Audit log

Who changed what in a workspace: the recorded events, their fields, filtering in the dashboard, the API and CSV export.

title: Audit log description: Who changed what in a workspace: the recorded events, their fields, filtering in the dashboard, the API and CSV export. order: 10#

The audit log records security-relevant changes in a workspace: keys, members, invites, agents, numbers, webhooks, exports, sign-in, billing and privacy actions. Admins read it on Settings, Audit Log. Beyond Retell

Settings, Audit Log: time, actor, action, target and details

What is recorded#

Entries are written in two ways: automatically when a listed write route succeeds, and explicitly by actions that need it (sign-ins, privacy reveals, transfers). Failed requests (status 400 or above) are not recorded.

Keys, members and workspace#

Action	Trigger
`api_key.create`, `api_key.update`, `api_key.delete`	API key created, access or webhook flag changed, deleted. Details include `name`, `scopes`, `allowed_ips`, `rate_limit_per_minute`
`public_key.create`, `public_key.delete`	Public key created or deleted
`member.add`, `member.role_change`, `member.remove`	Member added directly, role changed, removed
`invite.create`, `invite.revoke`	Invite sent or revoked
`workspace.update`	Name, webhook URL or concurrency limit changed
`webhook.update`	Workspace webhook URL changed, with the new `webhook_url`
`webhook.test`	Test webhook sent
`workspace.leave`, `workspace.transfer`	A member left; ownership transferred

Action	Trigger
`auth.sso_login`, `auth.saml_login`	Sign-in through OIDC SSO or SAML
`auth.2fa_enable`, `auth.2fa_disable`	Two-factor authentication turned on or off
`sso.update`, `sso.delete`	OIDC SSO configuration saved or removed
`workspace.saml_update`	SAML configuration saved
`workspace.scim_token_rotate`	SCIM token created or rotated

Build and deploy#

Action	Trigger
`agent.publish`, `agent.delete`, `agent.tag_move`, `agent.version_delete`	Agent version published, agent deleted, environment tag moved, version deleted
`llm.delete`, `flow.delete`, `knowledge_base.delete`	Engine or knowledge base deleted
`number.create`, `number.import`, `number.update`, `number.delete`, `number.bind_version`	Phone number bought, imported, updated, released, bound to a version

Data, privacy and billing#

Action	Trigger
`call.delete`, `contact.delete`, `batch_call.delete`	Records deleted
`call.remove_sensitive_data`	Remove sensitive data on a call, with redaction counts
`call.pii_reveal`	An admin revealed unscrubbed PII with Show PII
`export.create`, `export.download`	CSV export started or downloaded
`analysis.backfill`	Post-call analysis backfill started
`billing.settings_update`, `billing.add_credits`	Auto-recharge, budget or credit purchase
`kyc.submit`	Business verification submitted

Entry fields#

{
  "audit_log_id": "audit_5e2b7c1d9f0a3b4c6d8e1f2a",
  "actor_type": "user",
  "actor_id": "user_1a2b3c4d5e6f7a8b9c0d1e2f",
  "actor_label": "alex@example.com",
  "action": "api_key.create",
  "target_type": "api_key",
  "target_id": null,
  "details": { "name": "Production backend", "scopes": ["calls"] },
  "ip": "203.0.113.10",
  "created_timestamp": 1760668800000
}

Field	Values
`actor_type`	`user` (dashboard session), `api_key` (with the key's name as `actor_label`), or `system`
`target_type`, `target_id`	The resource changed, when the route names one
`details`	Selected request fields. Secrets are never included
`ip`	The client address the API saw

Filter in the dashboard#

The action filter offers All actions, API keys, Members and roles, Invites, Agents (publish, tags, delete), Phone numbers, Webhooks, Exports, Sign-in and 2FA and Billing. Each option matches actions that start with that prefix.

API#

GET /audit-log (admin only) returns the newest entries first.

Query parameter	Description
`action`	Prefix match, for example `api_key` or `auth.`
`actor_id`	Only this user or key
`before`	Timestamp in ms; entries created before it. Use the last entry's `created_timestamp` to page
`limit`	1 to 500, default 100

curl "https://api.tried.com.au/audit-log?action=member&limit=50" \
  -H "Authorization: Bearer $TRIED_API_KEY"

Export#

Export the log as CSV from the page, or create an export of kind audit_log on Exports. The CSV has created_timestamp, actor_type, actor_label, action, target_type, target_id, ip and details, up to 50,000 rows. The page notes Download it from Settings, Exports. once the export starts.

Retention#

Audit entries are kept until the workspace is deleted. They are not affected by an agent's call data retention setting.