M↓ View as Markdown ↗

Audit Logs¶

The audit log records who did what in your Actian AI Analyst organization: changes to the semantic layer, AI analysts, connections, Workspaces, members' organization-level access, API keys, integrations and more. Use it for compliance reviews, security investigations and troubleshooting.

Availability

Who can do this: members with the Manage organization capability (organization-level). The Administrator preset includes it.
Deployment: Actian SaaS and self-managed deployments.

If you don't hold Manage organization, Audit does not appear in your Settings menu.

Open the audit log¶

Open Settings (from Studio or Explorer).
Under Environment, select Audit.

The Audit page lists who did what in your organization, newest first.

What the log covers¶

The log covers the whole organization, not just the Workspace you have selected. It includes events from every Workspace and organization-level events.

Filter events¶

Use Filters to narrow the list. The panel shows how many filters are active.

Filter	What it does
From / To	Limits events to a date range. Dates are whole days in UTC, and both ends are included.
Initiator	Shows only events started by one person or one built-in service (for example `system:catalog-sync` or `system:steward-edit`). Choose All initiators to clear it.
Action family	Shows only one family of actions, for example `model`, `metric`, `workspace` or `api_key`. Choose All families to clear it.

The audit log has no keyword search, and you can't filter by resource type or IP address.

Note

The Initiator list includes every built-in service, even ones that have not acted in your organization. It also lists every person who has started at least one event. See Initiator and executor for how API keys appear.

Read the table¶

Column	Shows
Timestamp	Month, day and time of the event, in your browser's time zone.
Initiated by	The person or service that started the action. If someone or something else carried it out (the executor), its name is shown in muted text next to the initiator.
Action	The action code, in the form `subject.verb`, for example `model.update` or `workspace.member.set`.
Subject	The kind and ID of the item acted on, for example `Model <id>`.

The table loads 50 events at a time. Click Load more to see older events.

View event details¶

Click a row (or select it and press Enter or Space) to open the Audit event dialog. It shows:

Initiator: who asked for the action.
Executor: who carried it out. Shown only when it differs from the initiator.
Action and Subject.
Where: the Workspace the event was recorded in, or Organization when no Workspace is attached.
Trace ID: a correlation identifier, shown only when one was recorded.
Metadata: extra details that depend on the action, shown as JSON, or No metadata.

The full date and time appear under the fields.

What details are and are not in an entry

Audit entries do not contain field-level diffs or before-and-after snapshots, and they do not record IP addresses. To see earlier versions of a model, metric or glossary term, open its History tab.
Initiator and Executor show each person's display name from your identity provider, not a separate email field. Metadata is shown exactly as it was recorded, and for a few actions it can include an email address.
Where is not a reliable way to tell organization-level events apart. Many organization-level changes, such as Workspace, inference and connection-policy changes, are stamped with the Workspace the person had selected at the time. When a Workspace is deleted, its events show Organization.

Initiator and executor¶

Every event has an initiator (who asked for the action) and an executor (who performed it). Usually they are the same. They differ in cases like these:

Situation	Initiator	Executor
You approve an edit that Steward drafted	You	The Steward service that applies the edit
A Public API call exports or imports a Workspace	The member who created the API key	The API key, shown by its name
Scheduled or background work, such as a catalog sync	A built-in service, such as `system:catalog-sync`	The same service

Only the environment.export and environment.import entries are recorded with an API key as executor.

A Public API import also records the individual changes it makes, for example model.create. Those entries are attributed to the API key itself, shown by the key's name, so the key's name can appear in the Initiator list and column.

Creating, revoking and deleting API keys (api_key.create, api_key.revoke, api_key.delete) are recorded against the person who managed the key.

What is recorded¶

Each event has an action code in the form subject.verb. The first part is the action family that you can filter on.

