Audit
For Owners, Operators and anyone granted a Role that reads Audit, including security and compliance teams reading after the fact: who did what, and when, in the console and by the platform on its behalf.
Read the log
Open Identity & Access Management → Audit (disabled hover: "Requires owner or operator (or an AdminManage-class grant)"). Every action in the table below is kept for 400 days: role and tier grants, API-key lifecycle, deployment launches, updates, reconfigurations (including network and certificate changes), rollbacks, pauses, resumes and deletions, answers to parked jobs and job retries, account registration, verification, clearing, deletion and regions, identity providers, Fleet Configuration Templates, Update Manager rules, Library item deletions and the shared Entra credentials. Not recorded here: creating or deleting a Library, adding or removing its members, and saving or deleting a deployment draft in the wizard (a launch is recorded). A Library's own pages show its current members. Rows are newest first: When, Who, Action, Target (type and id), Outcome and AWS account; the footer states the window in UTC and the list pages with Previous and Next.
Who is the administrator's email for an action someone took in the console. A job an Update Manager rule started reads system:update-manager, and an automatic rollback after a failed update reads system:engine. Work Organisations does on its own, such as activating an API key in its deployment, reads as the internal host name of the Organisations worker that did it; the key's own audit trail under Programmatic access shows the same rows as "AlphaAgent Organisations". An action through a share request reads "<actor> (via share request)"; the installer's first set-up reads "System (initial setup)".
Filter
- Filter by actor (exact email or worker id).
- From (UTC) and To (UTC) as YYYY-MM-DD; the default window is the last seven days.
- Action (exact): the full action name, for example
role.grant.created.
Filters are exact; Clear filters resets them. Nothing matching reads Nothing matches these filters; an empty window reads Nothing recorded in this window.
What you should see
| Action | What happened |
|---|---|
role.grant.created, role.grant.archived | A Role or tier granted or revoked (Users, groups and roles). |
apikey.created, apikey.updated, apikey.rotated, apikey.external_id_rotated, apikey.revoked, apikey.deleted, apikey.expired | An API key's lifecycle (Programmatic access). |
apikey.materialised, apikey.run_data_purged | Organisations activated the key in its deployment; a deleted key's run data was purged (Who is the Organisations worker's host name). |
console_access.assigned, console_access.assignment_failed, console_access.reconciled, console_access.released, console_access.release_failed | The console-app assignment made in your Entra tenant alongside a grant, or released with a revoke. |
identity_provider.connected, identity_provider.deleted | An Entra tenant connected (Organisations was granted Graph access; detail: provider type, tenant id and name) or its connection removed (Identity providers). |
deployment_draft.licence.provisioned | A licence token provided in the deployment wizard (detail: the licence id and whether it replaced one; never the token). |
deployment.install.triggered | A deployment launched (detail: name, app domain, region, release, network access, outbound traffic, licence id). |
deployment.upgrade.triggered, deployment.reconfigure.triggered, deployment.rollback.triggered | An update, reconfigure or rollback job started: by an administrator, by an Update Manager rule (system:update-manager, detail: the rule, template and version), or automatically after a failed update (system:engine, detail: the failed job and its failure code). |
deployment.trusted_ca.changed | A deployment's trusted certificate authorities set at launch or changed (detail: the fingerprints before and after, and each certificate added or removed). |
deployment.uninstall.triggered | A deployment deleted (detail: name, app domain, region, network access). |
deployment.ecs.pause, deployment.ecs.resume | A deployment paused or resumed. |
deployment.seat_cap.exceeded | A deployment found over its user cap (Users, groups and roles). |
job.park.answered, job.cancelled, job.resumed, job.redone | A parked step answered (for example a Transit Gateway attachment accepted), a job abandoned or cancelled, resumed or redone. |
account.registered, account.verified, account.allowed_regions.updated, account.clear.triggered, account.deleted | An AWS account registered (detail: alias, allowed regions, the region its stack goes in), verified (outcome and each check), given a region, cleared or deleted. |
fleet_config.created, fleet_config.updated, fleet_config.deleted | A Fleet Configuration Template created, edited (a new version) or deleted (Fleet configurations and Update Manager). |
update_rule.created, update_rule.updated, update_rule.template_version_adopted, update_rule.deleted | An Update Manager rule created, changed (detail: what changed, before and after), moved to a new template version with Adopt vN, or deleted. |
library.item.deleted | An item deleted from a Library. |
platform_config.entra.credentials_updated | The shared Entra credentials replaced (Identity providers). |
Connector tool calls
The Connector tool calls tab lists the calls agents made through MCP connectors, one row per call: Time, Person, Deployment, Connector, Tool, Outcome and Approval, with filters for deployment, connector, person and date range. It needs the Owner or Operator tier or the ConnectorGovernance Role, is kept apart from the list above and does not count toward usage. See Connector policy, credentials and activity. Saving the connector policy and sharing or withdrawing a credential are recorded in the main list.
Notes
- Events are kept for 400 days and a window spans at most 90 days. A From date after To replaces the page with "Could not load the audit trail"; reload the page to get the filters back.
- No partial or wildcard search, and no export button: narrow the window and copy the rows, call
GET /audit?from&to&actor&actionon the Organisations API for the same rows as JSON (up to 200 per page, continued withcursor; Audit trails), or read the same records in your AWS account's logs. - Changes made inside a Studio deployment by its users are Studio's own records, not this log.