Audit logs

<head> <script type=“application/ld+json”> {{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Who can access audit logs?", "acceptedAnswer": {"@type": "Answer", "text": "Audit logs are available on Enterprise plans and are visible to workspace owners and admins."}}, {"@type": "Question", "name": "How long are audit logs retained?", "acceptedAnswer": {"@type": "Answer", "text": "Audit logs are retained for 13 weeks, or approximately 90 days. Events older than that are automatically removed."}}, {"@type": "Question", "name": "Can I export audit logs?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Click Export in the top right of the audit logs page to download your audit logs as a JSONL file, packaged as audit_logs.jsonl.zip. The export matches your active action, actor, and time range filters, and finished exports stay available for download for 7 days. Export is not available while a resource or client filter is active. If you need to integrate audit logs with a SIEM or external monitoring system, contact your account team to discuss enterprise integration options."}}, {"@type": "Question", "name": "Why don’t I see audit logs?", "acceptedAnswer": {"@type": "Answer", "text": "If audit logs are not available or do not appear as expected: - Confirm your workspace is on an Enterprise plan. - Confirm your role includes permission to view audit logs. You must be a workspace admin or owner. - Clear filters and try a broader time range."}}]}} </script> </head>

Audit logs provide a searchable audit trail of activity in your workspace. They show who performed an action, when it happened, what changed, and which resource was affected.

Use audit logs to review workspace settings and configuration changes, track access updates, and investigate unexpected behavior. Audit logs can also support security and compliance workflows when needed.

• Available on: Enterprise plans
• Access: Workspace admins and owners
• Location: Audit logs (Settings → Security → Audit logs)

Audit log events

Workspace audit logs include events across categories such as:

This table shows common examples. The All actions filter on the audit logs page lists the full set of event types recorded for your workspace.

Audit log table

By default, the page shows logs for All actions, All actors, and the Last 90 days. The total number of matching logs appears in the top right of the table.

The table is organized into four columns:

Click any row to expand it and see structured JSON details describing the event. This includes the metadata associated with that action, such as message IDs for prompt activity or specific fields that were updated in a workspace setting.

Events triggered through the RShift Sites API are also attributed to the access token that made the request. The expanded JSON details include an api_key_id field alongside the acting user, so you can trace which token drove a given change.

Filtering audit logs

You can combine the filters to focus on specific activity:

• All actions lets you select one or more action types, such as Member added, Member removed, Workspace updated, Project created, or Prompt sent. The dropdown is searchable.
• All actors lets you select one or more workspace members using the searchable picker.
• Resources lets you search for projects and people and show only events that affected them.
• All clients lets you select one or more client platforms to show only events performed from those apps: Web, Desktop app, iOS app, Android app, or Unknown. Unknown covers events recorded before RShift Sites started tracking the client platform on August 24, 2026, and events that did not come from one of these apps, such as automated SCIM provisioning.
• Time range includes presets for Last 7 days, Last 30 days, Last 90 days, This month, and Last month.

Your filter selections are reflected in the page URL, so you can share a filtered view with another admin or reload the page without losing it.

How to use audit logs

A typical workflow:

1. Set a relevant time range.
2. Filter by actor to review activity from a specific member.
3. Filter by action type to narrow results to a specific kind of change.
4. Expand entries to inspect the full JSON details.
5. Open affected projects or jump to related messages to review context.
6. Use the actor popover to copy details such as email, user ID, IP address, or user agent, or to check which client the event came from.

Exporting audit logs

Click Export in the top right of the page, then click Start new export. RShift Sites generates a JSONL file (one JSON event per line) of the audit logs matching your active action, actor, and time range filters, and packages it for download as audit_logs.jsonl.zip. Finished exports stay available for download for 7 days, and each export is itself recorded in the audit log.

Each exported event includes a client_platform field identifying the app the event came from, such as web, ios, android, or desktop-app. Exports created before client tracking was introduced do not include this field.

Audit log data retention

Logs are retained for 13 weeks, or approximately 90 days. Events older than that are automatically removed.

FAQ

Who can access audit logs?

Audit logs are available on Enterprise plans and are visible to workspace owners and admins.

How long are audit logs retained?

Audit logs are retained for 13 weeks, or approximately 90 days. Events older than that are automatically removed.

Can I export audit logs?

Yes. Click Export in the top right of the audit logs page to download your audit logs as a JSONL file, packaged as audit_logs.jsonl.zip. The export matches your active action, actor, and time range filters, and finished exports stay available for download for 7 days. Export is not available while a resource or client filter is active.

If you need to integrate audit logs with a SIEM or external monitoring system, contact your account team to discuss enterprise integration options.

Why don’t I see audit logs?

If audit logs are not available or do not appear as expected:

• Confirm your workspace is on an Enterprise plan.
• Confirm your role includes permission to view audit logs. You must be a workspace admin or owner.
• Clear filters and try a broader time range.

Related topics

• Workspace admin settings
• RShift Sites for Enterprise
• Groups
• Define reusable instructions with skills
• Set up SCIM user provisioning