> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# View the audit log

> Filter, inspect, and export organization audit events from the dashboard.

## Overview

Sensitive changes create append-only audit events. In this guide you filter, inspect, export, and stream those events. Search is available on Teams and Enterprise; Enterprise also supports CSV/JSON export and external destinations.

## Open the log

**1. Go to Settings → Audit log**

You need `audit.read`. Destinations and retention need `organization.update`.

**2. Narrow the list**

Combine filters. Date bounds use UTC; displayed event times use your browser's timezone.

| Filter | Matches |
| - | - |
| Actor | User id, API key, service account, or system |
| Action | Distinct action names such as `flag.updated` |
| Project / environment | Denormalized ids on the event |
| Flag key | Resource `flag:<key>` |
| Source | Dashboard, CLI, API, SDK, or system |

**3. Open an event**

Click a row, or tab to it and press Enter, to see before/after JSON, request id, IP, user agent, and reason when present.

`shipd push --force` records reason **Forced CAS override**.

## Export a snapshot

Use **Export** on the events tab for CSV or JSON of the current filters (up to 10,000 rows). Narrow the date range if the export is truncated.

```csv CSV theme={null}
id,createdAt,action,resource,actorType,source
1042,2026-08-27T07:12:00.000Z,flag.updated,flag:new-checkout,user,cli
```

```json JSON theme={null}
{
  "id": 1042,
  "action": "flag.updated",
  "resource": "flag:new-checkout",
  "source": "cli",
  "reason": "Forced CAS override"
}
```

## Retention and destinations

On **Export & retention**:

* Request 7 days through 7 years, or forever. The effective value is capped by your entitlement (normally 7 days on Teams and 60 days on Enterprise); forever applies only to an unlimited entitlement. Events are never edited; expiry is the only delete.
* Add a **webhook** (HMAC-SHA256 over `timestamp.eventId.body` in `x-shipd-signature`; signing secret is at least 16 characters and generated for you), a **SIEM** endpoint (JSON, Splunk HEC, or Datadog logs), or an **S3-compatible** bucket. Events are delivered automatically after the change is saved.

Test a destination before you rely on it. Copy the webhook signing secret when you create the destination — it is shown once. Rotate it later from Edit; the current value is never returned again. SIEM tokens and S3 keys stay hidden after create.

Related: [Audit log](/reference/audit-log) for event fields and destination formats · [Resolve a push conflict](/config-as-code/conflicts).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.