Changing who can view a status page records `page.access_changed`. The
`metadata.mode` field holds the new access mode: `public`, `password`,
`sso` (Google, Microsoft or OIDC sign-in), `ip_allowlist`, `jwt`, or
`customer_scoped`. The audit log shows it as "Set access mode on
*page* to *mode*".

## Event shape

Each row carries:

* `id`: opaque identifier.
* `org_id`: the organization the event scopes to.
* `actor_type` and `actor_user_id`: who performed the action (a user, an
  agent, or the system).
* `action`: dotted action string (for example `agent.rotate`,
  `slo.updated`).
* `target_type` and `target_id`: the resource the action affected.
* `metadata`: action-specific JSON payload.
* `ip` and `user_agent`: the request's client address and browser, when
  available.
* `created_at`: timestamp.

## Filtering

Filter by action, target type, actor, and IP address.

## Export

On the Business plan and above, export the log as CSV or read it through
the API. See [Export the audit log](https://docs.use.observer/docs/guides/audit-log-export.md).

## Retention

Audit log entries are kept for 90 days, then deleted. Longer retention on
Business and Enterprise is rolling out; see
[Export the audit log](https://docs.use.observer/docs/guides/audit-log-export.md#retention).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.