Audit logs
What the AI CodeOps audit log records, how to read and filter it under Measure → Audit Log, who can see it, and how long entries are kept on each plan.
The audit log records who changed what in a workspace: members and roles, keys, providers, policies, agents, schedules, budgets, secrets, approvals and the code AI sessions generate. Each entry has a time, the account that acted, the target, the IP address and a short description.
What is recorded
| Area | Actions |
|---|---|
| Members and roles | member.invited, member.removed, role.changed |
| API keys | apikey.created, apikey.revoked, apikey.scope.updated, apikey.scope.removed |
| Model providers | provider.credential.added, provider.credential.removed |
| Policies and budgets | policy.updated, budget.updated |
| Secrets | secret.created, secret.updated, secret.toggled, secret.deleted |
| Approvals | approval.decided, approval.canceled |
| Agents and tools | agent.created, agent.updated, agent.deleted, mcp_server.created, mcp_server.updated, mcp_server.deleted |
| Marketplace | marketplace.installed, marketplace.uninstalled |
| Schedules | schedule.created, schedule.updated, schedule.deleted |
| Generated code | session.code.edited, session.code.created, session.code.deleted |
| Sessions | session.canceled (with the reason given) |
| Deployments | deployment.recorded, deployment.status_changed, deploy_target.updated |
| Evidence and sharing | change.evidence_exported, workspace.share_enabled, workspace.share_disabled |
| Workspace | workspace.updated |
session.code.* entries record edits a person makes to the code a session generated, before it becomes a pull request.
Sign-ins, two-factor changes and SSO configuration are recorded too, but against the account or organization rather than a workspace. They don't appear on a workspace's Audit Log page, and they are kept for 7 days on every plan.
Read the audit log
- Open Measure → Audit Log.
- To narrow it down, pick an action under Action. The list offers only actions this workspace has recorded. All actions shows everything.
- Use ← Prev and Next → to page through, 50 entries at a time.
Each row shows When, Action, Account, Target, IP and Detail. Account is the account ID of the person who acted.
For a broader view of what happened in the workspace, including sessions and deployments, follow the Activity feed → link at the top of the page.
Who can read it
Reading the audit log needs the audit-read permission. Owners, admins and security admins have it; developers, members and viewers don't. A custom role can include it. Without it, the page says so and asks you to contact a workspace admin. See Roles and permissions.
Retention
How long entries are kept depends on your organization's plan:
| Plan | Kept for |
|---|---|
| Free | 7 days |
| Pro | 90 days |
| Enterprise | As long as the organization exists |
Older entries are deleted once a day. The same windows apply to the policy decisions shown under Secure → Policies.
- Entries of a deleted workspace are deleted after 7 days.
- Sign-in, two-factor and other account-level entries are kept for 7 days on every plan.
More in Data retention.
Exporting
There is no audit export in the open beta. To keep a record outside AI CodeOps:
- Evidence packs give you a signed record of a single change, including its review and approval.
- Your account data export, under Configure → Settings → Your data, includes your own audit events.
Next steps
Frequently asked questions
Can I export the audit log?
Not yet. There is no export button in the open beta. Your own audit events are included in your account data export.
Who can read the audit log?
Owners, admins and security admins, or any custom role with the audit-read permission.
How long are audit entries kept?
Workspace entries are kept 7 days on Free, 90 days on Pro, and for as long as the organization exists on Enterprise. Account and SSO entries are kept 7 days on every plan.