Audit log schema.
The audit log is the source of truth for everything that happened on the platform. Every row has the same shape. The schema is versioned and we only ever add fields.
Row shape
{
"id": "aud_01HQ3K...",
"at": "2026-05-17T15:14:22.418Z",
"workspace": "acme",
"actor": {
"type": "user", // user | service_account | assistant
"id": "usr_01HQ3K...",
"email": "priya@acme.com"
},
"action": {
"category": "write", // read | write | invoke | approve | admin
"name": "task.create",
"version": 1
},
"target": {
"type": "Task",
"id": "tsk_01HQ3K..."
},
"changes": {
"title": [null, "Review MSA"],
"assignee": [null, "priya@acme.com"]
},
"context": {
"request_id": "req_01HQ3K...",
"ip": "203.0.113.42",
"workflow": "support-triage",
"run_id": "run_01HQ3K..."
},
"result": "ok"
} Actor types
| Type | When you see it |
|---|---|
user | A human did this |
service_account | An API key did this |
assistant | The assistant runtime did this |
system | An internal job did this (rotations, backfills) |
Action catalog (subset)
Full catalog has 200+ action names. The most-queried:
| Name | Category |
|---|---|
task.create | write |
task.update | write |
task.complete | write |
document.create | write |
document.read | read |
document.update | write |
assistant.invoke | invoke |
assistant.tool_call | invoke |
approval.requested | approve |
approval.granted | approve |
sso.login_succeeded | admin |
sso.login_failed | admin |
workspace.member_added | admin |
workspace.member_removed | admin |
Streaming the audit log
Two delivery modes:
- Push. Configure an HMAC-signed webhook target. We deliver every row in real time.
- Pull. Query the audit log API with a since-cursor. Useful for batch jobs.
The generic path is a JSON stream over HTTPS, so it drops into any log store that accepts one.
Retention
Audit retention is configurable via retention.audit_days. Set it to match your own record-keeping needs.