Audit log
The audit log answers “who changed this, and when?”. Every change made in the workspace — through the web app, the Desk, an MCP token, the in-app assistant or an approval link — is written as one entry: the person or token, the time to the second, the IP address, the project, the item and the action, and for settings the fields that changed. Admins read it under Settings → Audit log; nobody can edit or delete an entry.
- Know what is recorded, and what is deliberately not
- Find who changed an item with the filters and the search
- Read what changed in a setting without ever seeing a secret
- Export the filtered entries to CSV
One entry per change
Recording happens in one place that every change passes through, so a new screen or tool cannot skip it: creating, editing, renaming, moving, deleting, publishing, running by hand, cancelling, approving and rejecting, and every change to people, access, variables, connections, schedules, endpoints, triggers, alerts, Git, SSO and billing. A run is one entry, never one per step.
- Not recorded: opening pages and ordinary reads, and runs that start on their own — from a schedule, an event trigger or a call to a published API endpoint.
- Recorded although they are reads: revealing a secret variable’s value, and exporting the audit log itself.
- Refusals: a change that fails is not an entry, except a refused attempt to change people, invitations or SSO, which is recorded with a Refused mark.
What an entry says
| Part | What it holds |
|---|---|
| Who | The person; a token with its name and its owner, such as Claude laptop (Ana Souza); an approval link with its label; or Waiso for the platform itself, such as an approval that timed out. |
| Channel | Web, Desk, MCP, Assistant, Link or System. |
| When | To the second, in your time zone — the line above the list names the zone. |
| Where | The project, or Workspace for a change outside any project, and the IP address the request came from. |
| What | The action and the item, with the item’s name as it was at that moment. A deleted item keeps its name and says it no longer exists. |
What changed
A change to a setting lists its fields as before → after: press Show what changed on the entry. A secret — a password, a key, a token, a secret variable’s value — only ever reads changed (secret, never shown), and code reads changed · 1,204 → 1,377 characters, never the code itself. Deleting a folder is one entry that counts the items removed (40 items), and each item removed is its own entry, so searching by a script’s name still finds it.
Find who changed something
- Open the audit log
Open Settings → Audit log. The newest entries come first, from the last 7 days.
- Narrow it down
Search by an item’s name, a project or a person, and combine the filters: person, project, item type, action and period — 24 hours, 7 days or 30 days. The line above the list counts the matching entries.
- Open the item
Click the item’s name to open it — the script in the editor, the flow on its canvas.
- Export it if you need it elsewhere
Export CSV downloads the entries the filters show, up to 100,000, in UTF-8 with times in UTC, so accents and commas open correctly in a spreadsheet. The export is itself an entry.
Who sees it, and for how long
- Only workspace admins read the audit log, through any channel. Members do not see the Settings item.
- Entries are kept for 30 days, then removed automatically. No screen, route, MCP tool or admin can edit or delete one before that.
- A period is at most 31 days long.