Audit Log
The Audit Log is the workspace-level history of important configuration and integration actions: who did what, and when. Use it for governance (proving that only approved admins changed a sync), security investigations, and troubleshooting (“we thought the model saved—which user saved it last?”).
How it works
Each entry records an activity type (for example, connection created, model updated, CRM sync rule changed), the user who performed it (name and email when available), a timestamp, and a data payload with structured details about the change. The list is read-only; you cannot edit or delete audit rows from the UI.
Activities cover the lifecycle of major workspace objects: data models, data connections (create, update, delete, authorize, and related actions), CRM sync configurations, enrichments, audiences, dashboards and charts, agents (create/update/delete), LLM providers and LLM configuration, tasks, notes, labels, invitations, workspace settings and resets, MCP clients, reports, and more. When assistants or integrations act on behalf of a user, the entry is still attributed to that user where the platform has user context.
Viewing the workspace audit log
- Open Admin in the main navigation (you need an admin role that includes access to admin settings).
- Go to Audit Log.
- Choose a time range at the top to narrow the window (for example, last week).
- Scan columns Performed on, Activity, Performed by, Email, and Data. The Data column shows JSON with fields relevant to that activity (ids, names, or diffs depending on the event).
If a user was later deactivated, the log can still show their historical actions; deactivated users may be labeled accordingly in the Performed by column.
Filtering and searching
Use the controls above the table to narrow the log. They combine with each other and with the time range.
| Control | What it does |
|---|---|
| Activity | Keep only the selected activity types. The list shows every activity that has been recorded in your workspace; type in Search activity to find one. Select several to include all of them. |
| Performed By | Keep only actions by the selected users. Type in Search users to find someone. Select several to include all of them. |
| Search audit log | Type a word or phrase and press Enter. Matches entries whose activity name or Data contains the text, ignoring case, so you can find every change that mentions a specific connection, model, or record ID. Clear the box to remove the search. |
The button label shows how many values are selected, for example Activity (2). Your filters and search are kept in the page URL, so you can bookmark or share a filtered view.
Other audit-style views
Some objects—such as a funnel—also expose an Audit tab on their own detail page. That tab is scoped to that object, whereas the workspace Audit Log aggregates events across the whole tenant.
Related
- Security
- Workspace management
- CRM sync overview — many audit entries come from sync configuration changes