> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Review a tamper-evident record of admin activity in your Ravenna organization, including configuration changes, integrations, and access policies.

The audit log captures admin activity across your Ravenna organization. Use it to review who changed what and when, investigate incidents, and produce evidence for compliance reviews.

## Overview

| Property | Detail                                               |
| -------- | ---------------------------------------------------- |
| Scope    | Organization                                         |
| Access   | Organization admin only                              |
| Location | Settings > Audit log                                 |
| Purpose  | Tamper-evident record of admin configuration changes |

***

## Event model

### Properties

| Field         | Description                                                                                         |
| ------------- | --------------------------------------------------------------------------------------------------- |
| Actor         | The user who performed the action.                                                                  |
| Action        | The operation performed (create, update, delete, sync, and so on).                                  |
| Resource type | The category of the affected object (integration, knowledge base, request type, agent model, role). |
| Resource      | The specific object affected, by ID and display name.                                               |
| Outcome       | `success` or `failed`. Failed events include the error message and code.                            |
| Inputs        | A redacted JSON snapshot of the request payload.                                                    |
| Timestamp     | When the event was recorded, in UTC.                                                                |
| Request ID    | Identifier that links the event to the originating request trace.                                   |

### Tracked resources

| Resource type        | Example actions                                              |
| -------------------- | ------------------------------------------------------------ |
| Integration          | Connect, disconnect, update configuration                    |
| Knowledge base       | Create, update, sync, delete                                 |
| Request type / form  | Create, publish, archive, delete, update fields              |
| Agent                | Create, update, delete                                       |
| Agent model          | Update LLM provider or model selection                       |
| Rule                 | Create, update, delete                                       |
| Workflow             | Create, update, delete, activate, deactivate                 |
| SLA                  | Create, update, delete                                       |
| Application          | Create, update, delete, archive, unarchive (single and bulk) |
| Role / access policy | Update admin role assignments                                |
| Workspace member     | Add, remove, bulk remove, update role                        |
| Organization member  | Update role, bulk remove                                     |
| User                 | Update profile                                               |

### Constraints

* Events are recorded automatically by the platform. Admins cannot create, edit, or delete events.
* Bulk actions (such as bulk delete or bulk archive) write one event per affected resource so each item can be traced individually.
* Sensitive values (credentials, secrets, tokens) are redacted before the event is stored.
* Events are retained according to your organization's retention policy.
* Only organization admins can read or export events.

***

## Export

| Format | Contents                                                                                                 |
| ------ | -------------------------------------------------------------------------------------------------------- |
| CSV    | One row per event with timestamp, actor, action, resource type, resource name, outcome, and JSON inputs. |

Exports honor the filters applied to the audit log view at the time of export.