Events & audit search
The log of who did what on the platform (logins, agent connects, resource changes) and what happened in all agent sessions, searchable by actor, kind, and time.
Events
An event records a platform-level action: who signed in, who connected to which agent, who created or deleted a resource. Access reviews and incident response run on this trail. For what happened inside an agent, see sessions.
Event types
Each event carries a type, a category, a human-readable description, and a metadata object with the specifics. The full catalogue of what gets recorded:
| Type | Category | What it records |
|---|---|---|
user.login | auth | A user signed in |
user.signup | auth | A new user signed up |
user.service_token | auth | A short-term service token was issued |
auth.default_org_changed | auth | A user changed their default organization |
auth.password_reset_requested | auth | A password reset was requested |
auth.password_reset_completed | auth | A password reset completed |
auth.password_reset_totp | auth | A password was reset via authenticator code |
user.scim_provisioned | auth | SCIM provisioned a user |
user.scim_replaced | auth | SCIM replaced a user |
user.scim_updated | auth | SCIM updated a user |
user.scim_activated | auth | SCIM activated a user |
user.scim_deactivated | auth | SCIM deactivated or deleted a user |
agent.invoke.requested | agents | An agent invocation was requested |
agent.invoke.timeout | agents | An invocation timed out waiting for the operator |
agent.invoke.failed | agents | An agent invocation failed |
agent.invoked | agents | An agent run was triggered |
agent.connected | agents | Someone opened a shell to an agent |
agent.create | agents | An agent was created |
agent.slack.invoked | agents | An agent was fired from Slack (/exo) |
agent.webhook.invoked | agents | An agent was fired by a webhook |
session.killed | sessions | A session was killed |
skill.created | skill | A skill was created |
skill.updated | skill | A skill was updated |
skill.deleted | skill | A skill was deleted |
skill.synced | skill | The skills catalogue was synced |
sandbox.invoked | sandboxes | A code sandbox was invoked |
sandbox.connected | sandboxes | Someone connected to a code sandbox |
tools.synced | tools | Cluster tools were synced from deployments |
tool.connected | tools | Someone connected to a tool |
tool.paused | tools | A Bastion tool pod was paused |
tool.tested | tools | A tool connectivity test ran |
team.role_updated | team | A member's role was updated |
team.member_toggled | team | A member was enabled or disabled |
team.member_removed | team | A member was removed |
team.member_invited | team | A member was invited |
team.invitation_revoked | team | An invitation was revoked |
group.scim_created | team | SCIM created a group |
group.scim_replaced | team | SCIM replaced a group |
group.scim_members_replaced | team | SCIM replaced a group's members |
group.scim_members_added | team | SCIM added members to a group |
group.scim_members_removed | team | SCIM removed members from a group |
group.scim_deleted | team | SCIM deleted a group |
provider.created | providers | An LLM provider was created |
provider.updated | providers | An LLM provider was updated |
provider.deleted | providers | An LLM provider was deleted |
integration.created | integrations | An integration was created |
integration.updated | integrations | An integration was updated |
integration.deleted | integrations | An integration was deleted |
mcp_server.created | mcp | An MCP server was created |
mcp_server.updated | mcp | An MCP server was updated |
mcp_server.deleted | mcp | An MCP server was deleted |
tenant.updated | settings | Tenant settings were updated |
settings.test_email_sent | settings | A test email was sent |
directory.synced | directory | A directory sync completed |
directory.sync_failed | directory | A directory sync failed |
Audit log
The Audit log rolls every session event across every deployment into one searchable view, scoped to your tenant. Where the Events feed tracks platform actions, the audit log reaches inside the runs themselves, so you can answer "what was typed, when, and by whom" across the whole fleet at once.
What you can filter and search on:
- Payload text: free-text search across the event payload (stdin, stdout, tool arguments).
- Kind: toggle
User input,Thinking,Action,Terminal, andIdentityevents. - Actor: a specific user, by ID.
- Agent: a specific agent, by ID.
- Time window: a
from/todate range.
Filters combine, and the match count updates as you narrow the set. Any row's Replay link jumps to the corresponding session.