The audit log is the workspace's record of administrative and structural actions: who changed a role, closed a period, deleted a ticket, or turned forced single sign-on off. It is append-only and belongs to the workspace, so it outlives the people who wrote it. Owners read it under Settings → Organization → Audit log.
Before you start
You need the Owner role. Admins cannot read the audit log.
What is recorded
Each entry is structural: the time, the acting account, whether the action was made on that person's behalf through a personal API token, the action, the type and id of the target, and for some actions a reason (for example the placeholder assigned when a person was pseudonymised, or the reason given for a redaction). Content is never recorded: no ticket text, comments, time notes, or attachments.
The page shows the 200 most recent entries with When and Action (the action name and the target id). Above the table, Filter by action narrows to actions whose name contains the text, and Since hides older entries; the count reads "{shown} of {total} entries". The full history stays in the workspace and is part of the workspace export.
Recorded action families
| Family | Examples |
|---|---|
| Members and invitations | invitation.create, invitation.accept, invitation.revoke, membership.role.admin, membership.remove, membership.leave, membership.agent_create, membership.provision.jit, membership.provision.scim, identity.pseudonymise |
| API tokens | api_token.create, api_token.agent_create, api_token.revoke |
| Authentication | domain.add, domain.remove, domain.force_sso.on, domain.force_sso.off, sso.status.active, sso.delete, scim.token.create, scim.token.revoke, scim.user.create, scim.group.create |
| Workspace and workflow | workspace.settings.update, workflow.settings.update, workflow.state.create, workflow.kind.create, workflow.priority.create |
| Clients and projects | client.create, client.update, client.archive, client.user.add, client.user.remove, client.billing_recipient.add, contact.upsert, project.create, project.update, project.archive, project.member.remove, project.collaborators.set |
| Time and billing | period.close, time.reattribute, billing_run.create, billing_run.void, rate.set, rate.delete, policy.set, bank.create, bank.update, bank.adjust, category.create, document.download |
| Tickets | ticket.delete, ticket.redact, and, for writes made through an API key, the ticket event (ticket.state, ticket.assignee, and so on) and comment.create |
mail.connect, mail.merge, mail.promote, mail.retry_processing |
|
| Organization | organization.invoice.request, subscription.cancel_at_period_end, workspace.export_started, workspace.exported, workspace.export_expired, workspace.delete_scheduled |
Day-to-day ticket edits made in the browser are not audit entries; they are on the ticket's timeline, which everyone who can see the ticket can read.
Delegated tokens
When someone acts through a personal API token, the entry is attributed to the token's owner and marked as made on their behalf, so an integration's work is traceable to the person who minted the key. An agent account is its own actor. Tickets and comments created this way are also marked with source api or mcp on the ticket. See API tokens and agent accounts.
Common problems
I cannot open the audit log. Only owners can. Anyone else sees "You do not have permission to do this."
An entry is missing. Only the 200 most recent entries are shown on the page. Older entries are in the workspace export.
I need to know who changed a ticket field. Open the ticket's timeline; browser edits are recorded there, not in the audit log.