Audit Log

This guide walks you through viewing, filtering, and exporting a record of every action taken in your workspace. By the end, you'll know exactly where to find who did what — and when.

What gets logged

Obvious records actions across your workspace automatically. Every event captures who performed it, what happened, and the outcome. Here's what the audit log tracks:

• Workspace

• Auth — Sign-ins, sign-outs, and authentication events.

• Resource — Creating, updating, or deleting projects, documents, sheets, threads, files, and templates.

• Permission — Changes to who can access what — sharing a project, updating roles, removing access.

• Access — When someone views or opens a resource.

• System — Workspace-level events like settings changes.

What each event shows

Every entry in the log includes:

• Timestamp — When it happened.

• Actor — Who did it (a person, an agent, or an API key).

• Event type — The specific action (e.g., auth.login, resource.create).

• Category — Which category the event falls under.

• Resource — What was affected (a project, sheet, document, thread, etc.) and its ID.

• Action — A description of what happened.

• Outcome — Whether it succeeded, failed, or was denied.

• IP address — Where the request came from.

Open the audit log

Note: Only workspace Owners and Admins can access the audit log.

Open Settings → Workspace → Trust & Compliance → Audit Log. The log opens with your most recent events listed first.

The page shows a count of total events and how many are currently displayed. Click Load More at the bottom of the table to see older entries.

Filter events

The audit log can get busy. Filters help you find what you're looking for.

At the top of the audit log page, you'll see a filter panel with six options:

• Start Date and End Date — Narrow results to a specific time range.

• Category — Filter by Auth, Resource, Permission, Access, or System.

• Event Type — Search for a specific event type (e.g., auth.login).

• Actor ID — Filter to a specific person or agent.

• Outcome — Show only events that succeeded, failed, or were denied.

Set the filters you want, then click Apply Filters. The table updates immediately.

To start over, click Reset. All filters clear and the full log reappears.

Tip: Combine filters to answer specific questions fast. Looking for failed login attempts l…