> ## Documentation Index
> Fetch the complete documentation index at: https://docs.causeloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

> View, filter, and export the immutable record of every significant action taken in your workspace.

The Audit Log gives workspace admins a tamper-evident trail of every meaningful action that takes place in the workspace — who did it, what they did, and when. Use it to investigate incidents, satisfy compliance requirements, and verify that access controls are working as expected.

Open it from the sidebar: **Settings → Audit Log**. You need the `audit:read` scope to access this page. By default this is available to **Tenant Admins**, **Security Admins**, and **Compliance Admins**.

***

## What is recorded

Every action that mutates workspace state emits an audit entry. Events are grouped into categories:

| Category | Example actions                                                          |
| -------- | ------------------------------------------------------------------------ |
| `create` | Member invited, API key created, team created, connector added           |
| `update` | Workspace settings changed, member role changed, retention policy edited |
| `delete` | Member removed, API key revoked, team deleted, connector removed         |
| `invite` | Invitation sent, invitation resent                                       |
| `revoke` | Session revoked, API key revoked, service account token revoked          |
| `export` | Workspace data export triggered                                          |
| `login`  | Authentication events (`auth.*`)                                         |
| `other`  | Any action not matching the above suffixes                               |

Each entry records:

| Field          | Description                                                                                        |
| -------------- | -------------------------------------------------------------------------------------------------- |
| **Actor**      | The user (or service account) who performed the action, including their name and ID                |
| **Action**     | A dot-delimited string identifying the event (e.g. `member.invited`, `workspace.settings.updated`) |
| **Target**     | The type and ID of the resource affected (e.g. `member / mbr_01J…`)                                |
| **Metadata**   | Structured context relevant to the event (e.g. the new role assigned, the fields changed)          |
| **IP address** | The source IP of the request                                                                       |
| **Timestamp**  | UTC timestamp of the event                                                                         |

<Note>
  Audit log entries cannot be edited or deleted. The retention floor for audit records is 365 days — see [Data & Retention](/product-guide/settings/data-retention).
</Note>

***

## Filtering the log

Use the filter bar at the top of the Audit Log screen to narrow the results:

| Filter                  | Description                                                                                                     |
| ----------------------- | --------------------------------------------------------------------------------------------------------------- |
| **Search**              | Full-text search across actor names, action strings, and metadata                                               |
| **Date from / Date to** | Restrict results to a date range (ISO 8601 date, e.g. `2026-01-01`)                                             |
| **Actor**               | Filter by a specific member's user ID                                                                           |
| **Action**              | Exact action string, or use a wildcard prefix (e.g. `member.*` matches all member events)                       |
| **Category**            | One of the category values above — `create`, `update`, `delete`, `invite`, `revoke`, `export`, `login`, `other` |

Results are returned in reverse chronological order, paginated in pages of up to 100 entries.

***

## Exporting the audit log

Click **Export** to download the filtered audit log as a CSV file. The export runs asynchronously; you will receive an email when the download is ready.

<Steps>
  <Step title="Apply filters (optional)">
    Set any date range or category filters you want the export to respect.
  </Step>

  <Step title="Click Export">
    A `POST /v1/audit/export` request is submitted. The response returns `202 Accepted`.
  </Step>

  <Step title="Download the file">
    An email is sent to your account address when the export is ready. The link expires after 24 hours.
  </Step>
</Steps>

***

## API endpoints

<CodeGroup>
  ```bash List audit entries theme={null}
  curl -X GET "https://api.causeloop.ai/v1/audit?category=invite&date_from=2026-01-01&limit=50" \
    -H "Authorization: Bearer $TOKEN"
  ```

  ```bash Export audit log theme={null}
  curl -X POST "https://api.causeloop.ai/v1/audit/export" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"date_from": "2026-01-01", "date_to": "2026-06-30"}'
  ```
</CodeGroup>

| Method | Path               | Description                                |
| ------ | ------------------ | ------------------------------------------ |
| `GET`  | `/v1/audit`        | List audit entries (filterable, paginated) |
| `POST` | `/v1/audit/export` | Queue a CSV export of filtered entries     |

Query parameters for `GET /settings/audit`:

| Parameter   | Type    | Description                                              |
| ----------- | ------- | -------------------------------------------------------- |
| `q`         | string  | Full-text search                                         |
| `date_from` | string  | Start date (ISO 8601)                                    |
| `date_to`   | string  | End date (ISO 8601)                                      |
| `actor_id`  | string  | Filter to a specific actor                               |
| `action`    | string  | Exact action string or wildcard prefix (e.g. `member.*`) |
| `category`  | string  | Event category                                           |
| `limit`     | integer | Page size, 1–100 (default 25)                            |
| `cursor`    | string  | Pagination cursor from previous response                 |

For the full REST specification see [API Reference](/api-reference/overview).