> ## Documentation Index > Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt > Use this file to discover all available pages before exploring further. # Audit log > Review a tamper-evident record of admin activity in your Ravenna organization, including configuration changes, integrations, and access policies. The audit log captures admin activity across your Ravenna organization. Use it to review who changed what and when, investigate incidents, and produce evidence for compliance reviews. *** ## Get started Click your organization name in the top left, then select **Settings** from the dropdown menu. Click **Audit log** in the left sidebar. The audit log requires the organization admin role. Members and guests cannot view audit events. *** ## What gets logged Ravenna records admin actions that change the configuration of your organization or workspaces. Each event captures the actor, target resource, action, timestamp, and a structured snapshot of the inputs. Events are recorded for areas including: * **Integrations** — connecting, configuring, or removing third-party integrations. * **Knowledge bases** — creating, updating, syncing, or deleting knowledge sources. * **Request types and forms** — publishing, editing, archiving, or deleting forms and fields. * **Agent models** — selecting or updating the LLM provider and model used by agents. * **Agents** — creating, updating, or deleting agents. * **Rules** — creating, updating, or deleting agent rules that govern automated behavior. * **Workflows** — creating, updating, deleting, activating, or deactivating workflows. * **SLAs** — creating, updating, or deleting service level agreements. * **Applications** — creating, updating, deleting, archiving, or unarchiving applications, including bulk actions and workspace assignment changes. * **Access and roles** — changes to admin roles and permission policies. * **Members** — adding or removing workspace members, updating organization or workspace member roles, and changes to user profiles. The audit log captures admin configuration changes. Day-to-day ticket activity (comments, status changes, assignments) is recorded on individual tickets, not in the audit log. *** ## Review events The audit log displays each event as a row with the actor, action, resource, and timestamp. ### Filter events Use the filter bar above the table to narrow results: * **Actor** — the user who performed the action. * **Resource type** — the kind of object changed (for example, integration, knowledge base, form, agent, rule, workflow). * **Resource** — a specific resource by name. * **Event name** — the action performed (for example, *Integration created*, *Form updated*). * **Date range** — restrict events to a specific time window. * **Outcome** — show only successful or failed actions. Filters combine with `AND` logic. Inline text filters save automatically when you click outside the input. ### Inspect an event Click any row to open the detail panel. The panel shows: * **Summary** — actor, action, resource, and outcome. * **Inputs** — the request payload submitted with the action, with sensitive values redacted. * **Context** — the originating IP address, user agent, and request ID. * **Errors** — the error message and code, when an action failed. Use the request ID when contacting Ravenna support. It links the audit event to the underlying request trace. *** ## Export events Export a filtered view of the audit log for offline review or to share with auditors. Narrow the audit log to the events you want to export. The export respects your active filters. Click **Export** in the top right of the audit log page. Ravenna generates a CSV file containing the filtered events and downloads it to your browser. Each row includes the event timestamp, actor, action, resource type, resource name, outcome, and a JSON snapshot of the action inputs. Exports are scoped to the events visible to you. Events older than your organization's retention window are not included. *** ## Common use cases * **Investigate an unexpected change** — filter by resource and date range to find the actor and action that produced the change. * **Review admin activity for a user** — filter by actor to see every configuration change a specific admin has made. * **Provide evidence for compliance** — export events for a defined window and share the CSV with auditors. * **Detect failed admin actions** — filter by outcome `failed` to identify permission errors or misconfigurations. ## Overview | Property | Detail | | -------- | ---------------------------------------------------- | | Scope | Organization | | Access | Organization admin only | | Location | Settings > Audit log | | Purpose | Tamper-evident record of admin configuration changes | *** ## Event model ### Properties | Field | Description | | ------------- | --------------------------------------------------------------------------------------------------- | | Actor | The user who performed the action. | | Action | The operation performed (create, update, delete, sync, and so on). | | Resource type | The category of the affected object (integration, knowledge base, request type, agent model, role). | | Resource | The specific object affected, by ID and display name. | | Outcome | `success` or `failed`. Failed events include the error message and code. | | Inputs | A redacted JSON snapshot of the request payload. | | Timestamp | When the event was recorded, in UTC. | | Request ID | Identifier that links the event to the originating request trace. | ### Tracked resources | Resource type | Example actions | | -------------------- | ------------------------------------------------------------ | | Integration | Connect, disconnect, update configuration | | Knowledge base | Create, update, sync, delete | | Request type / form | Create, publish, archive, delete, update fields | | Agent | Create, update, delete | | Agent model | Update LLM provider or model selection | | Rule | Create, update, delete | | Workflow | Create, update, delete, activate, deactivate | | SLA | Create, update, delete | | Application | Create, update, delete, archive, unarchive (single and bulk) | | Role / access policy | Update admin role assignments | | Workspace member | Add, remove, bulk remove, update role | | Organization member | Update role, bulk remove | | User | Update profile | ### Constraints * Events are recorded automatically by the platform. Admins cannot create, edit, or delete events. * Bulk actions (such as bulk delete or bulk archive) write one event per affected resource so each item can be traced individually. * Sensitive values (credentials, secrets, tokens) are redacted before the event is stored. * Events are retained according to your organization's retention policy. * Only organization admins can read or export events. *** ## Export | Format | Contents | | ------ | -------------------------------------------------------------------------------------------------------- | | CSV | One row per event with timestamp, actor, action, resource type, resource name, outcome, and JSON inputs. | Exports honor the filters applied to the audit log view at the time of export.