Audit Log

The Audit Log gives workspace admins a tamper-evident trail of every meaningful action that takes place in the workspace — who did it, what they did, and when. Use it to investigate incidents, satisfy compliance requirements, and verify that access controls are working as expected. Open it from the sidebar: Settings → Audit Log. You need the audit:read scope to access this page. By default this is available to Tenant Admins, Security Admins, and Compliance Admins.

What is recorded

Every action that mutates workspace state emits an audit entry. Events are grouped into categories:

Category	Example actions
`create`	Member invited, API key created, team created, connector added
`update`	Workspace settings changed, member role changed, retention policy edited
`delete`	Member removed, API key revoked, team deleted, connector removed
`invite`	Invitation sent, invitation resent
`revoke`	Session revoked, API key revoked, service account token revoked
`export`	Workspace data export triggered
`login`	Authentication events (`auth.*`)
`other`	Any action not matching the above suffixes

Each entry records:

Field	Description
Actor	The user (or service account) who performed the action, including their name and ID
Action	A dot-delimited string identifying the event (e.g. `member.invited`, `workspace.settings.updated`)
Target	The type and ID of the resource affected (e.g. `member / mbr_01J…`)
Metadata	Structured context relevant to the event (e.g. the new role assigned, the fields changed)
IP address	The source IP of the request
Timestamp	UTC timestamp of the event

Audit log entries cannot be edited or deleted. The retention floor for audit records is 365 days — see Data & Retention.

Filtering the log

Use the filter bar at the top of the Audit Log screen to narrow the results:

Filter	Description
Search	Full-text search across actor names, action strings, and metadata
Date from / Date to	Restrict results to a date range (ISO 8601 date, e.g. `2026-01-01`)
Actor	Filter by a specific member’s user ID
Action	Exact action string, or use a wildcard prefix (e.g. `member.*` matches all member events)
Category	One of the category values above — `create`, `update`, `delete`, `invite`, `revoke`, `export`, `login`, `other`

Results are returned in reverse chronological order, paginated in pages of up to 100 entries.

Exporting the audit log

Click Export to download the filtered audit log as a CSV file. The export runs asynchronously; you will receive an email when the download is ready.

Apply filters (optional)

Set any date range or category filters you want the export to respect.

Click Export

A POST /v1/audit/export request is submitted. The response returns 202 Accepted.

Download the file

An email is sent to your account address when the export is ready. The link expires after 24 hours.

API endpoints

curl -X GET "https://api.causeloop.ai/v1/audit?category=invite&date_from=2026-01-01&limit=50" \
  -H "Authorization: Bearer $TOKEN"

curl -X POST "https://api.causeloop.ai/v1/audit/export" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"date_from": "2026-01-01", "date_to": "2026-06-30"}'

Method	Path	Description
`GET`	`/v1/audit`	List audit entries (filterable, paginated)
`POST`	`/v1/audit/export`	Queue a CSV export of filtered entries

Query parameters for GET /settings/audit:

Parameter	Type	Description
`q`	string	Full-text search
`date_from`	string	Start date (ISO 8601)
`date_to`	string	End date (ISO 8601)
`actor_id`	string	Filter to a specific actor
`action`	string	Exact action string or wildcard prefix (e.g. `member.*`)
`category`	string	Event category
`limit`	integer	Page size, 1–100 (default 25)
`cursor`	string	Pagination cursor from previous response

For the full REST specification see API Reference.

Working in Causeloop

Settings & Administration

What is recorded

Filtering the log

Exporting the audit log

API endpoints

​What is recorded

​Filtering the log

​Exporting the audit log

​API endpoints

What is recorded

Filtering the log

Exporting the audit log

API endpoints