> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Event fields, export limits, webhook signatures, and destination delivery.

## Overview

Use **Settings → Audit log** to inspect, export, and stream the history of changes to your organization. Events are append-only. Membership, invitation, and team events can appear shortly after the change.

## Event fields

| Field | Meaning |
| - | - |
| `id` | Identity cursor, newest first |
| `organizationId` | Organization that owns this event, included in both export formats |
| `actorId` / `impersonatorId` | Acting identity and, when applicable, the impersonating operator |
| `action` | `flag.updated`, `member.invited`, `team.created`, `project.teams.updated`, … |
| `resource` | `flag:new-checkout` |
| `actorType` | `user`, `api_key`, `service_account`, or `system` |
| `tokenId` | Service-account token that performed the mutation; `null` otherwise |
| `source` | `dashboard`, `cli`, `api`, `sdk`, `system` |
| `projectId` / `environmentId` | Project and environment identifiers remain available for filtering after archive |
| `before` / `after` | JSON snapshots of the mutation |
| `requestId` / `correlationId` | HTTP request ids when the write came from the API |
| `ipAddress` / `userAgent` | Client provenance |
| `reason` | Optional human note (`Forced CAS override` on `shipd push --force`) |

Sensitive fields are redacted from event snapshots. Credentials, key hashes, tokens, and identity assertions must not be used as audit evidence. The dashboard renders snapshots as text. Date-only filters use UTC day boundaries; event timestamps display in your browser's timezone. Organization journal events use actions such as `member.added`, `member.role.updated`, `member.invitation.accepted`, and `team.member.removed`. Invitation events reference `invitation:<id>`. Other identity journal events use `identity.<table>.<operation>` actions; impersonation sessions produce `impersonation.started` and `impersonation.ended` events.

## Export

Audit-log search is available on Teams and Enterprise. Export is Enterprise-only. Export uses the same filters as the list, is capped at **10,000** rows per batch, and supports CSV and JSON.

Each export reflects a consistent view of the matching events. Each request records started and completed or failed events. A successful response reports its row count and a `nextCursor` when the cap was reached. Use **Export next batch**, or pass that cursor with the same filters to the export API, to retrieve older events. Requests are limited to 60 seconds. Downloads require audit-read access and the export entitlement; responses are not cacheable. Downloads do not create a hosted artifact URL.

CSV cells that start with `=`, `+`, `-`, or `@` are prefixed so spreadsheet apps will not treat them as formulas.

## Retention

| Setting | Meaning |
| - | - |
| Missing row | 365-day request, capped by the plan and protected minimum |
| `7`–`2555` | Requested days, subject to the plan and protected minimum |
| `null` | Keep forever; accepted only when the entitlement is unlimited |

Events expire according to your effective retention policy. The configured window is capped by the plan entitlement, but a protected contractual minimum takes precedence over that cap. A retention hold prevents expiry and customer retention changes. Retention settings remain attached to audit history after organization deletion.

IP addresses and user agents follow the same event retention window, including holds; they are not retained under a separate indefinite policy. Exported copies are governed by the recipient's retention policy. Deletion requests do not override a hold or protected contractual minimum: contact support for policy review. Removing a hold requires an operator action with a recorded identity and reason. Previously expired data cannot be restored by extending retention.

The standard caps are 7 days on Teams and 60 days on Enterprise; contracted entitlements and protected minimums can differ. Free and Pro do not expose the customer audit log. If your organization downgrades, existing audit history remains readable. Creating destinations, exporting, and changing retention continue to follow the current plan's entitlements.

## Webhook delivery

POST JSON `{ "type": "audit.event", "event": { … } }`.

| Header | Value |
| - | - |
| `content-type` | `application/json` |
| `x-shipd-timestamp` | Unix seconds |
| `x-shipd-signature` | `sha256=<hex>` of `timestamp.eventId.body` |
| `x-shipd-event-id` | Audit event id |

```js Node theme={null}
import { createHmac } from "node:crypto";

const expected = createHmac("sha256", secret)
  .update(`${timestamp}.${eventId}.${rawBody}`)
  .digest("hex");
```

```py Python theme={null}
import hmac, hashlib

expected = hmac.new(
    secret.encode(),
    f"{timestamp}.{event_id}.{rawBody}".encode(),
    hashlib.sha256,
).hexdigest()
```

Signing secret is at least 16 characters. Create returns it once; list and update redact it. Rotate by sending a new `config.secret` on update (omit or leave blank to keep the current value). SIEM tokens and S3 keys stay redacted after create.

## SIEM and S3

| Type | Auth |
| - | - |
| JSON | `Authorization: Bearer <token>` |
| Splunk HEC | `Authorization: Splunk <token>` |
| Datadog | `DD-API-KEY` |
| S3-compatible | SigV4 path-style PutObject |

HTTP and private RFC1918 URLs are allowed (localhost Splunk, in-VPC MinIO). Cloud metadata and link-local addresses are rejected.

Related: [View the audit log](/operations/audit-log) · [Access control](/enterprise/access-control).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.