Audit Logs
Audit logs record administrative and security events across your organization and its projects: who did it, what they changed or viewed, when, from where, and whether it worked. Use them for security reviews, investigations and compliance evidence.
Open Organization Settings → Audit Logs. Audit logs need the audit-logs entitlement (Enterprise plans). Viewing needs auditLogs.viewer:read: Owner, Security & Compliance and Auditor among the built-in roles. A member who holds this permission only through a project role sees only the entries for those projects.
Columns
| Column | Meaning |
|---|---|
| Time | When the event happened. |
| Project | The project, or an Organization badge for organization-wide events. |
| Actor | The user, the API key (by public key), or System for scheduled jobs. |
| Resource Type | What was acted on, such as apiKey, orgMembership, customRole or dataRetention. |
| Resource ID | The ID of that resource. |
| Action | What happened, such as create, update, delete or user.login. |
| Outcome | SUCCESS or FAILURE. |
| IP Address and User Agent | Where the request came from. |
| Before and After | The state of the resource before and after the change. |
The newest entries come first, 50 per page. The Content views filter limits the table to content view entries (see below). There is no search or date range in the viewer; export the log for other analysis. Each entry also keeps the actor's email, name and roles at the time of the event, and the person acted on where there is one, so entries stay meaningful after a user is deleted.
What is recorded
- Access and membership: invitations, organization and project role changes, removals, and custom role changes. See Members & Roles.
- Sign-in: sign-in, failed sign-in, sign-in code challenge, sign-up, sign-out, password reset requests and outcomes, and data processing consent accepted or withdrawn. See Authentication & Security.
- Keys and credentials: project and organization API keys, LLM connections, Budget AI keys and provider credentials (including blocks, unblocks, rotations and step-up bypasses), and Discover AI enrollment keys and device certificates.
- Settings: organization and project changes (including logos), data retention changes (
organization.data_retention_changed), integrations (Slack, Jira, Linear, PagerDuty, ServiceNow, PostHog, blob storage), directory and Microsoft 365 connectors, automations, exports and protected prompt labels. - Project content: prompts, datasets, scores and score configs, evaluators, annotation queues, comments, and trace deletions.
- Governance: guardrail and PII settings, compliance requests and approvals, evidence, agent profiles, AI Inventory changes and drift alerts.
- Content views: every time someone opens prompt or response content. See Content views.
- Export downloads: every download of an export file, with the user, the time and the file. See Export downloads.
- Page views: opening sensitive pages, such as API keys, project members, project General settings, the Governance Audit & Export page, PII settings and the audit log itself.
- Okta access reconciliation: drift found, members removed and aborted runs. See SCIM Provisioning.
Changes made through SCIM are not recorded.
Content views
Every opening of prompt or response content writes an audit entry. This covers opening a trace, in the side panel or as a full page, and opening a session. Each entry records:
- Actor: who opened the content, with their roles at the time.
- Resource Type and Resource ID: the trace or session that was opened, in its project.
- Time, IP Address and User Agent: when and from where.
In the console, only members with the content permission (pii:read) can open content, so content view entries show who actually read prompts and responses, not who only listed traces. See Data Privacy.
To review content access, turn on the Content views filter above the table. To answer "who read this person's prompts?", match the resource IDs of content view entries to that person's traces and sessions, or export the log and do the same in your own tools.
Export downloads
Every download of an export file writes an audit entry with the user who downloaded it, the time and the file. This covers table exports from Project Settings → Exports and from the Export ready notification, and audit log exports. Together with the entry written when the export is created, this is the chain of custody for each exported file. Each export file also carries a SHA-256 checksum. See Data Exports.
Export
Select Export above the table and choose CSV, JSON or JSONL. The export runs in the background and contains every entry you can see. Downloading the file is itself recorded as an export download. When it is ready you get an email (if the deployment can send email) and an in-app notification with the download link. Download links stay valid for one hour. Audit log exports do not appear in a project's Exports tab.
The export file has these fields: id, createdAt, updatedAt, type, apiKeyId, userId, orgId, userOrgRole, projectId, userProjectRole, resourceType, resourceId, action, before, after. It does not include the actor's email or name, the outcome, the IP address or the user agent. For those, use the S3 stream below.
Stream to S3 for your SIEM
A deployment can copy audit log entries to an S3 or S3-compatible bucket on a schedule, for your SIEM to collect. This is set with environment variables on the deployment. On a deployment managed by ANTS Platform, ask your ANTS Platform team.
| Setting | Default | Meaning |
|---|---|---|
LANGFUSE_S3_AUDIT_LOG_EXPORT_IS_ENABLED | false | Turns the export on. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_BUCKET, _PREFIX, _REGION, _ENDPOINT | none | Destination. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_ACCESS_KEY_ID, _SECRET_ACCESS_KEY | none | Credentials. Can be left empty when the deployment's cloud role can write to the bucket. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_SSE, _SSE_KMS_KEY_ID | none | Server-side encryption: AES256 or aws:kms. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_CRON | 0 * * * * | Schedule. Hourly by default. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_INCLUDE_DIFFS | false | Include the before and after state. |
LANGFUSE_S3_AUDIT_LOG_EXPORT_START_AT | none | Earliest entry to export. |
How the files look:
- One JSON object per line (
.jsonl). - Files are grouped by organization and day:
<prefix>audit-logs/org_id=<organization id>/dt=<YYYY-MM-DD>/. Grant each consumer read access to its own organization's path. - Entries with no organization, such as a failed sign-in for an unknown email, go under
org_id=_unscoped. - Before and after state is left out by default. When it is included, credential fields such as secret keys and client secrets are replaced with
[REDACTED]. - Each run continues from the last exported entry. Delivery is at least once, so deduplicate on the entry
id. - Files are not compressed.
Retention
Audit log entries are kept indefinitely. The organization data retention setting does not delete them.
Next steps
- Audit & Export: generate audit and evidence reports for governance.
- Members & Roles: who can view audit logs.
- Access Control (RBAC): the permission model.