Audit log

The audit log records what changed in the account and who changed it: agents published, indexed or retagged, configuration parts and profiles edited, failed sign-ins, and events from the agent servers. Administrators read it in the UI; developers can read it through the API.

What produces an entry

• Agents: a draft published, with the fields that changed; a description submitted for indexing; indexing completed; indexing failed, with the reason; a description removed from search; a title, tag or run limit changed, with the old and new values; prompts added, changed or removed, by name only. Each entry names the agent.
• Configuration: a system configuration part created, updated or deleted: agent servers, encryption, secrets, authentication, compile rules, validation, allowlist, search, connection pools, hooks. The entry lists the names of the fields that changed, never their values. An allowlist change lists the entries added and removed.
• Profiles: an LLM, API, database or MCP profile created, updated or deleted, with the profile name and the names of the fields that changed.
• Sign-ins: repeated failed sign-ins for a user, one entry per three attempts, so that a continuing attack remains visible. A password reset requested for an email address the account does not know. The requester learns nothing either way; the entry is how an administrator sees the attempt.
• Agent servers: an agent server started, picked up a runtime change, shut down, or reported an error, with the server's name and version.

Every entry carries the time of the change and, where a person made it, the user's name and email. An entry is visible to the roles that could have made the change: an administrator-only setting produces an entry only administrators see.

Reading the audit log

The Audit log page opens from its icon in the UI's header, shown to administrators and the owner. Choose a time window, and narrow the list to one kind of entry or to the changes made by one user, identified by email. Entries are kept for 7 days. The paid service has no such limit.

Through the REST API, getAuditLog returns the same entries to developers and above.

Why the values are not shown

A configuration part may hold secrets or encryption settings, and developers can read the audit log through the API. Reporting the field names says what changed without exposing the new value. The current value is on the configuration page itself, where access depends on the role.