Skip to content
Featurebase Featurebase Featurebase
Dashboard
API Reference

Audit Logs

Audit logs provide a chronological record of significant admin actions in your organization. Use them for security auditing, compliance reporting, and tracking workspace changes.

List audit logs
GET/v2/audit-logs
ModelsExpand Collapse
AuditLogListResponse object { id, action, actor, 8 more }
id: string

Unique event identifier

action: "auth.login" or "auth.logout" or "auth.login_failed" or 144 more

The type of action that was performed

One of the following:
"auth.login"
"auth.logout"
"auth.login_failed"
"auth.password_reset_requested"
"auth.password_changed"
"auth.mfa_enabled"
"auth.mfa_disabled"
"auth.sso_login"
"auth.password_reset_completed"
"auth.unauthorized_method"
"auth.recovery_code_regenerated"
"auth.sso_enforcement_blocked"
"auth.sso_enforcement_session_invalidated"
"auth.managed_account_link_blocked"
"auth.cross_org_invite_accepted"
"auth.sso_enforcement_shadow"
"teammate.invited"
"teammate.joined"
"teammate.removed"
"teammate.email_changed"
"teammate.name_changed"
"teammate.seat_changed"
"teammate.deactivated"
"teammate.invite_changed"
"teammate.invite_deleted"
"teammate.scim_provisioned"
"teammate.scim_deprovisioned"
"teammate.scim_unlinked"
"teammate.scim_relinked"
"teammate.scim_operation_blocked"
"teammate.scim_seat_capacity_blocked"
"teammate.scim_email_updated"
"teammate.scim_exclusion_list_updated"
"teammate.restored"
"teammate.scim_restored"
"teammate.scim_auto_claimed"
"teammate.scim_claim_role_preserved"
"teammate.permanently_removed"
"member.role_changed"
"organization.owner_transferred"
"article.created"
"article.updated"
"article.body_edited"
"article.published"
"article.unpublished"
"article.deleted"
"changelog.created"
"changelog.published"
"changelog.deleted"
"changelog.unpublished"
"settings.name_changed"
"settings.branding_updated"
"settings.custom_domain_changed"
"settings.language_changed"
"settings.timezone_changed"
"settings.email_settings_changed"
"settings.help_center_updated"
"settings.moderation_changed"
"settings.voting_changed"
"settings.statuses_updated"
"settings.boards_updated"
"settings.privacy_changed"
"settings.subdomain_changed"
"settings.subdomain_change_requested"
"settings.grace_period_changed"
"security.scim_override_blocked"
"security.sso_enabled"
"security.sso_disabled"
"security.sso_configured"
"security.sso_jit_provisioning_blocked"
"security.directory_sync_enabled"
"security.directory_sync_disabled"
"security.directory_sync_reconciled"
"security.two_factor_enforced"
"security.auth_method_changed"
"security.ip_allowlist_changed"
"security.ip_allowlist_blocked"
"security.identity_verification_changed"
"security.sso_url_changed"
"security.sso_jit_provisioning_changed"
"security.sso_enforcement_enabled"
"security.sso_enforcement_disabled"
"security.dsync_group_mappings_changed"
"security.dsync_mapping_priority_changed"
"security.user_banned"
"security.user_unbanned"
"integration.installed"
"integration.uninstalled"
"integration.configured"
"webhook.created"
"webhook.updated"
"webhook.deleted"
"webhook.secret_rotated"
"api_key.created"
"api_key.regenerated"
"api_key.deleted"
"organization.deletion_scheduled"
"organization.deletion_cancelled"
"data.export_initiated"
"data.import_initiated"
"data.bulk_delete"
"data.user_data_deleted"
"data.csv_exported"
"billing.plan_changed"
"billing.plan_cancelled"
"billing.seat_limit_changed"
"billing.seat_activated"
"workflow.created"
"workflow.activated"
"workflow.deactivated"
"workflow.deleted"
"workflow.updated"
"messenger.look_and_feel_changed"
"messenger.spaces_changed"
"messenger.language_changed"
"messenger.platform_availability_changed"
"messenger.search_browse_changed"
"messenger.email_collection_changed"
"messenger.welcome_message_changed"
"messenger.launcher_changed"
"messenger.inbound_conversations_changed"
"messenger.office_hours_changed"
"messenger.identity_verification_changed"
"messenger.privacy_policy_changed"
"brand.created"
"brand.updated"
"brand.deleted"
"brand.messenger_look_and_feel_changed"
"brand.messenger_launcher_changed"
"brand.messenger_welcome_message_changed"
"brand.messenger_privacy_policy_changed"
"brand.default_changed"
"ai_agent.enabled"
"ai_agent.disabled"
"ai_agent.identity_changed"
"ai_agent.customization_changed"
"ai_agent.guidance_changed"
"ai_agent.multilingual_changed"
"ai_agent.data_context_changed"
"email.sending_address_created"
"email.sending_address_updated"
"email.sending_address_deleted"
"email.domain_registered"
"email.domain_deleted"
"email.reply_to_changed"
"email.ignored_address_added"
"email.ignored_address_removed"
actor: object { id, apiKey, email, 2 more }
id: string

Featurebase user ID of the actor, or null for system actors

apiKey: object { id, name }

API key that authenticated the request, or null for dashboard sessions

id: string

API key ID

name: string

API key name

email: string

Email address of the actor

name: string

Display name of the actor

type: "admin" or "system" or "api_key" or "integration"

The type of actor that performed the action

One of the following:
"admin"
"system"
"api_key"
"integration"
correlationId: string

Groups related events from a single operation (e.g. bulk import)

createdAt: string

ISO 8601 timestamp of when the event occurred

description: string

Pre-rendered human-readable description of the event

domain: "authentication" or "team_management" or "permissions" or 12 more

The domain/category the action belongs to

One of the following:
"authentication"
"team_management"
"permissions"
"articles"
"changelog"
"workspace_settings"
"security"
"integrations"
"data_management"
"billing"
"workflows"
"messenger"
"brands"
"ai_agent"
"email_config"
metadata: map[unknown]

Event-specific payload with before/after state when applicable. The shape of this object depends on the action type.

object: "audit_log"

Object type identifier

request: object { ipAddress, userAgent }
ipAddress: string

IP address the request originated from

userAgent: string

User-Agent header from the request

resource: object { id, name, type }
id: string

ID of the affected resource, or null for organization-level events

name: string

Display name of the affected resource

type: string

Type of the affected resource