Audit log

A record of sign-ins, invitations, role, security and configuration changes in your workspace, filterable by action and resource.

Administration → Audit log

The audit log is a running record of security- and configuration-sensitive events in your workspace: who signed in, who was invited, which roles and settings changed, and when. Use it to answer "who changed this?" and to show evidence for a compliance review.

Where to find it

Choose Admin in the sidebar, then Audit log under Access & governance.
Available on plans that include Audit logs.
It needs permission to read the audit log. Owners, Admins and Auditors have it by default; you can grant it to a custom role.

What is recorded

Each entry has an action, a resource and, where there is one, the record it concerns. Examples:

Sign-in and sign-out, and changes to two-factor authentication.
Invitations, member changes and password resets; role changes.
Changes to the workspace, projects, workflows, statuses, labels and custom fields.
API tokens, outbound webhooks, SCIM tokens and the IP allowlist.
Ticket automations, mailboxes, report schedules, the chat widget and change-freeze windows.
Ticket events such as merges, SLA holds and releases, and declaring a major incident.
Exports and erasures of a requester's personal data.

Everyday ticket edits, comments and status changes are not in the audit log; they are in each ticket's own activity history.

Read an entry

Entries are newest first, 25 to a page. Each row shows When, Actor (the person, or a dash for system events), Action, Resource (with the record's id) and the IP address it came from. Choose Details to see the browser's user agent and any extra information recorded with it, such as the old and new values.

Filter the log

Action: All actions, or one of Create, Update, Delete, Login, Logout, Invite, Assign and Transition. Merges and data exports are listed under All actions.
Filter by resource: type a resource name exactly as it appears in the Resource column, for example member, role or api-token. It matches whole names only.
The total number of matching entries is shown beside the filters.

Good to know