Workspace Audit Logs

Feature available with the Enterprise Plan Audit Logs record changes made across the organization: who made a change, what was affected, and when. Each entry captures the actor, the affected entity, the action, and a timestamp.

Use Cases

Security: Track API key creation/deletion and user access patterns.
Compliance: Maintain records of who changed what and when.
Troubleshooting: Understand what changed and identify who made specific modifications.
Team Management: Monitor member activities and permission changes.

Accessing Audit Logs

Go to Settings > Security > Audit Logs to view activity history.

Audit Logs table showing rows with Timestamp, Entity, Type, Action, and Actor columns, listing Updated actions on experiments and agents. — Audit Logs table with timestamps, entities, actions, and actors

The same records are available to compliance tooling through the API: POST /v2/audit-logs/query filters, sorts, and paginates them. See the Query audit logs API reference. To download a range as a file for a SIEM or a warehouse, see Export audit logs.

Log Columns

Timestamp: When the action occurred
Entity: What was affected. See Tracked Entities for the full list
Type: Category of the resource
Action: What happened. See Tracked Actions for the full list
Source: Where the action came from. See Sources for the full list
Actor: Who performed the action

Sources

The Source column records how the action reached orq.ai. The Key column is the internal identifier.

Source	Key	Description
UI	`ui`	A signed-in user acting in the web app
API	`api`	A workspace, project, or management API key
Router	`router`	A legacy router API key
MCP	`mcp`	An orq.ai MCP server tool
Automation	`automation`	A scheduled or webhook-triggered run, recorded against the creator of the automation or schedule
Internal	`internal`	An orq.ai service calling another service
SCIM	`scim`	Your identity provider’s provisioning connector
System	`system`	An orq.ai-initiated action with no request behind it, such as a cascading key revoke

Records written before this column existed have no source.

Tracked Entities

The Key column is the internal identifier for each entity type.

Entity	Key
Agent	`agent`
Agent Schedule	`agent_schedule`
Alert	`alert`
Annotation	`human_review`
Annotation Queue	`annotation_queue`
API Key	`api_key`
Audit Log Destination	`audit_log_destination`
Automation	`automation`
Budget	`budget`
Dataset	`dataset`
Deployment	`deployment`
Evaluator	`evaluator`
Experiment	`experiment_v2`
Factory	`factory`
File	`file`
File System	`file_system`
Folder	`directory`
Guardrail Rule	`guardrail_rule`
Identity	`identity`
Integration	`integration`
Knowledge	`knowledge`
Legacy Experiment	`experiment`
Management Key	`management_key`
MCP Gateway	`mcp_gateway`
MCP Server	`mcp_server`
Member	`member`
Memory Store	`memory_store`
Model	`model`
Monitor	`monitor`
Notifier	`notifier`
Permission	`permission`
Playground	`playground`
Project	`project`
Prompt	`prompt_library`
Routing Rule	`routing_rule`
SCM Connection	`scm_connection`
Session	`session`
Skill	`skill`
Smart Router	`smart_router`
SSO Configuration	`sso_config`
Subscription	`subscription`
Team	`team`
Tool	`tool`
Variable Collection	`variable_collection`
Webhook	`webhook`
Workflow	`workflow`
Workspace	`workspace`

Tracked Actions

The Key column is the internal identifier for each action.

Action	Key
Access Updated	`access_updated`
Accessed	`accessed`
Added	`added`
Cancelled	`cancelled`
Connected	`connected`
Consumption Reset	`consumption_reset`
Created	`created`
Deleted	`deleted`
Deprovisioned	`deprovisioned`
Disabled	`disabled`
Disconnected	`disconnected`
Enabled	`enabled`
Exported	`exported`
Invited	`invited`
Logged Out	`logged_out`
Login Succeeded	`login_succeeded`
Provisioned	`provisioned`
Removed	`removed`
Revoked	`revoked`
Rotated	`rotated`
Scope Updated	`scope_updated`
Set	`set`
Subscribed	`subscribed`
Triggered	`triggered`
Updated	`updated`

Use the following filters to find audit logs:

Entity Type
Actor who performed the action
Source the action came from

Sort by Timestamp or Entity to further improve your results.

Export audit logs

POST /v2/audit-logs/export streams every record that matches the request’s filters and sorting as a download: audit-logs-<date>.csv by default, or audit-logs-<date>.json with ?format=json. The JSON export carries the full record; the CSV export carries the columns created_at, entity_type, action, actor_id, actor_type, actor_display, actor_ip, origin, request_id, project_id, entity_id, and metadata.

cURL

curl -X POST "https://my.orq.ai/v2/audit-logs/export?format=csv" \
  -H "Authorization: Bearer $ORQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "operator": "and",
      "filters": [
        { "type": "string", "path": "entity_type", "operator": "is", "value": "api_key" },
        {
          "type": "date",
          "path": "created_at",
          "operator": "is_between",
          "value": { "criteria": { "startDate": "2026-10-01", "endDate": "2026-10-15" } }
        }
      ]
    },
    "sorting": [{ "key": "created_at", "direction": "desc" }]
  }' \
  -o audit-logs.csv

The body takes the same filters and sorting objects as the query API, where the filter paths, types and operators are listed; the date value accepts YYYY-MM-DD or RFC 3339 bounds. The endpoint is API-only: the console has no download control. The endpoint accepts a management API key or an authenticated workspace admin session, and requires the audit logs feature: a workspace without it receives 402.

Immutability

Audit log entries are append-only: Orq.ai records each action automatically, and no interface, API, or role can edit or delete an entry. This includes organization admins. The guarantee is enforced at the application level:

The public audit log surface is read-only: query, filter, sort, and file export, with no write capability.
Entries are written only by internal Orq.ai services through insert-only paths.
The only automated deletion is retention-based: entries are removed when the workspace retention window expires. See Data Retention.

Data Retention

Audit logs are retained for the retention period of the workspace subscription unless a separate audit retention window is configured. An audit retention window can be set between 1 day and 3,650 days independently of the retention applied to traces and other workspace data. To configure it, contact support. The time range picker on the Audit Logs page shows the effective audit retention window. Retention changes apply to entries recorded after the change; existing entries keep the expiry they were recorded with. See Data Retention for full details.

Workspace & Projects

Identity & Access

Billing & Usage

Security & Compliance

Support

Enterprise Deployment

Use Cases

Accessing Audit Logs

Log Columns

Sources

Tracked Entities

Tracked Actions

Export audit logs

Immutability

Data Retention

​Use Cases

​Accessing Audit Logs

​Log Columns

​Sources

​Tracked Entities

​Tracked Actions

​Filter Options

​Export audit logs

​Immutability

​Data Retention

Use Cases

Accessing Audit Logs

Log Columns

Sources

Tracked Entities

Tracked Actions

Filter Options

Export audit logs

Immutability

Data Retention