Audit Logs

Audit Logs allow Enterprise organizations to review security-related organization activity. Organization Owners and Organization Admins can use audit logs to check who performed an action, when it happened, which IP address it came from, and which organization resource was affected.

Audit Logs are available for Enterprise organizations on the Apidog SaaS plan, and are not yet enabled in on-premises (private deployment) builds. By default, audit log data is retained for 180 days.

Use Audit Logs for security reviews, internal audits, compliance checks, and investigating organization-level changes such as member updates, role changes, authentication activity, access token changes, SSO and SCIM activity, public access setting changes, and data exports.

Availability and Permissions

Role	View audit logs	Export CSV	Query with API
Organization Owner	Supported	Supported	Supported
Organization Admin	Supported	Supported	Supported
Organization Member	Not supported	Not supported	Not supported

Audit Logs are organization-level logs. Authentication events are displayed only when Apidog can reliably attribute the event to the organization.

View Audit Logs

Go to Organization Settings.

Navigate to the Security section.

Select Audit Logs.

The Audit Logs page displays organization-level events in a table. Each log entry includes the actor, event, description, IP address, and time.

Filter Audit Logs

Use filters to narrow down audit logs when investigating issues.

Filter	Description
Time range	Filter logs by Last 7 days, Last 30 days, Last 90 days, Last 180 days, or a custom time range within the 180-day retention period.
Event	Filter logs by event type, such as member role changes, failed sign-ins, access token changes, or audit log exports.
Actor	Filter logs by the user or integration that performed the action.

Export Audit Logs

You can export audit logs as a CSV file for offline review, security assessments, or archival workflows. CSV exports use the filters currently applied on the Audit Logs page and include matching logs within the 180-day retention period.

Apply the Filters you want to use.

Click Export Audit Logs.

Download the generated CSV file.

Exporting audit logs is itself recorded in Audit Logs.

Query Audit Logs with API

Enterprise organizations can query audit logs programmatically with the Audit Logs API. This is useful when your team wants to collect logs on a schedule and import them into an external SIEM, security monitoring system, or internal audit pipeline.

The Audit Logs API supports time-window queries and cursor pagination within the 180-day retention period. Each successful Audit Logs API query is recorded as a query summary, including details such as the caller, IP address, query time window, limit, results, and timestamp. Queries rejected by rate limiting are not recorded. The full returned payload is not copied into audit log metadata.

Audit Logs support API-based log collection. Native SIEM connectors, Syslog, generic webhook forwarding, and real-time log streaming are not yet supported.

Sensitive Data Protection

Audit logs are designed to record security-relevant activity without storing sensitive values. Apidog applies the same redaction policy across the Audit Logs page, CSV exports, and API responses.

Audit logs do not expose token values, passwords, secret values, raw SAML assertions, reset tokens, private keys, or exported content.

Event area	Sensitive data handling
Access tokens	Token values are not exposed.
SCIM	SCIM token values are not exposed.
Shared documents	Shared document passwords are not exposed.
Vault and secrets	Secret values are not exposed.
SSO	Raw SAML responses and assertions are not exposed.
Data exports	Exported file content is not copied into audit log metadata.

Supported Audit Log Events

The following event categories are supported in Audit Logs.

Category	Description
Members and permissions	One or more users were invited to join the organization.
Members and permissions	An external member whose email domain does not match the organization's allowed email domains was invited to join the organization, a team, or a project.
Members and permissions	A user became an organization member, such as through invitation acceptance, SCIM provisioning, SSO just-in-time joining, a project invite, or a team transfer.
Members and permissions	A member's organization-level role was changed.
Members and permissions	A member was removed from the organization, including manual removal or SCIM deprovisioning.
Members and permissions	An organization member was added to a team.
Members and permissions	A member's role in an organization team was changed.
Members and permissions	A member was removed from an organization team.
Members and permissions	Team membership was updated through SAML group mapping or directory sync.
Members and permissions	A custom organization project role was created.
Members and permissions	A custom organization project role was changed, such as its name or permissions.
Members and permissions	A custom organization project role was deleted.
Team governance	Ownership of one or more teams in the organization was transferred.
Organization boundary	An existing team was moved into the organization.
Organization boundary	The organization's member email domain restriction policy was enabled or disabled.
Organization boundary	The organization's allowed email domain list was changed.
Organization boundary	The organization's team creation policy was enabled or disabled.
Access tokens	An access token was created. Token values are not exposed.
Access tokens	Access token settings were changed. Token values are not exposed.
Access tokens	An access token was regenerated or rotated. Neither the old nor the new token value is exposed.
Access tokens	An access token was deleted or revoked.
Authentication and sessions	A user signed in successfully.
Authentication and sessions	A sign-in attempt failed.
Authentication and sessions	A SAML SSO sign-in failed.
Authentication and sessions	A user signed out.
Authentication and sessions	A user completed a password reset.
SSO and SCIM	The organization's SSO configuration was created or changed.
SSO and SCIM	The organization's SSO enforced authentication setting was enabled or disabled.
SSO and SCIM	The SCIM provisioning token was reset or regenerated. The token value is not exposed.
SSO and SCIM	A user was provisioned through SCIM.
SSO and SCIM	A user was deprovisioned through SCIM.
Data export	A data export request or export job was created.
Audit log activity	Audit logs were exported, such as through a CSV export.
Audit log activity	Audit logs were queried through the Audit Logs API.
Public access governance	A Docs Site's visibility or access settings changed.
Public access governance	A Docs Site's domain settings changed, including custom domain changes.
Public access governance	A shared document's visibility or access settings changed.
Public access governance	Password protection for a shared document changed. Password values are not exposed.
Vault and secrets	A vault provider configuration was created, changed, or deleted. Secret configuration values are not exposed.
Vault and secrets	Vault secret entries were changed. Secret values are not exposed.
Project lifecycle	A module was deleted from a project.
Project lifecycle	An environment was deleted from a project.
Project lifecycle	A project was deleted from the organization.
Authorization	Access to a protected resource or action was denied.

FAQs

Are Audit Logs the same as Team Activity?

No. Audit Logs focus on security-relevant organization activity and administrative actions. They are designed for organization-level security reviews, compliance checks, and audit workflows. Team Activity is used to track project and team collaboration activity.

Do Audit Logs include Resource History or rollback?

Do Audit Logs record full request and response bodies?

Availability and Permissions#

View Audit Logs#

Filter Audit Logs#

Export Audit Logs#

Query Audit Logs with API#

Sensitive Data Protection#

Supported Audit Log Events#

FAQs#

Availability and Permissions

View Audit Logs

Filter Audit Logs

Export Audit Logs

Query Audit Logs with API

Sensitive Data Protection

Supported Audit Log Events

FAQs