> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace Audit Logs

> Monitor organization activities and changes. Track who did what, when they did it, and what was affected for compliance and security.

<Badge color="blue" size="lg" shape="pill" stroke="true">Feature available with the [Enterprise Plan](https://orq.ai/solutions/enterprise)</Badge>

Audit Logs record changes made across the organization: who made a change, what was affected, and when. Each entry captures the actor, the affected entity, the action, and a timestamp.

## Use Cases

* **Security**: Track API key creation/deletion and user access patterns.

* **Compliance**: Maintain records of who changed what and when.

* **Troubleshooting**: Understand what changed and identify who made specific modifications.

* **Team Management**: Monitor member activities and permission changes.

## Accessing Audit Logs

Go to **Settings > Organization > Audit Logs** to view activity history.

<Frame caption="Audit Logs table with timestamps, entities, actions, and actors">
  <img src="https://mintcdn.com/orqai/S1-0kiPeULI-eMfT/images/audit-logs.png?fit=max&auto=format&n=S1-0kiPeULI-eMfT&q=85&s=7ee6259598d5976ab0d9413a08a463fa" alt="Audit Logs table showing rows with Timestamp, Entity, Type, Action, and Actor columns, listing Updated actions on experiments and agents." width="1785" height="717" data-path="images/audit-logs.png" />
</Frame>

## Log Columns

* **Timestamp**: When the action occurred
* **Entity**: What was affected. See [Tracked Entities](#tracked-entities) for the full list
* **Type**: Category of the resource
* **Action**: What happened. See [Tracked Actions](#tracked-actions) for the full list
* **Source**: Where the action came from. See [Sources](#sources) for the full list
* **Actor**: Who performed the action

## Sources

The **Source** column records how the action reached orq.ai. The **Key** column is the internal identifier.

| Source         | Key          | Description                                                                                      |
| -------------- | ------------ | ------------------------------------------------------------------------------------------------ |
| **UI**         | `ui`         | A signed-in user acting in the web app                                                           |
| **API**        | `api`        | A workspace, project, or management API key                                                      |
| **Router**     | `router`     | A legacy router API key                                                                          |
| **MCP**        | `mcp`        | An orq.ai MCP server tool                                                                        |
| **Automation** | `automation` | A scheduled or webhook-triggered run, recorded against the creator of the automation or schedule |
| **Internal**   | `internal`   | An orq.ai service calling another service                                                        |
| **SCIM**       | `scim`       | Your identity provider's provisioning connector                                                  |
| **System**     | `system`     | An orq.ai-initiated action with no request behind it, such as a cascading key revoke             |

Records written before this column existed have no source.

## Tracked Entities

The **Key** column is the internal identifier for each entity type.

| Entity                  | Key                   |
| ----------------------- | --------------------- |
| **Agent**               | `agent`               |
| **Agent Schedule**      | `agent_schedule`      |
| **Annotation**          | `human_review`        |
| **Annotation Queue**    | `annotation_queue`    |
| **API Key**             | `api_key`             |
| **Automation**          | `automation`          |
| **Budget**              | `budget`              |
| **Dataset**             | `dataset`             |
| **Deployment**          | `deployment`          |
| **Evaluator**           | `evaluator`           |
| **Experiment**          | `experiment_v2`       |
| **File**                | `file`                |
| **Folder**              | `directory`           |
| **Identity**            | `identity`            |
| **Integration**         | `integration`         |
| **Knowledge**           | `knowledge`           |
| **Legacy Experiment**   | `experiment`          |
| **Management Key**      | `management_key`      |
| **Member**              | `member`              |
| **Memory Store**        | `memory_store`        |
| **Model**               | `model`               |
| **Permission**          | `permission`          |
| **Playground**          | `playground`          |
| **Project**             | `project`             |
| **Prompt**              | `prompt_library`      |
| **Session**             | `session`             |
| **Skill**               | `skill`               |
| **SSO Configuration**   | `sso_config`          |
| **Subscription**        | `subscription`        |
| **Team**                | `team`                |
| **Tool**                | `tool`                |
| **Variable Collection** | `variable_collection` |
| **Workflow**            | `workflow`            |
| **Workspace**           | `workspace`           |

## Tracked Actions

The **Key** column is the internal identifier for each action.

| Action                | Key                 |
| --------------------- | ------------------- |
| **Access Updated**    | `access_updated`    |
| **Accessed**          | `accessed`          |
| **Added**             | `added`             |
| **Cancelled**         | `cancelled`         |
| **Connected**         | `connected`         |
| **Consumption Reset** | `consumption_reset` |
| **Created**           | `created`           |
| **Deleted**           | `deleted`           |
| **Deprovisioned**     | `deprovisioned`     |
| **Disabled**          | `disabled`          |
| **Disconnected**      | `disconnected`      |
| **Enabled**           | `enabled`           |
| **Exported**          | `exported`          |
| **Invited**           | `invited`           |
| **Logged Out**        | `logged_out`        |
| **Login Succeeded**   | `login_succeeded`   |
| **Provisioned**       | `provisioned`       |
| **Removed**           | `removed`           |
| **Revoked**           | `revoked`           |
| **Rotated**           | `rotated`           |
| **Scope Updated**     | `scope_updated`     |
| **Set**               | `set`               |
| **Subscribed**        | `subscribed`        |
| **Triggered**         | `triggered`         |
| **Updated**           | `updated`           |

## Filter Options

Use the following filters to find audit logs:

* Entity Type
* Actor who performed the action
* Source the action came from

Sort by Timestamp or Entity to further improve your results.

## Immutability

Audit log entries are **append-only**: **Orq.ai** records each action automatically, and no interface, API, or role can edit or delete an entry. This includes organization admins.

The guarantee is enforced at the application level:

* The public audit log surface is read-only: query, filter, sort, and export, with no write capability.
* Entries are written only by internal **Orq.ai** services through insert-only paths.
* The only automated deletion is retention-based: entries are removed when the workspace retention window expires. See [Data Retention](/ai-studio/organization/data-retention).

## Data Retention

Audit logs are retained for the retention period of the workspace subscription. Longer retention is available on higher plans. To adjust the retention window, contact support. See [Data Retention](/ai-studio/organization/data-retention) for full details.