Audit log.
Every action, on the record.
One immutable log of every identity action across every Brand — queryable by actor, action, resource, time. Compliance teams get the source of truth they need; security teams get the answer to "who did what". Retention scales with your plan; expired entries prune daily.
Identity actions, end to end
Every action that mutates identity state is logged. Reads generally are not — your CDN already has those, and logging them doubles audit volume without much value. A sampling:
| user.signedIn | Successful sign-in (provider, app, IP) |
|---|---|
| grant.created | User authorized an App |
| grant.revoked | User revoked an App |
| wallet.linked | New wallet linked to user |
| oidcClient.created | New App registered |
| oidcClient.secretRotated | App secret rotated |
| brand.connectionEnabled | A provider was enabled on a Brand |
| brand.credentialUpdated | BYO OAuth credentials updated |
| member.invited | Teammate invitation sent |
| member.roleChanged | Teammate’s role changed |
| webhookSubscription.created | New webhook subscription |
| webhookSubscription.disabled | Webhook auto-disabled |
| tokenGate.created | New token-gate rule |
| apiKey.rotated | API key rotated |
Shaped for replay
actor
Who performed the action — user `sub`, member ID, or M2M client ID. Distinguishes "user via web" from "M2M worker" with the `azp` claim.
action
A dotted string like `oidcClient.created` or `member.invited`. Stable across releases, safe to filter on.
resourceType + resourceId
What was acted on. Filter by resource to get the full lineage of a single App, Brand, or member binding.
metadata
Action-specific JSON — IP address for sign-ins, before/after for updates, provider name for credential changes.
timestamp
Server-side UTC. The Dashboard renders in local time; queries take ISO 8601.
brand (optional)
Set when the action happened against a specific Brand. Org-level actions (billing, members) omit it.
Scaled to your plan
Plan tiers gate audit-log retention — entries past the configured window are pruned daily by a background job. The shorter the window, the cheaper the storage. Enterprise tiers extend the window or unlock unlimited retention for compliance.
Read more
Webhooks
The same events stream out in real time. Audit log is the durable record, webhooks are the live feed.
Teams & roles
Permissions include AuditLog:View. Grant it to security or compliance teammates without giving them Admin.
API keys
Org-level API keys can read the audit log via the platform API — useful for piping into your SIEM.
Common questions
Always know who did what.
No setup required — the audit log is on the moment you create your Org. Query it from the Dashboard or pipe it into your SIEM via API key.