> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.ovalbee.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.ovalbee.com/_mcp/server.

# Audit log

The audit log records security-relevant actions. Where you open it depends on where OvalBee runs:

* **On your own installation**, instance administrators open it under **Admin** → **Audit log**. It shows the events of the current workspace together with instance-wide ones, such as accounts and sign-in providers changed by an administrator.
* **On OvalBee Cloud**, the owner of a workspace whose plan includes the audit log finds **Audit log** in the main sidebar. It shows that workspace's events only.

Each entry has the time, the person who acted, what they did, what it was done to, their IP address, and details such as the old and new role in a role change. Filter by kind of event, date range or person — **Filter by this actor** on any row narrows the log to one person — and use **Export CSV** to take the result into your own tools.

## What's recorded

| Area                           | Events                                                                                                                                                                                                            |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Sign-in**                    | Sign-ins and sign-outs, password changes and resets, email confirmation, linking an external identity.                                                                                                            |
| **Accounts**                   | Signups, profile changes, account deactivation and deletion.                                                                                                                                                      |
| **Members**                    | Members added, invited and removed, invitations accepted, cancelled and resent, role changes.                                                                                                                     |
| **Flow sharing**               | Access to a flow granted, changed or revoked.                                                                                                                                                                     |
| **API tokens** and **Secrets** | Created, updated, revoked or deleted.                                                                                                                                                                             |
| **Workspaces**                 | Created, renamed or deleted.                                                                                                                                                                                      |
| **Flows**                      | Created or deleted, published or unpublished as a public example, versions saved, restored or deleted.                                                                                                            |
| **Datasets** and **Assets**    | Datasets created or deleted, assets deleted.                                                                                                                                                                      |
| **Storage**                    | Storage providers of the workspace added, changed or removed (whether their credentials changed, never the credentials), storage buckets added, repointed or removed.                                             |
| **Instance administration**    | Accounts created, changed, deactivated and reactivated by an administrator, instance roles, passwords set by an administrator, sign-in providers added, changed or removed, node library refreshes, plan changes. |

The log never stores passwords, tokens, secret values or request bodies.

## How it behaves

* **Append-only.** Entries can't be edited or deleted from the app.
* **Recorded while it's on.** The audit log is part of paid plans, and events are recorded while the plan includes it. Turning it on later doesn't fill in what happened before.

## Related pages

* [Members and roles](/administration/members-and-roles) — the membership changes you'll see here.
* [Sign-in and accounts](/administration/sign-in-and-accounts) — sign-in events and account lifecycle.