| 1 | --- |
| 2 | title: Audit log |
| 3 | description: Every action agents take with their run credentials, and every change people and tokens make, with whether it was allowed and the rule that decided. |
| 4 | --- |
| 5 | |
| 6 | Every workspace keeps an audit log. It records: |
| 7 | |
| 8 | - **Everything an agent does** with its [run credentials](/guides/working-with-g1t/#credentials), |
| 9 | reads included: every API and MCP call, every clone and fetch, every push. |
| 10 | - **Every change people and workspace tokens make** through the API, the |
| 11 | MCP server and git: opening and closing issues, comments, merges, |
| 12 | settings, pushes. Reads by people are not recorded. A workflow job's |
| 13 | [`G1T_TOKEN`](/guides/actions/#the-jobs-token) is recorded as that job's, |
| 14 | under its run. |
| 15 | |
| 16 | - **A repository's lifecycle**, wherever the change was made, g1t.sh |
| 17 | included. A transfer is recorded in both workspaces' logs, and a |
| 18 | workspace's deletion as `workspace.deleted`. A restore by g1t's support |
| 19 | is recorded as `workspace.restored`, and the purge 30 days after a |
| 20 | deletion as `workspace.purged`, its log's last entry. |
| 21 | |
| 22 | | Action | Recorded when | |
| 23 | | --- | --- | |
| 24 | | `repo.renamed` | A repository was renamed. | |
| 25 | | `repo.visibility_changed` | It was made public or private. | |
| 26 | | `repo.default_branch_changed` | Its default branch changed. | |
| 27 | | `branch.renamed` | A branch was renamed. | |
| 28 | | `repo.archived`, `repo.unarchived` | It was archived, or unarchived. | |
| 29 | | `repo.transferred` | It moved to another workspace. | |
| 30 | | `repo.deleted`, `repo.restored`, `repo.purged` | It was deleted, restored, or removed for good. | |
| 31 | | `repo.collaborator_added`, `repo.collaborator_role_changed`, `repo.collaborator_removed` | Someone was given a role on it, had it changed, or lost it. See [access and roles](/guides/access-and-roles/). | |
| 32 | | `repo.invitation_created`, `repo.invitation_revoked` | Someone was invited to it, or an invitation was withdrawn. | |
| 33 | | `workspace.base_permission_changed` | An owner changed what members get on every repository. | |
| 34 | | `workspace.team_creation_changed` | An owner changed who can create teams. See [who can create teams](/guides/teams/#who-can-create-teams). | |
| 35 | | `team.created`, `team.edited`, `team.deleted` | A [team](/guides/teams/) was created, changed or deleted. | |
| 36 | | `team.member_added`, `team.member_role_changed`, `team.member_removed` | Someone was added to a team, made its maintainer or a member, or taken out of it. | |
| 37 | | `team.repo_added`, `team.repo_role_changed`, `team.repo_removed` | A team was given a role on a repository, had it changed, or lost it. | |
| 38 | | `package.delete`, `package.restore`, `package.purged` | A [package](/guides/packages/#delete-and-restore) was deleted, restored, or removed for good 30 days after it was deleted. | |
| 39 | | `package.delete_version`, `package.restore_version` | One of its versions was deleted or restored. | |
| 40 | | `package.access_added`, `package.access_role_changed`, `package.access_removed` | A person or team was given a role on a package itself, had it changed, or lost it. | |
| 41 | | `package.actions_access_added`, `package.actions_access_role_changed`, `package.actions_access_removed` | A repository's workflows were given access to a package under [Manage Actions access](/guides/packages/#manage-actions-access), had it changed, or lost it. | |
| 42 | | `package.inherit_access_changed` | Inheriting access from the linked repository was turned on or off. | |
| 43 | | `package.visibility_changed` | A package was made public or private. | |
| 44 | | `package.linked`, `package.unlinked` | A package was linked to a repository (from its settings, or by an image's source label), or unlinked. | |
| 45 | | `workspace.residency_changed` | An owner changed where the workspace's new repositories are stored. See [data residency](/guides/workspaces/#data-residency). | |
