Audit Logs

Audit logs record configuration and security events across your organization, including the actor, time, and affected resource. Use them to investigate changes and incidents.

Viewing audit logs

In the UI

Go to Settings → Organization → Audit logs in your workspace. Logs are displayed in a table with the following columns:

Column	Description
Timestamp	When the action occurred.
Event	The action taken, e.g. `workflow.created`.
Description	A human-readable summary of the action.
Actor	The email address of the user who performed the action.

Use the search bar, event type filter, and date range selector to narrow results.

Via API

Audit logs are also accessible through the Sim API for integration with external SIEM or log management tools.

GET /api/v1/audit-logs
X-API-Key: <api-key>

Query parameters:

Parameter	Type	Description
`action`	string	Filter by event type (e.g. `workflow.created`)
`resourceType`	string	Filter by resource type (e.g. `workflow`)
`resourceId`	string	Filter by a specific resource ID
`workspaceId`	string	Filter by workspace
`actorId`	string	Filter by user ID. For organization-wide filters, the actor must be a current or former org member; workspace-scoped logs can also include external workspace members.
`startDate`	string	ISO 8601 date — return logs on or after this date
`endDate`	string	ISO 8601 date — return logs on or before this date
`includeDeparted`	boolean	Include logs from members who have since left the organization (default `false`)
`limit`	number	Results per page (1–100, default 50)
`cursor`	string	Opaque cursor for fetching the next page

Example response:

{
  "data": [
    {
      "id": "abc123",
      "action": "workflow.created",
      "resourceType": "workflow",
      "resourceId": "wf_xyz",
      "resourceName": "Customer Onboarding",
      "description": "Created workflow \"Customer Onboarding\"",
      "actorId": "usr_abc",
      "actorName": "Alice Smith",
      "actorEmail": "alice@company.com",
      "workspaceId": "ws_def",
      "metadata": {},
      "createdAt": "2026-04-20T21:16:00.000Z"
    }
  ],
  "nextCursor": "eyJpZCI6ImFiYzEyMyJ9",
  "limits": {
    "workflowExecutionRateLimit": {
      "sync": { "requestsPerMinute": 60, "maxBurst": 10, "remaining": 59, "resetAt": "2026-04-20T21:17:00.000Z" },
      "async": { "requestsPerMinute": 30, "maxBurst": 5, "remaining": 30, "resetAt": "2026-04-20T21:17:00.000Z" }
    },
    "usage": { "currentPeriodCost": 1.25, "limit": 50, "plan": "enterprise", "isExceeded": false }
  }
}

Paginate by passing the nextCursor value as the cursor parameter in the next request. When nextCursor is absent, you have reached the last page. Each entry also includes actorName; metadata is an arbitrary per-action JSON object. The limits object reports your current rate-limit and usage status.

The API accepts both personal and workspace-scoped API keys. Rate limits apply — the response includes X-RateLimit-* headers with your current limit and remaining quota.

Event types

Audit log events follow a resource.action naming pattern. The table below lists the main categories.

Category	Example events
Workflows	`workflow.created`, `workflow.deleted`, `workflow.deployed`, `workflow.locked`
Workspaces	`workspace.created`, `workspace.updated`, `workspace.deleted`
Members	`member.invited`, `member.removed`, `member.role_changed`
Permission groups	`permission_group.created`, `permission_group.updated`, `permission_group.deleted`
Environments	`environment.updated`, `environment.deleted`
Knowledge bases	`knowledge_base.created`, `knowledge_base.deleted`, `connector.synced`
Tables	`table.created`, `table.updated`, `table.deleted`
API keys	`api_key.created`, `api_key.revoked`
Credentials	`credential.created`, `credential.deleted`, `oauth.disconnected`
Organization	`organization.updated`, `org_member.added`, `org_member.role_changed`

Workspace invitation events include whether the invite is for an internal organization member or an external workspace member in their metadata. External workspace members can appear as actors on workspace-scoped events, and appear in the roster with an External label without becoming organization members.

Common Questions

Organization owners and admins can view audit logs. On Sim Cloud, you must be on the Enterprise plan.

Audit log entries are append-only and cannot be modified or deleted through the Sim interface or API. They represent a reliable record of actions taken in your organization.

Yes. Use the API to export logs programmatically. Paginate through all records using the cursor parameter and store them in your own data warehouse or SIEM.

Audit logs are scoped to your organization and include activity across all workspaces within it. You can filter by workspaceId to narrow results to a specific workspace.

Each entry includes the event type, a description, the actor's name and email, the affected resource, the workspace, and a timestamp. IP addresses and user agents are not exposed through the API.

Yes. Pass the actorId query parameter to filter logs by a specific user. Organization-wide actor filters require the actor to be a current or former member of your organization. Workspace-scoped logs may also include external workspace members who acted inside a workspace without joining the organization.

Self-hosted setup

Self-hosted deployments use environment variables instead of the billing/plan check.

Environment variables

AUDIT_LOGS_ENABLED=true
NEXT_PUBLIC_AUDIT_LOGS_ENABLED=true

Once enabled, audit logs are viewable in Settings → Organization → Audit logs and accessible via the API.

GET /api/v1/audit-logs authenticates with an x-api-key whose owner is an admin or owner of an organization, so it is unreachable on a deployment where nobody belongs to one yet. On Sim Cloud it additionally requires an active Enterprise subscription; self-hosted, AUDIT_LOGS_ENABLED takes that role. The admin-key equivalent needs neither an organization nor a plan:

GET /api/v1/admin/audit-logs
x-admin-key: <admin-api-key>

It accepts the same filters plus actorEmail, drops includeDeparted, and paginates with limit (max 250) and offset instead of the organization endpoint's limit (max 100) and cursor. It returns entries across the whole deployment rather than one organization. GET /api/v1/admin/audit-logs/<id> returns a single entry. Set ADMIN_API_KEY to use it — see the self-hosted enterprise guide.