# Audit log

Who did what in a workspace: sign-ins, API keys, team changes, sending, webhooks, connections, exports and the account security policy.

Under **Settings → Audit log**, a workspace admin can see who did what, when, and from which network address. It answers the questions a compliance review or an incident asks: who created that key, who invited that person, who changed the sender, when did this address last sign in.

## What is recorded

- **Sign-ins.** Each sign-in (with the method: password, link, passkey, GitHub or single sign-on), each sign-out, and a session ended or refused by the account's security policy.
- **Security.** Two-factor turned on or off, a password change, a passkey added or removed, a browser remembered or forgotten.
- **API keys.** Created (with its permissions) and revoked, including keys a connected site creates and retires.
- **Team.** Invitations sent, withdrawn and accepted; roles changed; members removed; ownership transferred.
- **Workspace.** Renamed, scheduled for deletion, restored, exported. Contact and suppression exports.
- **Sending.** The sender name or address changed; a domain added or removed.
- **Webhooks and connections.** Endpoints added, changed, removed or given a new secret; a store or CRM connected, reconfigured or disconnected; the store signing secret set or cleared.
- **Account.** The security policy changed; a SCIM token created or revoked; people provisioned, renamed or deprovisioned by the identity provider; a personal-data erasure run.

Each entry names the actor (a person by email address, an API key by its name, the identity provider, or the system), what was acted on, the network address the request came from, and a few details specific to the action: a role, a permission list, a before-and-after pair. Credentials are never recorded: no key, secret, token or password appears in the log.

Failed sign-in attempts are not recorded. They are throttled, but a log that anyone with an address can fill from outside is not the log an admin wants to read.

## Reading it

The page shows the last 30 days, newest first; choose dates to look further back, or filter by action or by who. Entries cannot be edited or deleted by anyone, including SendBeam staff.

A person who administers every workspace on the account can switch to **Whole account** and see every workspace's entries together, with a workspace column. Account-level events (the security policy, SCIM) appear under every workspace on the account.

Members cannot see the audit log. It names who signed in from where and who changed keys, team and sending, which is admin business in the same way a webhook's URL is.

## Through the API

A key with the `audit:read` permission can read the same entries from `GET /api/v1/account/audit-log`, which is how a SIEM or a compliance tool keeps its own copy. The permission is read-only and off by default when you create a key; it is listed under Integrations. See the [API reference](https://sendbeam.io/docs/api#tag/Audit-log) for the filters and the cursor paging.

## How long entries are kept

Entries are kept for 365 days and then removed automatically. Deleting a workspace removes its entries with it once the 14-day grace period ends, and a person's erasure request removes every entry that names their address.

---
Source: https://sendbeam.io/docs/admin/audit-log