Audit Log

The audit log records significant actions in your organization: sign-ins, member and role changes, invites, content changes, and access changes. Use it to answer who changed what, and when.

View the log

Open Admin > Audit. Each row shows:

• TIME the action happened.
• ACTOR who performed it. When an agent made the change, the row shows MCP or API and the name of the agent key.
• ACTION the event that occurred, such as auth.signin_failed.
• OBJECT what it affected.

Inspect an entry

Select a row to expand it. The detail view shows the actor IP address, user agent, and the full event metadata. An agent change names its key in key_id and key_name. When an access change records the old value, the metadata names it from or before.

Filter

• Type an action in the filter box, or up to 20 actions separated by commas, then select FILTER.
• Choose an actor, or leave it on All actors.
• Choose a source: Agent writes: MCP and API, MCP, or REST API.
• Choose Access changes to see only the events that change who can read or write content.
• To see the changes of one agent key, expand a row of that key and select Show the changes of this key. Remove the Key chip to see every key again.

Use NEWER and OLDER to page through results.

Access changes

These events change who can read or write content:

• Members and invites: role changes with the old role, removals, members who leave, scope changes, and invites that are sent, resent, revoked, or accepted.
• Agent access: agent keys that are created or revoked, and agents that a reader connects or disconnects. When an admin revokes the key or disconnects the agent of a member, the row has by: admin.
• Workspaces: created, deleted, and exported, and settings changes with the old and the new value, AI policy included.
• Sidebar sections: created, deleted, and visibility changes.
• Pages: status and visibility changes with the old and the new value, password and encryption changes, archives, and restores.
• Organization security: the two-factor policy, the agent key lifetime, custom domains, and changes to single sign-on, the allowed email domains, and your ContextOwl address. Each of the last three holds the old and the new value.
• Webhooks, import connections, and bundle imports.

A save that keeps every value of a workspace, a member, a page, or an organization security setting records nothing. The single sign-on row says whether the client secret changed, but never holds the secret.

The Recent activity feed on the Overview shows agent key, sign-in, account, invite, member, connected agent, organization, single sign-on, and webhook events to admins only. Other members see the page, section, workspace, and import events, also when they change access.

Access

The audit log is on every plan, the free plan included. Admins can open it. Rows for Open source plan decisions show ContextOwl as the actor.