Skip to main content
Track and review all administrative and operational activities across AI for Work.

​
Overview

The Audit Log system records every administrative and user action on the platform, creating a tamper-resistant trail that supports security, compliance, and troubleshooting. audit log home Logs are captured in three locations, each scoped to a different level of the platform:
LocationWhat it tracksWho can access
Admin HubPlatform-wide configuration changes — user management, security settings, assistant config, workspace managementFull admins (all logs); custom admins (modules they manage)
WorkspaceTeam-level activity — collaborator changes, permission updates, workspace configuration, resource allocationWorkspace administrators
AgentAgent-level activity — creation, modification, publishing status, integrationsUsers with edit access or ownership of the agent

​
Log Entry Details

Every log entry captures the following fields: audit log details
FieldDescription
UserFull name and email address of the person who performed the action
ModuleThe functional area where the activity occurred (e.g., User Management, Security, or a specific agent page)
ActivityA concise description of the action and its impact
TimestampExact date and time of the activity in a consistent format

​
Filtering

Use the built-in filters to narrow log results for investigation or review. audit log filters
FilterDescription
Date RangeLimit results to a specific time period
UserShow activity from a specific individual
Module / Sub-moduleFocus on a functional area; the filter adapts dynamically based on the current log context

​
Export

Export filtered logs for compliance reporting, investigations, or record-keeping. audit log download
  • Click Export to download the current filtered view as a CSV file.
  • All data fields and relationships are preserved in the export.

​
System Integrity

The Audit Log system is built with the following guarantees:
PropertyDescription
Real-time loggingActions are recorded instantly when performed
Consistent formatLog entries use the same structure across all three locations
Complete coverageNo entries are missing or duplicated
Tamper resistanceAll logs are read-only and cannot be modified

​
Audit Log API

Use the Audit Log API to retrieve log data programmatically for custom reporting, SIEM integration, or compliance workflows.
PropertyValue
MethodGET
Endpointhttps://{{host}}/api/public/auditlogs
Content-Typeapplication/json
Authorizationauth: {{Admin's Personalkey}}

​
Query Parameters

All parameters are optional unless your use case requires scoping. Combine them to narrow results.
ParameterDescriptionExample
entityType of resource to filter byentity=usergroups
entityIdUnique ID of a specific resource instanceentityId=12345
userIdFilter by the user who performed the actionuserId=john_doe
emailIdFilter by the email address of the acting useremailId=john.doe@example.com
startTime / endTimeTime window for the query (ISO 8601 format)startTime=2024-12-01T00:00:00Z&endTime=2024-12-05T23:59:59Z
actionType of action: create, update, or deleteaction=create

​
Supported Entities and Actions

Entityentity KeySupported Actions
User Groupusergroupcreate, update, delete
AgentAgentcreate, update, delete
Rolerolecreate, update, delete
SSO Statusssostatusupdate
Service Accountserviceaccountcreate, update, delete
LLM Integrationsllmintegrationscreate, update, delete
Domainsdomainscreate, update, delete
Rate Limitsratelimitsupdate
Email Notification Preferencesemailnotificationpreferencesupdate
Business Rulesnlprulescreate, update, delete
User Enrollmentuserenrollmentupdate

​
Sample Request

curl --location 'https://{{host}}/api/public/auditlogs?startTime=2024-12-01T23%3A59%3A59Z&endTime=2024-12-12T23%3A59%3A59Z&entity=nlprules&action=update&emailId=test.user%40example.com' \
--header 'auth: {{Admin's Personalkey}}'

​
Sample Response

{
  "logs": [
    {
      "parentIds": [],
      "_id": "67584fc8a16721a7bb876d3b",
      "entity": "nlprules",
      "action": "update",
      "userId": "u-6fd26567-2b99-5265-9b69-54fba448d26f",
      "accountId": "ac-a16b8603-4c4d-57b7-a6e2-ddf53fee4efb",
      "entityId": "66a389b40e9b336c5e6edb19",
      "delta": {
        "from": {},
        "to": {
          "name": "Answer rule - 67"
        }
      },
      "htmlText": "Update business rule <b>Answer rule - 67</b>",
      "userName": "John Doe",
      "emailId": "john.doe@example.com",
      "keywords": "",
      "cOn": "2024-12-10T14:27:20.286Z",
      "__v": 0
    }
  ]
}