Audit log

The audit log is a complete history of actions taken within your workspace. It records activity by both members and MCP tokens, and is designed for security audits and incident investigation.

Recorded events

• Membership changes (invite / remove / role change)
• Project create / delete
• Spec / case / report changes
• Token issue / revoke
• Billing plan changes

Retention

Export

Audit log export is available on the Team Plus plan. Download logs for a specified date range from Settings › Audit log › Export in the admin console.

Log structure

Each log entry contains the following JSON fields:

Copy{
  "eventType":    "<event type>",
  "actorId":      "<actor ID>",
  "actorType":    "USER | MCP_TOKEN",
  "resourceType": "<resource type>",
  "resourceId":   "<resource ID or null>",
  "metadata":     { "<additional info...>" },
  "workspaceId":  "<workspace ID or null>",
  "timestamp":    "<ISO 8601>",
  "sourceIp":     "<IP address or 'system' / 'mcp' / 'unknown'>"
}