> ## Documentation Index > Fetch the complete documentation index at: https://docs.oasm.io/llms.txt > Use this file to discover all available pages before exploring further. # Audit log > View and export workspace activity for compliance and incident investigation in OASM The **Audit log** (under **Settings → Audit log**, `/settings/audit`) records the activity that happens inside a workspace. Its subtitle summarizes the purpose: *"View and export workspace activity"*. Every significant action — creating or revoking an API key, deleting a scan target, and other workspace operations — is captured as an event with the actor who performed it and the outcome. The audit log is the primary source of truth for compliance reporting and incident investigation. ## Key concepts ### Events Each event describes a single action against a resource. Events are immutable: they are written when the action occurs and cannot be edited or deleted from the console. ### Actors Events are attributed to an actor — a **user**, an **API key**, the **system**, or an **agent** (such as a worker). This makes it possible to trace who or what changed the workspace. Events from a user whose account no longer exists show the actor as **Deleted user**. ### Outcomes Every event has one of three outcomes: **Success**, **Failure**, or **Denied** (the actor lacked permission). Only non-success outcomes get a badge in the event list, so failures and denials stand out. ## Browse the audit log **1. Open Settings → Audit log** Open **Settings** and select **Audit log** in the **Workspace** group. You need the `audit.read` permission; without it the page shows an access-denied message. **2. Read the event list** Events appear newest first under **Recent events**, 50 per page. Each entry shows the actor's avatar and name, the action key, the readable action label, the resource type and ID, the source IP, and a relative time (hover it for the exact timestamp). **3. Page through history** Use **Older** and **Newer** below the list to move between pages. **4. Inspect an event** Click an event (or focus it and press Enter) to open the detail panel. ## Event details The detail panel shows the action label, the exact time, the outcome badge, and: | Field | Description | | - | - | | Actor | Name, email, and actor ID | | Resource | Resource type and ID | | Source IP | The IP address the request came from | | User agent | Parsed into browser or client, operating system, device type, and device, with the raw string below | | Request ID / Correlation ID | Identifiers for tracing the request through the platform logs | | Changes | Each changed field with its before → after values, when the action modified data | | Metadata | Extra key/value context recorded with the event | Click **View raw JSON** to see the complete event record. ## Filters The toolbar above the list has a **Filter** button, a **Date** range picker, and **Export CSV**. | Filter | Input | Description | | - | - | - | | Action | Pick from the workspace's action catalog | Filter by the type of action performed | | Outcome | Success, Failure, or Denied | Filter events by result | | Actor | Pick a workspace member, or paste a user, API key, or agent ID | Find events performed by a specific actor | | Resource type | Free text, up to 32 characters | Restrict to one kind of resource | | Date | Presets (Today, Last 7/30/60/90 days) or a custom range | Restrict events to a time window | Each field can be used once, and conditions are combined with AND. The active filter is summarized next to the **Filter** button; click the **×** to clear it. On a phone, the filter builder opens as a bottom sheet. > [!TIP] > > Click an actor's name or an action key in the list to filter by it instantly. This replaces any existing condition on that field. ## Export the audit log Click **Export CSV** to download the events that match the current filters and date range. The file is named `audit--.csv`, and a notification confirms how many events were exported. Exports are capped at **10,000 rows** — narrow the filters or date range if the export is rejected. The CSV can be imported into spreadsheets or SIEM tooling for further analysis and long-term retention. ## Example events | Action | Resource type | Typical outcome | | - | - | - | | Created API key | API key | Success | | Revoked API key | API key | Success | | Deleted scan target | Scan target | Success | > **Which events are recorded?** > > The audit log captures workspace activity, including actions such as **Created API key**, **Revoked API key**, and **Deleted scan target**. Resources include scan targets, API keys, and other items the workspace manages. Events are also recorded when an action fails — failed attempts are valuable for incident investigation. ## Best practices * Review the audit log regularly as part of your security operations routine. * Use the **Actor** filter to investigate a specific user, API key, or agent after an incident. * Filter by **Outcome = Failure** or **Outcome = Denied** to surface repeated failed or unauthorized attempts that may indicate misconfiguration or abuse. * Export a CSV snapshot periodically for compliance and long-term retention. * Combine the audit log with [API key](/api-keys) rotation and [member](/members) reviews to close access-related findings quickly. ## Related > **[API keys](/api-keys)** > > Track creation and revocation of workspace API keys > **[Members](/members)** > > Understand the actors behind workspace activity > **[Workspace](/workspace)** > > See which tenant the audit events belong to > **[Worker](/worker)** > > Identify agent activity in the audit log This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.