Audit Logs

Audit logs record configuration and security events across your organization, including the actor, time, and affected resource. Use them to investigate changes and incidents.

Viewing audit logs

In the UI

Go to Settings → Organization → Audit logs in your workspace. Logs are displayed in a table with the following columns:

Column	Description
Timestamp	When the action occurred.
Event	The action taken, e.g. `workflow.created`.
Description	A human-readable summary of the action.
Actor	The email address of the user who performed the action.

Use the search bar, event type filter, and date range selector to narrow results.

Via API

Audit logs are also accessible through the Sim API for integration with external SIEM or log management tools.

GET /api/v1/audit-logs
X-API-Key: <api-key>

Query parameters:

Parameter	Type	Description
`action`	string	Filter by event type (e.g. `workflow.created`)
`resourceType`	string	Filter by resource type (e.g. `workflow`)
`resourceId`	string	Filter by a specific resource ID
`workspaceId`	string	Filter by workspace
`actorId`	string	Filter by a current organization member’s user ID. For a departed-actor filter, use the CSV export with `includeDeparted=true`.
`startDate`	string	ISO 8601 date — return logs on or after this date
`endDate`	string	ISO 8601 date — return logs on or before this date
`includeDeparted`	boolean	Include logs from members who have since left the organization (default `false`)
`limit`	number	Results per page (1–100, default 50)
`cursor`	string	Opaque cursor for fetching the next page

Example response:

{
  "data": [
    {
      "id": "abc123",
      "action": "workflow.created",
      "resourceType": "workflow",
      "resourceId": "wf_xyz",
      "resourceName": "Customer Onboarding",
      "description": "Created workflow \"Customer Onboarding\"",
      "actorId": "usr_abc",
      "actorName": "Alice Smith",
      "actorEmail": "alice@company.com",
      "workspaceId": "ws_def",
      "metadata": {},
      "createdAt": "2026-04-20T21:16:00.000Z"
    }
  ],
  "nextCursor": "eyJpZCI6ImFiYzEyMyJ9",
  "limits": {
    "workflowExecutionRateLimit": {
      "sync": { "requestsPerMinute": 60, "maxBurst": 10, "remaining": 59, "resetAt": "2026-04-20T21:17:00.000Z" },
      "async": { "requestsPerMinute": 30, "maxBurst": 5, "remaining": 30, "resetAt": "2026-04-20T21:17:00.000Z" }
    },
    "usage": { "currentPeriodCost": 1.25, "limit": 50, "plan": "enterprise", "isExceeded": false }
  }
}

Paginate by passing the nextCursor value as the cursor parameter in the next request. When nextCursor is absent, you have reached the last page. Each entry also includes actorName; metadata is an arbitrary per-action JSON object. The limits object reports your current rate-limit and usage status.

The organization audit API requires a personal API key belonging to an organization owner or admin. Workspace API keys are refused. Rate limits apply — the response includes X-RateLimit-* headers with your current limit and remaining quota.

Event types

Audit log events follow a resource.action naming pattern. The table below lists the main categories.

Category	Example events
Authentication	`auth.login_succeeded`, `auth.login_failed`, `auth.logout`, `auth.impersonation_started`, `auth.impersonation_ended`, `auth.sessions_revoked`
Workflows	`workflow.created`, `workflow.deleted`, `workflow.deployed`, `workflow.locked`
Workspaces	`workspace.created`, `workspace.updated`, `workspace.deleted`
Members	`member.invited`, `member.removed`, `member.role_changed`
Permission groups	`permission_group.created`, `permission_group.updated`, `permission_group.deleted`
Environments	`environment.updated`, `environment.deleted`
Knowledge bases	`knowledge_base.created`, `knowledge_base.deleted`, `connector.synced`
Tables	`table.created`, `table.updated`, `table.deleted`
API keys	`api_key.created`, `api_key.revoked`
Credentials	`credential.created`, `credential.deleted`, `oauth.disconnected`
Organization	`organization.updated`, `org_member.added`, `org_member.role_changed`, `organization.sso_provider.updated`
Exports and drains	`audit_logs.exported`, `data_drain.created`, `data_drain.updated`, `data_drain.ran`, `data_drain.tested`

Authentication failures and password-reset requests use an anonymous actor and identify the target account separately. Impersonation and administrative session revocations identify the operator and the target organization. Table-row mutations record operation summaries and counts without copying row contents.

Most audit writes are best effort: a database outage or process loss can prevent persistence even when the underlying action succeeds. Deployment activation uses an awaited, idempotent audit insert before its outbox checkpoint. Audit logs are not a complete tool-invocation stream or a transactionally guaranteed ledger for every operation.

Organization visibility depends on current workspace ownership or stored organization attribution. Older workspace events without organization metadata may no longer appear in organization queries after the workspace is physically deleted.

Workspace invitation events include whether the invite is for an internal organization member or an external workspace member in their metadata. External workspace members can appear as actors on workspace-scoped events, and appear in the roster with an External label without becoming organization members.

Common Questions

Organization owners and admins can view audit logs. On Sim Cloud, you must be on the Enterprise plan.

The Sim interface and API do not provide audit-entry edits or deletion. Database administrators can still alter stored records, and entries are not cryptographically sealed. Use a data drain to archive them under your own storage and retention controls.

Yes. Download CSV from the audit viewer or paginate the API for your SIEM. CSV includes event, workspace, resource and actor IDs, IP address, user agent, surface and metadata. Organization administrators can include departed actors for historical investigations. CSV downloads are recorded in the audit trail and capped at 10,000 rows or 64 MiB. Oversized records also end the download early; the X-Export-Truncated header indicates a partial export. For continuous delivery, use an audit-log data drain.

Audit logs are scoped to your organization and include activity across all workspaces within it. You can filter by workspaceId to narrow results to a specific workspace.

Each entry includes the event type, a description, the actor's name and email, the affected resource, the workspace, and a timestamp. The JSON API omits IP addresses and user agents; authorized CSV exports and audit-log drains include them.

Yes. The JSON API accepts actorId for current organization members. CSV exports also support departed actors when includeDeparted=true. Workspace-scoped logs may include external workspace members who acted inside a workspace without joining the organization.

Self-hosted setup

Self-hosted deployments use environment variables instead of the billing/plan check.

Environment variables

AUDIT_LOGS_ENABLED=true
NEXT_PUBLIC_AUDIT_LOGS_ENABLED=true

Once enabled, audit logs are viewable in Settings → Organization → Audit logs and accessible via the API.

GET /api/v1/audit-logs authenticates with an x-api-key whose owner is an admin or owner of an organization, so it is unreachable on a deployment where nobody belongs to one yet. On Sim Cloud it additionally requires an active Enterprise subscription; self-hosted, AUDIT_LOGS_ENABLED takes that role. The admin-key equivalent needs neither an organization nor a plan:

GET /api/v1/admin/audit-logs
x-admin-key: <admin-api-key>

It accepts the same filters plus actorEmail, drops includeDeparted, and paginates with limit (max 250) and offset instead of the organization endpoint's limit (max 100) and cursor. It returns entries across the whole deployment rather than one organization. GET /api/v1/admin/audit-logs/<id> returns a single entry. Set ADMIN_API_KEY to use it — see the self-hosted enterprise guide.