Action family	Examples of what is recorded
`model`, `metric`, `glossary_term`, `glossary_mapping`	Creating, updating, deleting and restoring models, metrics and glossary terms, including restoring an earlier version. Changes to a model's dimensions, measures, filters and relationships are recorded as `model.update`.
`analyst`, `saved_prompt`, `suggestion`, `suggestion_category`	Creating, updating, duplicating, deploying, undeploying and deleting AI analysts; changes to their model, glossary and user access; saved prompts and suggestions.
`steward`, `steward-command`	Steward edits that were approved and applied, reverts, Steward memory and tool-permission changes, attachments and Steward commands.
`turn`	Starting, cancelling, approving or rejecting a conversation turn, answering a request for input, and feedback on answers.
`data_source`, `catalog_connection`, `catalog_sync`	Creating, updating, deleting, testing and sharing data connections; catalog connections and catalog syncs.
`schedule`, `inbox`, `artifact`, `task`	Scheduled Insights, Inbox actions, saving and sharing Artifacts, and sharing, renaming or deleting tasks.
`environment`	Workspace exports and imports (`environment.export`, `environment.import`). See Export and Import.
`audit`	Audit log exports (`audit.export`).
`api_key`, `integration`, `notification`	API keys, Slack and Microsoft Teams integrations and their notification routes, and notification preferences.
`workspace`	Creating, renaming and deleting Workspaces (`workspace.create`, `workspace.rename`, `workspace.delete`), and Workspace capability changes made on the Workspaces page (`workspace.member.set`, `workspace.member.remove`).
`org`	Changes to a member's organization-level capabilities (`org.member_role.update`), the connection-management policy (`org.connection_policy.set`), the chart theme, the organization's LLM and embedding endpoints (Settings → Inference; `org.llm_endpoint.set` / `.remove`, `org.embedding_endpoint.set` / `.remove`), and, where sign-up domains are available, sign-up domains and members who joined through one (`org.signup_domain.add` / `.remove`, `org.member.joined_by_signup_domain`).
`support`	Bug reports sent from the app. See What is shared with Actian.
`internal`	On Actian SaaS, actions Actian staff take on your organization. See Actions taken by Actian staff.
`operator`	On self-managed deployments, the first-run creation of the organization (`operator.bootstrap`).

Actions taken by Actian staff¶

On Actian SaaS, actions that Actian staff take on your organization appear in your audit log as internal.* actions, with the staff member's account shown as the initiator. On self-managed deployments you don't see internal.* events.

What is not recorded¶

Question text and answers. turn.start records who started a turn and when, not what was asked. To review conversations, use Monitoring.
Enterprise SSO and SCIM configuration. Setting up, changing or deleting the SSO connection, claiming or removing SSO domains, turning Require SSO on or off, and SCIM settings and tokens are not audited.
Member invitations and removals made in Settings → Members.
Workspace capability changes made from Settings → Members. Only changes to a member's organization-level capabilities are recorded there. Workspace capability changes made on the Workspaces page are recorded (workspace.member.set, workspace.member.remove).

Integrity¶

You can't edit or delete audit entries in the product, and you can't turn auditing off. Most entries are written in the same transaction as the change they describe. Some events, including starting a conversation turn, changes to a member's organization-level capabilities and the connection-management policy, are written separately on a best-effort basis: if writing the entry fails, the action itself still goes ahead.

Export the audit log¶

You can download the audit log as a CSV file. The file is prepared in the background, so large exports don't block the page.

On the Audit page, click Export. The Export audit log dialog opens with your current filters already filled in.
Adjust From, To, Initiator and Action family if needed. If either date is empty, the dialog warns: No date range selected — the export will include every matching event. Set a date range to keep the file small.
Click Export. While the dialog shows Preparing export…, the filters and the Export button are disabled.
When the dialog shows Ready followed by the filters used, click Download.
If the dialog shows Failed with The export failed. Try again., click Export to retry.

The file is named audit-export-<YYYY-MM-DD>.csv, using the date (in UTC) when you requested it.

What the CSV contains¶

The CSV starts with a header row, then one row per event, newest first. It contains every matching event up to the moment you clicked Export. Events recorded after that are not included.

Column	Contents
`id`	Event ID
`createdAt`	Date and time in ISO 8601 format, UTC
`action`	Action code, for example `model.update`
`subjectKind`, `subjectId`	Kind and ID of the item acted on
`initiatorId`, `initiatorName`	Who asked for the action (display name)
`executorId`, `executorName`	Who carried it out (display name)
`environmentId`, `environmentName`	The Workspace the event was recorded in. Blank for organization-level events.
`traceId`	Trace ID, when one was recorded
`metadata`	Action-specific details as a JSON object, or blank

The CSV has no separate email column.

Export limits¶

One export per person. Each person keeps one audit export at a time. Requesting a new export deletes your previous file. You can't start a new export while one is still being prepared.
Only you can download your export. Other administrators can't download a file you requested.
Size limit. Exports larger than about 100 MB fail with The export was too large. Narrow the filters and try again. Use a shorter date range or an Action family filter.
Exports are audited. Each export request is recorded as an audit.export event, with the filters used.