Audit log

Overview

Use Settings → Audit log to inspect, export, and stream the history of changes to your organization. Events are append-only. Membership, invitation, and team events can appear shortly after the change.

Event fields

Field	Meaning
`id`	Identity cursor, newest first
`organizationId`	Organization that owns this event, included in both export formats
`actorId` / `impersonatorId`	Acting identity and, when applicable, the impersonating operator
`action`	`flag.updated`, `member.invited`, `team.created`, `project.teams.updated`, …
`resource`	`flag:new-checkout`
`actorType`	`user`, `api_key`, `service_account`, or `system`
`tokenId`	Service-account token that performed the mutation; `null` otherwise
`source`	`dashboard`, `cli`, `api`, `sdk`, `system`
`projectId` / `environmentId`	Project and environment identifiers remain available for filtering after archive
`before` / `after`	JSON snapshots of the mutation
`requestId` / `correlationId`	HTTP request ids when the write came from the API
`ipAddress` / `userAgent`	Client provenance
`reason`	Optional human note (`Forced CAS override` on `shipd push --force`)

Sensitive fields are redacted from event snapshots. Credentials, key hashes, tokens, and identity assertions must not be used as audit evidence. The dashboard renders snapshots as text. Date-only filters use UTC day boundaries; event timestamps display in your browser’s timezone. Organization journal events use actions such as member.added, member.role.updated, member.invitation.accepted, and team.member.removed. Invitation events reference invitation:<id>. Other identity journal events use identity.<table>.<operation> actions; impersonation sessions produce impersonation.started and impersonation.ended events.

Export

Audit-log search is available on Teams and Enterprise. Export is Enterprise-only. Export uses the same filters as the list, is capped at 10,000 rows per batch, and supports CSV and JSON. Each export reflects a consistent view of the matching events. Each request records started and completed or failed events. A successful response reports its row count and a nextCursor when the cap was reached. Use Export next batch, or pass that cursor with the same filters to the export API, to retrieve older events. Requests are limited to 60 seconds. Downloads require audit-read access and the export entitlement; responses are not cacheable. Downloads do not create a hosted artifact URL. CSV cells that start with =, +, -, or @ are prefixed so spreadsheet apps will not treat them as formulas.

Retention

Setting	Meaning
Missing row	365-day request, capped by the plan and protected minimum
`7`–`2555`	Requested days, subject to the plan and protected minimum
`null`	Keep forever; accepted only when the entitlement is unlimited

Events expire according to your effective retention policy. The configured window is capped by the plan entitlement, but a protected contractual minimum takes precedence over that cap. A retention hold prevents expiry and customer retention changes. Retention settings remain attached to audit history after organization deletion. IP addresses and user agents follow the same event retention window, including holds; they are not retained under a separate indefinite policy. Exported copies are governed by the recipient’s retention policy. Deletion requests do not override a hold or protected contractual minimum: contact support for policy review. Removing a hold requires an operator action with a recorded identity and reason. Previously expired data cannot be restored by extending retention. The standard caps are 7 days on Teams and 60 days on Enterprise; contracted entitlements and protected minimums can differ. Free and Pro do not expose the customer audit log. If your organization downgrades, existing audit history remains readable. Creating destinations, exporting, and changing retention continue to follow the current plan’s entitlements.

Webhook delivery

POST JSON { "type": "audit.event", "event": { … } }.

Header	Value
`content-type`	`application/json`
`x-shipd-timestamp`	Unix seconds
`x-shipd-signature`	`sha256=<hex>` of `timestamp.eventId.body`
`x-shipd-event-id`	Audit event id

import { createHmac } from "node:crypto";

const expected = createHmac("sha256", secret)
  .update(`${timestamp}.${eventId}.${rawBody}`)
  .digest("hex");

import hmac, hashlib

expected = hmac.new(
    secret.encode(),
    f"{timestamp}.{event_id}.{rawBody}".encode(),
    hashlib.sha256,
).hexdigest()

Signing secret is at least 16 characters. Create returns it once; list and update redact it. Rotate by sending a new config.secret on update (omit or leave blank to keep the current value). SIEM tokens and S3 keys stay redacted after create.

SIEM and S3

Type	Auth
JSON	`Authorization: Bearer <token>`
Splunk HEC	`Authorization: Splunk <token>`
Datadog	`DD-API-KEY`
S3-compatible	SigV4 path-style PutObject

HTTP and private RFC1918 URLs are allowed (localhost Splunk, in-VPC MinIO). Cloud metadata and link-local addresses are rejected. Related: View the audit log · Access control.

HTTP APIs

Operations APIs

Enterprise APIs

Errors

Overview

Event fields

Export

Retention

Webhook delivery

SIEM and S3

​Overview

​Event fields

​Export

​Retention

​Webhook delivery

​SIEM and S3

Overview

Event fields

Export

Retention

Webhook delivery

SIEM and S3