Audit logs

Organization administrators can use audit logs to review security-relevant changes in Inspect. Open Organization → Audit logs. Other organization members cannot access the page or its audit-log API.

What you can reviewCopy Anchor Link

The audit log shows when an action occurred, who performed it, the action type, client IP address and user agent, and any related API key prefix or Inspect session. Depending on the action, the API and CSV export can also include user IDs and event-specific details.

Some fields are empty when they do not apply or the related user or session is no longer available. Audit logs include only an API key prefix, never the complete credential.

Recorded actionsCopy Anchor Link

Inspect currently records the following action types. An organization only sees events for features it uses. Some identifiers are retained for historical events.

• API keys and sessions: api_key.created, api_key.rotated, api_key.revoked, api.called, session.revoked
• Organization access and policy: private_networking.updated, sign_in_policy.updated, sso_provider.registered, sso_provider.deleted, oidc_signing_keys.revoked, legal_agreement.accepted
• Invitations and users: user_invitation.created, user_invitation.resent, user_invitation.revoked, user_invitation.accepted, user_role.granted, user_role.revoked, user.deactivated, user.reactivated, user.updated
• Authentication and administrative access: auth.signed_out, auth.account_linked, auth.account_unlinked, auth.identity_verification_required, auth.identity_verification_failed, auth.identity_verified, user_impersonation.started, user_impersonation.stopped
• Repositories: repository.added, repository.removed
• Connectors: connector.created, connector.updated, connector.deleted, connector_authorization.connected, connector_authorization.enabled, connector_authorization.disabled, connector_authorization.removed
• Datadog automation setup and triggers: datadog_installation.created, datadog_installation.revalidated, datadog_installation.deleted, datadog_trigger.created, datadog_trigger.updated, datadog_trigger.deleted, datadog_trigger.retried, datadog_secret.rotated, datadog_cleanup.failed
• Secrets: organization_secret.updated, organization_secret.deleted, provider_secret.updated, provider_secret.deleted, egress_secret.created, egress_secret.updated, egress_secret.deleted
• Historical and specialized operations: experiment.updated, experiment_variant.updated, preview_qa_session.created, preview_qa_session.redeemed, triage_board.cleared

Connector authorization events are recorded after a connection or lifecycle change succeeds. Failed connection attempts are not included.

Find and export eventsCopy Anchor Link

Entries appear newest first and default to the current month. Filter by a preset or custom date range and an exact action type. Search is case-insensitive across the action, actor, API key prefix, IP address, user agent, and session ID. Event-specific details are not searchable.

Results are paginated with 50 or 100 entries per page. To download every matching entry in the selected date range, apply any filters or search term and choose Export CSV. The export includes timestamps, actions, actor details, client details, API key and session identifiers, and event-specific details as JSON.

Inspect does not currently provide scheduled exports, continuous audit streaming, or built-in SIEM forwarding.

Retention and limitationsCopy Anchor Link

Audit-log retention is not configurable, and Inspect does not currently specify a fixed retention period. Export the records you need if your organization requires an external archive or a specific compliance window.

Audit logs cover the actions listed above. They are not a complete transcript of session prompts, agent tool calls, code changes, or network requests. Inspect does not record standard egress logs for sandbox requests sent through private networking.