Skip to main content
Every action that matters is logged. The audit trail is how you know who did what, when, and why — for team review, compliance, and incident response.

​
What’s audited

  • Publishes and rollbacks — Flow and pipeline versions.
  • Approvals — decisions with actor, reason, and target.
  • Access changes — invites, role changes, member removals, per-Flow access grants.
  • Token events — issue, revoke, first use.
  • Secret rotations — connectors, tool headers, trigger secrets. Values never logged.
  • Provider key events — set, delete.
  • Policy changes — workspace policy edits.
  • Improvement deploys — the improvement flow’s ships.
  • Data actions — bulk supersede, deletes.
  • Billing changes — plan changes, tax edits, overage cap adjustments.
Trace payloads (prompts, tool responses) are not audit entries — they’re their own retention system. Audit covers structural / access / config changes.

​
The audit view

Settings → Security → Audit. Reverse-chronological list:
  • Actor — name + email (or “workspace token: X” for automation).
  • Action — publish / rollback / etc.
  • Target — Flow, block, secret name, member.
  • Details — action-specific fields (release note, rollback reason, role delta).
  • Source — UI / CLI / API / webhook.
  • IP / user agent — where the action originated.
  • Signature — every entry is signed; tampering is detectable.
Filter by actor, action type, date range.

​
Exporting

Settings → Security → Audit → Export:
  • CSV — flat table.
  • JSON — full detail per entry.
  • PDF — printable, one entry per row.
Exports are signed with a workspace-level signature so external auditors can verify authenticity. Bulk export for a specific period:

​
Retention

  • Free — 30 days.
  • Team — 1 year.
  • Enterprise — configurable (up to 7 years or indefinite).
Older entries are archived (still queryable via export) but hidden from the default view. Configure retention: Settings → Security → Audit → Retention. Only Owners.

​
Immutability

Audit entries cannot be deleted, edited, or reordered. If an entry is wrong, add a corrective entry — the original stays. This is what makes the audit trail trustworthy. Even Owners cannot delete audit entries. Enforced at the storage layer.

​
SIEM forwarding

For orgs with a security operations center, forward audit events to your SIEM. Settings → Security → Audit → Forwarding:
  • Slack / Discord webhook — notifications on important events (publish, rollback, secret rotation).
  • PagerDuty — page on rollback or auto-rollback triggers.
  • Splunk / Datadog / SumoLogic — JSON stream via HTTPS.
  • Generic webhook — POST every audit event to your endpoint.
Configure filters per destination — e.g. only forward publish and rollback events to Slack, but forward everything to Splunk.

​
Webhook payload shape

​
Verify signatures

Each entry carries a signature. Verify with your workspace’s public audit key (Settings → Security → Audit → Verification key):
Ensures a leaked-and-tampered audit log fails verification.

​
Compliance modes

Turning on Compliance mode (per Flow, Settings → Access) tightens audit:
  • Every action requires a reason (not optional).
  • Audit retention forced to the compliance-required duration.
  • Certain destructive actions require multi-sign approval (audit records both signers).
  • Data export requires explicit approval workflow.
Compliance mode is a one-way transition per Flow — turning off requires an Owner + written justification.

​
Debugging with audit

Common questions the audit view answers:
  • “Who published this Flow last?” — filter action=flows.publish, target=<flow>.
  • “Why did we rollback?” — filter action=flows.rollback, click the entry for the reason field.
  • “When was this secret rotated?” — filter action=secrets.rotate.
  • “Did anyone touch access on this Flow in the last week?” — filter target=<flow>, action prefix=access..