Audit log

See who changed what in your organization, and when. Open Logs > Audit in the console.

Permission

Needs See sign-in and audit logs.

What's recorded

The audit log records every change made:

• by admins in the console
• by API keys, through the management API and SCIM
• by Fob itself, such as creating a user the first time they sign in through your identity provider

It also records when someone reads something sensitive: exporting users (user.exported), exporting the audit log (audit.exported) and revealing a webhook's signing secret (webhook.secret_revealed).

Nobody can edit or delete entries, including Fob. Sign-in attempts aren't in the audit log; see Logs > Sign-ins for those.

Each entry has:

Field	Contents
Time	When the change happened. Hover over it for the full date and the IP address.
Actor	The admin's email or the API key's name. Kept even after the admin or key is deleted. Empty for changes Fob made itself.
Action	What changed, such as user.invited or application.secret_rotated.
Target	The ID of what changed.
IP	Where the change came from.
Details	The change's data, as JSON.

Changes to users, groups, apps and settings are also sent as webhook events.

Search the audit log

Filter the list with:

• Search: text anywhere in the action, the actor, the IP address or the details.
• Type of change: People, Groups and admin roles, Apps, Sign-in and security, Single sign-on, API keys and webhooks, Domains and branding, Access, or Organization and admins.
• When: any time, or the last 24 hours, 7, 30 or 90 days.

The page loads 100 entries at a time. Choose Show older for more.

Export the audit log

Choose Export, then CSV or JSON Lines. The file holds everything that matches your current filters, newest first, up to 100,000 entries. CSV files are safe to open in a spreadsheet.

CSV columns:

id,time,actor_type,actor,action,project,target_id,ip,details

actor_type is user for an admin, api_key or fob. project is your organization's address, such as acme, and is empty for changes to admins and other organization-wide settings.

JSON Lines files have one entry per line:

{"id":"0193a3c1-7e4b-7c1a-9d2e-1f0a2b3c4d5e","action":"user.invited","actor_type":"user","actor":"ada@acme.com","actor_email":"ada@acme.com","actor_api_key":null,"project_slug":"acme","target_id":"0193a3c1-7e4b-7c1a-9d2e-5e4d3c2b1a0f","data":{"email":"grace@acme.com"},"ip":"203.0.113.7","created_at":"2026-11-09T10:15:00Z"}

Retention

Data	Kept for
Audit log	365 days
Sign-in log	365 days
Webhook messages	30 days

Deleting your organization deletes its logs.