Audit Logs

Audit Logs allow Enterprise organizations to review security-related organization activity in Apidog. Organization Owners and Organization Admins can use audit logs to check who performed an action, when it happened, which IP address it came from, and which organization resource was affected.

Audit Logs are available for Enterprise organizations. Audit log data is retained for 180 days.

Use Audit Logs for security reviews, internal audits, compliance checks, and investigating organization-level changes such as member updates, role changes, authentication activity, access token changes, SSO and SCIM activity, public access changes, and data exports.

Availability and Permissions

Role	View audit logs	Export CSV	Query with API
Organization Owner	Supported	Supported	Supported
Organization Admin	Supported	Supported	Supported
Organization Member	Not supported	Not supported	Not supported

Audit Logs are organization-level logs. Authentication events are displayed only when Apidog can reliably attribute the event to the organization.

View Audit Logs

Go to Organization Settings.

Navigate to Security section.

Select Audit Logs.

The Audit Logs page displays organization-level events in a table. Each log entry includes the actor, event, description, IP address, and time.

Filter Audit Logs

Use filters to narrow the audit log list during an investigation.

Filter	Description
Time range	Filter logs by Last 7 days, Last 30 days, Last 90 days, Last 180 days, or a custom time range within the 180-day retention period.
Event	Filter logs by event type, such as member role changes, login failures, access token changes, or audit log exports.
Actor	Filter logs by the user or integration that performed the action.

Export Audit Logs

You can export audit logs as a CSV file for offline review, security assessments, or archival workflows. CSV exports use the filters currently applied on the Audit Logs page and include matching logs within the 180-day retention period.

Apply the Filters you want to use.

Click Export Audit Logs.

Download the generated CSV file.

Exporting audit logs is also recorded in Audit Logs as.

Query Audit Logs with API

Enterprise organizations can query audit logs programmatically with the Audit Logs API. This is useful when your team wants to collect logs on a schedule and import them into an external SIEM, security monitoring system, or internal audit pipeline.

The Audit Logs API supports time-window queries and cursor pagination within the 180-day retention period. Each Audit Logs API query is recorded as a query summary including details, such as the caller, IP address, query window, limit, result, and timestamp. It does not copy the full returned payload into the audit log metadata.

Audit Logs support API-based log collection. Native SIEM connectors, Syslog, generic webhook forwarding, and real-time log streaming are not yet supported.

Sensitive Data Protection

Audit logs are designed to record security-relevant activity without storing sensitive values. Apidog uses the same redaction policy in the Audit Logs page, CSV exports, and API responses.

Audit logs do not expose token values, passwords, secret values, raw SAML assertions, reset tokens, private keys, or exported content.

Event area	Sensitive data handling
Access tokens	Token values are not exposed.
SCIM	SCIM token values are not exposed.
Shared documents	Shared document passwords are not exposed.
Vault and secrets	Secret values are not exposed.
SSO	Raw SAML responses and assertions are not exposed.
Data exports	Exported file content is not copied into audit log metadata.

Supported Audit Log Events

The following event categories are supported in Audit Logs.

Category	Description
Members and permissions	One or more people were invited to join the organization.
Members and permissions	A user became an organization member, such as through invitation acceptance, SCIM provisioning, SSO just-in-time joining, project invite, or team transfer.
Members and permissions	A member's organization-level role was changed.
Members and permissions	A member was removed from the organization, including manual removal or SCIM deprovisioning.
Members and permissions	An organization member was added to a team.
Members and permissions	A member's role within an organization team was changed.
Members and permissions	A member was removed from an organization team.
Members and permissions	Team membership was updated by SAML group mapping or directory sync.
Organization boundary	An existing team was moved into the organization.
Members and permissions	A custom organization project role was created.
Members and permissions	A custom organization project role was changed, such as its name or permissions.
Members and permissions	A custom organization project role was deleted.
Access tokens	An access token was created. Token values are not exposed.
Access tokens	Access token settings were changed. Token values are not exposed.
Access tokens	An access token was regenerated or rotated. Old and new token values are not exposed.
Access tokens	An access token was deleted or revoked.
Authentication and sessions	A user signed in successfully.
Authentication and sessions	A sign-in attempt failed.
Authentication and sessions	A SAML SSO sign-in failed.
Authentication and sessions	A user signed out.
SSO and SCIM	The organization's SSO configuration was created or changed.
SSO and SCIM	The SCIM provisioning token was reset or regenerated. The token value is not exposed.
SSO and SCIM	A user was provisioned through SCIM.
SSO and SCIM	A user was deprovisioned through SCIM.
Data export	A data export request or export job was created.
Audit log activity	Audit logs were exported, such as through a CSV export.
Public access governance	A Docs Site's visibility or access settings changed.
Public access governance	A Docs Site domain setting changed, including custom domain changes.
Public access governance	A shared document's visibility or access settings changed.
Public access governance	Password protection for a shared document changed. Password values are not exposed.
Vault and secrets	A vault provider configuration was created, changed, or deleted. Secret configuration values are not exposed.
Vault and secrets	Vault secret entries were changed. Secret values are not exposed.
Authentication and sessions	A user completed a password reset.
Authorization	Access to a protected resource or action was denied.
Audit log activity	Audit logs were queried through the Audit Logs API.

FAQs

Are Audit Logs the same as Team Activity?

No. Audit Logs focus on security-relevant organization activity and administrative actions. They are designed for organization-level security reviews, compliance checks, and audit workflows. Team Activity is used to track project and team collaboration activity.

Do Audit Logs include Resource History or rollback?

Do Audit Logs record full request and response bodies?

Availability and Permissions#

View Audit Logs#

Filter Audit Logs#

Export Audit Logs#

Query Audit Logs with API#

Sensitive Data Protection#

Supported Audit Log Events#

FAQs#

Availability and Permissions

View Audit Logs

Filter Audit Logs

Export Audit Logs

Query Audit Logs with API

Sensitive Data Protection

Supported Audit Log Events

FAQs