Skip to main content

​
Overview

Sensitive changes create append-only audit events. In this guide you filter, inspect, export, and stream those events. Search is available on Teams and Enterprise; Enterprise also supports CSV/JSON export and external destinations.

​
Open the log

1

Go to Settings → Audit log

You need audit.read. Destinations and retention need organization.update.
2

Narrow the list

Combine filters. Date bounds use UTC; displayed event times use your browser’s timezone.
3

Open an event

Click a row, or tab to it and press Enter, to see before/after JSON, request id, IP, user agent, and reason when present.
shipd push --force records reason Forced CAS override.

​
Export a snapshot

Use Export on the events tab for CSV or JSON of the current filters (up to 10,000 rows). Narrow the date range if the export is truncated.

​
Retention and destinations

On Export & retention:
  • Request 7 days through 7 years, or forever. The effective value is capped by your entitlement (normally 7 days on Teams and 60 days on Enterprise); forever applies only to an unlimited entitlement. Events are never edited; expiry is the only delete.
  • Add a webhook (HMAC-SHA256 over timestamp.eventId.body in x-shipd-signature; signing secret is at least 16 characters and generated for you), a SIEM endpoint (JSON, Splunk HEC, or Datadog logs), or an S3-compatible bucket. Events are delivered automatically after the change is saved.
Test a destination before you rely on it. Copy the webhook signing secret when you create the destination — it is shown once. Rotate it later from Edit; the current value is never returned again. SIEM tokens and S3 keys stay hidden after create. Related: Audit log for event fields and destination formats · Resolve a push conflict.