> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace Audit Logs

> Monitor organization activities and changes. Track who did what, when they did it, and what was affected for compliance and security.

<Badge color="blue" size="lg" shape="pill" stroke="true">Feature available with the [Enterprise Plan](https://orq.ai/solutions/enterprise)</Badge>

Audit Logs record changes made across the organization: who made a change, what was affected, and when. Each entry captures the actor, the affected entity, the action, and a timestamp.

## Use Cases

* **Security**: Track API key creation/deletion and user access patterns.

* **Compliance**: Maintain records of who changed what and when.

* **Troubleshooting**: Understand what changed and identify who made specific modifications.

* **Team Management**: Monitor member activities and permission changes.

## Accessing Audit Logs

Go to **Settings > Organization > Audit Logs** to view activity history.

<Frame caption="Audit Logs table with timestamps, entities, actions, and actors">
  <img src="https://mintcdn.com/orqai/S1-0kiPeULI-eMfT/images/audit-logs.png?fit=max&auto=format&n=S1-0kiPeULI-eMfT&q=85&s=7ee6259598d5976ab0d9413a08a463fa" alt="Audit Logs table showing rows with Timestamp, Entity, Type, Action, and Actor columns, listing Updated actions on experiments and agents." width="1785" height="717" data-path="images/audit-logs.png" />
</Frame>

## Log Columns

* **Timestamp**: When the action occurred
* **Entity**: What was affected. See [Tracked Entities](#tracked-entities) for the full list
* **Type**: Category of the resource
* **Action**: What happened. See [Tracked Actions](#tracked-actions) for the full list
* **Source**: Where the action came from. See [Sources](#sources) for the full list
* **Actor**: Who performed the action

## Sources

The **Source** column records how the action reached orq.ai. The **Key** column is the internal identifier.

| Source | Key | Description |
| - | - | - |
| **UI** | `ui` | A signed-in user acting in the web app |
| **API** | `api` | A workspace, project, or management API key |
| **Router** | `router` | A legacy router API key |
| **MCP** | `mcp` | An orq.ai MCP server tool |
| **Automation** | `automation` | A scheduled or webhook-triggered run, recorded against the creator of the automation or schedule |
| **Internal** | `internal` | An orq.ai service calling another service |
| **SCIM** | `scim` | Your identity provider's provisioning connector |
| **System** | `system` | An orq.ai-initiated action with no request behind it, such as a cascading key revoke |

Records written before this column existed have no source.

## Tracked Entities

The **Key** column is the internal identifier for each entity type.

| Entity | Key |
| - | - |
| **Agent** | `agent` |
| **Agent Schedule** | `agent_schedule` |
| **Alert** | `alert` |
| **Annotation** | `human_review` |
| **Annotation Queue** | `annotation_queue` |
| **API Key** | `api_key` |
| **Automation** | `automation` |
| **Budget** | `budget` |
| **Dataset** | `dataset` |
| **Deployment** | `deployment` |
| **Evaluator** | `evaluator` |
| **Experiment** | `experiment_v2` |
| **Factory** | `factory` |
| **File** | `file` |
| **File System** | `file_system` |
| **Folder** | `directory` |
| **Guardrail Rule** | `guardrail_rule` |
| **Identity** | `identity` |
| **Integration** | `integration` |
| **Knowledge** | `knowledge` |
| **Legacy Experiment** | `experiment` |
| **Management Key** | `management_key` |
| **MCP Gateway** | `mcp_gateway` |
| **MCP Server** | `mcp_server` |
| **Member** | `member` |
| **Memory Store** | `memory_store` |
| **Model** | `model` |
| **Monitor** | `monitor` |
| **Notifier** | `notifier` |
| **Permission** | `permission` |
| **Playground** | `playground` |
| **Project** | `project` |
| **Prompt** | `prompt_library` |
| **Routing Rule** | `routing_rule` |
| **SCM Connection** | `scm_connection` |
| **Session** | `session` |
| **Skill** | `skill` |
| **Smart Router** | `smart_router` |
| **SSO Configuration** | `sso_config` |
| **Subscription** | `subscription` |
| **Team** | `team` |
| **Tool** | `tool` |
| **Variable Collection** | `variable_collection` |
| **Webhook** | `webhook` |
| **Workflow** | `workflow` |
| **Workspace** | `workspace` |

## Tracked Actions

The **Key** column is the internal identifier for each action.

| Action | Key |
| - | - |
| **Access Updated** | `access_updated` |
| **Accessed** | `accessed` |
| **Added** | `added` |
| **Cancelled** | `cancelled` |
| **Connected** | `connected` |
| **Consumption Reset** | `consumption_reset` |
| **Created** | `created` |
| **Deleted** | `deleted` |
| **Deprovisioned** | `deprovisioned` |
| **Disabled** | `disabled` |
| **Disconnected** | `disconnected` |
| **Enabled** | `enabled` |
| **Exported** | `exported` |
| **Invited** | `invited` |
| **Logged Out** | `logged_out` |
| **Login Succeeded** | `login_succeeded` |
| **Provisioned** | `provisioned` |
| **Removed** | `removed` |
| **Revoked** | `revoked` |
| **Rotated** | `rotated` |
| **Scope Updated** | `scope_updated` |
| **Set** | `set` |
| **Subscribed** | `subscribed` |
| **Triggered** | `triggered` |
| **Updated** | `updated` |

## Filter Options

Use the following filters to find audit logs:

* Entity Type
* Actor who performed the action
* Source the action came from

Sort by Timestamp or Entity to further improve your results.

## Immutability

Audit log entries are **append-only**: **Orq.ai** records each action automatically, and no interface, API, or role can edit or delete an entry. This includes organization admins.

The guarantee is enforced at the application level:

* The public audit log surface is read-only: query, filter, sort, and export, with no write capability.
* Entries are written only by internal **Orq.ai** services through insert-only paths.
* The only automated deletion is retention-based: entries are removed when the workspace retention window expires. See [Data Retention](/ai-studio/organization/data-retention).

## Data Retention

Audit logs are retained for the retention period of the workspace subscription. Longer retention is available on higher plans. To adjust the retention window, contact support. See [Data Retention](/ai-studio/organization/data-retention) for full details.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.