For AI agents: a documentation index is available at /llms.txt. A markdown version of this page is available at /guide/cloud/admin/audit-trail.md.

CloudAdministration

Audit trail

A record of who changed what and when — for compliance, incident review and settling disputes.

Premium Unlimited

The audit trail and activity logs are Premium features.

The audit trail records actions across the workspace: who did it, what changed, and when. It is the record you need when something is queried months later and nobody's memory is reliable.

#What it covers

AreaRecorded
AccessSign-ins, role changes, project membership
DataTask, project and field changes
TimeTimesheet submissions, approvals, corrections
AdminSettings, subscription, feature toggles
APIEvery Developer API and MCP request, with status code and response time

Individual tasks also carry their own activity history — see Task details. The audit trail is the workspace-wide view.

#What it's actually for

📋Compliance evidence

Demonstrating access control and change history to an auditor.

🔍Incident review

What changed just before things went wrong.

💰Billing disputes

When a client queries an invoice, the trail shows when time was logged, submitted, approved and amended.

🚪Offboarding checks

Confirming access was actually removed.

#Using it well

  1. Know how to search it before you need to

    Nobody learns a new tool well during an incident. Run a query now.

  2. Narrow by time first

    Then by person or object. Starting broad returns more than you can read.

  3. Establish the sequence

    The order of events usually tells you more than any single entry.

  4. Export what matters

    For a formal investigation or audit, export the relevant window rather than relying on it staying queryable.

#API and MCP activity

Every API request is logged with its status code and response time — including MCP tool calls from an AI assistant.

This is the authoritative record of what an assistant actually did, as opposed to what it reported doing. If you have connected a read-write key, this log is how you verify the workflows before widening trust.

Tip

One API key per integration makes this log far more useful — you can tell which system made each call.

#What it is not

Not a backup, and not a productivity monitor

The audit trail records that a change happened; it does not let you restore the previous state. And using it to monitor individual activity is both a poor measure and a fast way to lose the team's trust — it exists for security and compliance.