# Audit logs

> What the AI CodeOps audit log records, how to read and filter it under Measure → Audit Log, who can see it, and how long entries are kept on each plan.

Source: https://aicodeops.dev/docs/audit-logs · Last updated: 2026-10-18

The audit log records who changed what in a workspace: members and roles, keys, providers, policies, agents, schedules, budgets, secrets, approvals and the code AI sessions generate. Each entry has a time, the account that acted, the target, the IP address and a short description.

## What is recorded

| Area                 | Actions                                                                                                             |
| -------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Members and roles    | `member.invited`, `member.removed`, `role.changed`                                                                  |
| API keys             | `apikey.created`, `apikey.revoked`, `apikey.scope.updated`, `apikey.scope.removed`                                  |
| Model providers      | `provider.credential.added`, `provider.credential.removed`                                                          |
| Policies and budgets | `policy.updated`, `budget.updated`                                                                                  |
| Secrets              | `secret.created`, `secret.updated`, `secret.toggled`, `secret.deleted`                                              |
| Approvals            | `approval.decided`, `approval.canceled`                                                                             |
| Agents and tools     | `agent.created`, `agent.updated`, `agent.deleted`, `mcp_server.created`, `mcp_server.updated`, `mcp_server.deleted` |
| Marketplace          | `marketplace.installed`, `marketplace.uninstalled`                                                                  |
| Schedules            | `schedule.created`, `schedule.updated`, `schedule.deleted`                                                          |
| Generated code       | `session.code.edited`, `session.code.created`, `session.code.deleted`                                               |
| Sessions             | `session.canceled` (with the reason given)                                                                          |
| Deployments          | `deployment.recorded`, `deployment.status_changed`, `deploy_target.updated`                                         |
| Evidence and sharing | `change.evidence_exported`, `workspace.share_enabled`, `workspace.share_disabled`                                   |
| Workspace            | `workspace.updated`                                                                                                 |

`session.code.*` entries record edits a person makes to the code a session generated, before it becomes a pull request.

Sign-ins, two-factor changes and SSO configuration are recorded too, but against the account or organization rather than a workspace. They don't appear on a workspace's Audit Log page, and they are kept for 7 days on every plan.

## Read the audit log

1. Open **Measure → Audit Log**.
2. To narrow it down, pick an action under **Action**. The list offers only actions this workspace has recorded. **All actions** shows everything.
3. Use **← Prev** and **Next →** to page through, 50 entries at a time.

Each row shows **When**, **Action**, **Account**, **Target**, **IP** and **Detail**. **Account** is the account ID of the person who acted.

For a broader view of what happened in the workspace, including sessions and deployments, follow the **Activity feed →** link at the top of the page.

## Who can read it

Reading the audit log needs the audit-read permission. Owners, admins and security admins have it; developers, members and viewers don't. A custom role can include it. Without it, the page says so and asks you to contact a workspace admin. See [Roles and permissions](https://aicodeops.dev/docs/roles-and-permissions).

## Retention

How long entries are kept depends on your organization's plan:

| Plan       | Kept for                           |
| ---------- | ---------------------------------- |
| Free       | 7 days                             |
| Pro        | 90 days                            |
| Enterprise | As long as the organization exists |

Older entries are deleted once a day. The same windows apply to the policy decisions shown under **Secure → Policies**.

- Entries of a deleted workspace are deleted after 7 days.
- Sign-in, two-factor and other account-level entries are kept for 7 days on every plan.

More in [Data retention](https://aicodeops.dev/docs/data-retention).

## Exporting

There is no audit export in the open beta. To keep a record outside AI CodeOps:

- [Evidence packs](https://aicodeops.dev/docs/evidence-packs) give you a signed record of a single change, including its review and approval.
- Your account data export, under **Configure → Settings → Your data**, includes your own audit events.

## Next steps

- [Roles and permissions](https://aicodeops.dev/docs/roles-and-permissions)
- [Data retention](https://aicodeops.dev/docs/data-retention)
- [Audit and RBAC](https://aicodeops.dev/product/audit-rbac)

## Frequently asked questions

### Can I export the audit log?

Not yet. There is no export button in the open beta. Your own audit events are included in your account data export.

### Who can read the audit log?

Owners, admins and security admins, or any custom role with the audit-read permission.

### How long are audit entries kept?

Workspace entries are kept 7 days on Free, 90 days on Pro, and for as long as the organization exists on Enterprise. Account and SSO entries are kept 7 days on every plan.