Audit log

What is recorded

The audit log is under Settings → Team → Audit log. Each entry records the action, what it acted on, who attempted it, and the outcome: succeeded, denied, or failed. The actor is a user or one of their access tokens. Refused attempts are recorded too, so you can see when someone tried something their role or token did not allow.

Reading a credential leaves an entry, as a change does. Revealing a database password or opening an environment version is recorded.

Filtering

actor (user or token)   action, e.g. deployment.create, database-user.reveal
target type and id      outcome
occurred between        from / to

The app filters by action and outcome. The API takes every filter above. Results are paged in order, so entries added while you read neither shift the page nor repeat rows.

Retention

Nobody can edit or delete an entry, in the app or over the API. Entries are removed only when they reach 400 days old, or when the team itself is deleted.