Skip to main content
Use this reference to decide what to look for in Audit logs. Each entry records an action, time, and outcome, with more details where available. A shield icon marks a security-critical event, such as a role change or database deletion. It indicates an action worth reviewing, not necessarily a problem.

Business systems

These events describe changes to the structure and setup of your system. Don’t use this list as a promise that every individual record edit or app visitor action is logged.

Authentication

These are organization account events. For the sign-in experience of people using a public app, see Authentication.

User management

For a credit-limit investigation, compare the member’s own limit with the organization default. See AI credit limits.

Organization

Events also cover organization name changes and deletion, along with changes to available security controls, such as disabling AI features or requiring an invitation for SSO access. Changes to connections managed by your IT team can appear too, including enabling access, replacing connection credentials, and creating or deleting developer applications.

Read an event’s details

Select a row in the audit log to see the information captured for that action. Depending on the event, this may include:
  • The affected item: such as a table, app, user, or group.
  • Before and after: for a name, role, setting, or credit limit.
  • What was included: such as imported tables or records.
  • Who and when: the person or connection responsible and the recorded time.
Not every event includes every detail. For filters, exports, and the 30-day retention window, see Audit logs overview.
Last modified on October 22, 2026