> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Audit Log > Search organization security events and verify their tamper-evident integrity. The Audit Log is the organization-scoped record of security and administrative activity in Forge. It identifies the action, actor, target, request context, and state change behind each event and presents the newest events first. ## Event schema Every audit event contains an ID, organization, action, actor type, occurrence time, creation time, and JSON objects for before values, after values, and metadata. Events can also include: | Field | Meaning | | ------------- | ----------------------------------------------------------------------------- | | Actor | Console user ID, role, and display name when the action has a human actor. | | Target | Type, stable ID, and display name of the affected resource. | | Request | Request ID, source IP address, and user agent. | | Before values | Security-relevant state before a mutation. | | After values | Security-relevant state after a mutation. | | Metadata | Action-specific identifiers, status, revision, or bounded execution evidence. | The Console table shows the occurrence time, action, actor, target, and request ID or IP address. Open any event to inspect its available details. The audit API returns the complete typed event, including before values, after values, metadata, and user agent. ### Event details Open an event to review its actor, target, request context, and approved state changes. The JSON view can be copied and contains exactly the sanitized fields shown in the drawer. Action-specific values that are not approved for Console display remain omitted. Policy audit snapshots contain revision, state, ownership, management mode, and definition hash information. Use policy revision history for complete policy content. ### Actor types | Type | Source | | ---------------- | ---------------------------------------------------- | | `console_user` | An authenticated Forge Console user. | | `system` | A Forge-owned system operation. | | `workos_webhook` | An identity or directory event received from WorkOS. | | `background_job` | A scheduled or asynchronous Forge operation. | ## Covered activity Audit actions are namespaced strings such as `member.*`, `auth.*`, `sso.*`, `retention.*`, and `mcp_registry.*`. Recorded activity includes: * Membership, role, invitation, SSO, and credential changes. * Policy, approval, governance, and remediation decisions. * MCP Registry servers, installations, OAuth grants, and gateway tokens. * Integration, export destination, and delivery changes. * Retention settings, preservation holds, and cleanup outcomes. * Configuration publication, rollback, and endpoint operations. An audit event records a completed or attempted Forge operation that explicitly emits audit evidence. It is not a replacement for the higher-volume session and gateway telemetry shown in [Sessions](/observe/sessions). ## Search The Console supports: * After and before timestamps. * Action categories. * Actor type. * Target type. * Newest-first pagination with 25 events per page. The API additionally supports an exact console actor ID, exact target ID, offset or cursor pagination, and up to 200 events per request. An `action` filter is exact unless it ends in `.`, in which case it matches that namespace prefix. ## Integrity Protected organization audit events, governance evaluations, and AI control-point events are appended to an organization-scoped SHA-256 hash ledger. Each ledger entry records: * A monotonic sequence number. * Source kind and source ID. * Canonical schema version and payload hash. * Previous-entry hash and current entry hash. For audited mutations, the product change and organization audit event are committed in the same database transaction. The audit event's ledger entry is appended in that transaction as well. Ordinary updates and deletions of ledger rows are rejected by the database. A scheduled verifier checks sequence continuity, previous hashes, entry hashes, canonical source hashes, and missing protected source rows. Verification failures create a system audit event on the transition into a failed state. ### Proof packages Forge can produce a bounded integrity proof package containing: * Current verification status and failures. * Ledger entries and canonical versions. * Checkpoints spanning sequence ranges. * Checkpoint signatures and external anchor receipts when configured. The proof establishes the integrity of the canonical fields protected by each schema version. It does not claim that expired prompt, response, tool, or source detail remains available after its retention window. Newer canonical versions deliberately protect retention-compatible facts while preserving earlier ledger entries. ## Retention Audit events belong to the security-record retention class. The selected organization window is 1, 3, or 7 years, subject to the effective minimum shown in the Console. Audit-ledger proofs preserve the integrity history defined by their canonical versions even when separately retained evidence detail expires. See [Privacy](/secure/privacy) for retention jobs, tombstone proofs, and preservation holds. ## Exports Configured Splunk, Amazon S3, and other security-export destinations can receive selected organization audit events. The Audit Log links to active destinations so their schemas, credentials, health, and delivery state can be managed separately. ## Related pages Review the identities and roles represented in audit events. Configure security-record retention and preservation holds. Use audit evidence in framework assessments. Export selected security events to Splunk.