| 46 | | `workspace.deleted`, `workspace.restored`, `workspace.purged` | An owner deleted the workspace, g1t's support restored it, or it was removed for good. See [deleting a workspace](/guides/workspaces/#delete-a-workspace). | |
| 47 | |
| 48 | Through the API and the MCP server, the call itself is recorded under its |
| 49 | operation's name too, such as `delete_repo`. See |
| 50 | [managing a repository](/guides/managing-repositories/). |
| 51 | |
| 52 | Refusals are recorded too, with the rule that refused them. Entries are |
| 53 | only ever added: nothing edits or removes one. |
| 54 | |
| 55 | ## What an entry says |
| 56 | |
| 57 | | Field | What it is | |
| 58 | | --- | --- | |
| 59 | | Time | When it happened, to the millisecond. | |
| 60 | | Actor | Who did it: a person, an agent, or a workspace token. | |
| 61 | | On behalf of | For an agent, the person it worked for: `g1t on behalf of syntaqx`. | |
| 62 | | Run | The agent run, with its kind: `implement`, `review`, `update` and so on; or the workflow run whose job's token did it, as `workflow_job`. | |
| 63 | | Credential | The id of the token used. | |
| 64 | | Action | The API or MCP operation, such as `create_issue`, or `git.push` and `git.fetch`. | |
| 65 | | Target | The repository, the issue or pull request number, and for git the refs it moved. | |
| 66 | | Outcome | `allowed` or `denied`. | |
| 67 | | Rule | What decided it: the run's scope, such as `run:implement/tools`; a refusal rule, such as `scope:repository`, or `token:repository` for a workflow job's token used on another repository; or, for people, their own access. A refusal by the repository's own rules is `service` (or `repository` for git). | |
| 68 | | Result | `ok`, or the reason it failed. | |
| 69 | | Request id | The request's id, the same one Cloudflare logs it under. | |
| 70 | |
| 71 | The rules that refuse an agent are listed under |
| 72 | [credentials](/guides/working-with-g1t/#credentials). |
| 73 | |
| 74 | ## Read the log |
| 75 | |
| 76 | Open the workspace's settings and choose **Audit log**, or go to |
| 77 | `g1t.sh/<workspace>/-/audit`. |
| 78 | |
| 79 | - **Owners** see everything in the workspace. |
| 80 | - **Members** see what was done to the workspace's projects, and anything |
| 81 | they did, or had done on their behalf. Changes owners made to the |
| 82 | workspace itself are for owners. |
| 83 | |
| 84 | Filter by actor (a person matches what they did and what agents did for |
| 85 | them), agent, action, project, outcome, who acted, and a range of days. |
| 86 | The filters are part of the page's address, so a filtered view can be |
| 87 | shared with anyone who can see it. |
| 88 | |
| 89 | Each agent run's page has a **What it did** section listing its entries in |
| 90 | order, and a pull request's **Agent** panel shows the latest of what its |
| 91 | runs did. Both link to the full log, filtered to the run. |
| 92 | |
| 93 | ## How long it is kept |
| 94 | |
| 95 | How far back the log goes depends on the workspace's plan: |
| 96 | |
| 97 | | Workspace | Kept | |
| 98 | | --- | --- | |
| 99 | | Free | **7 days** | |
| 100 | | On the [g1t plan](/guides/usage-and-billing/#the-g1t-plan) | **90 days** | |
| 101 | | Paid for by an [enterprise](/guides/usage-and-billing/#enterprises-and-custom-terms) | **90 days** | |
| 102 | | Longer, by arrangement | Up to **400 days** | |
| 103 | |
| 104 | The log can be read and exported back that far, and no further. Once a |
| 105 | day, entries older than that are **deleted**, and cannot be brought back: |
| 106 | export what you need to keep before then. Starting the plan keeps 90 days |
| 107 | from then on; entries already deleted stay deleted. Ending it goes back to |
| 108 | 7 days, and the next daily pass deletes what is older. |
| 109 | |
| 110 | For a longer log, such as for a compliance requirement, email |
| 111 | [support@g1t.sh](mailto:support@g1t.sh). g1t can set the workspace's |
| 112 | account to keep up to 400 days, and what is set there takes the place of |
| 113 | the plan's. A [self-hosted](/guides/self-hosting/) g1t that does not charge |
| 114 | keeps 90 days for every workspace. |
| 115 | |
| 116 | ## Export |
| 117 | |
| 118 | **CSV** and **JSON** on the Audit log page download what the current |
| 119 | filters match, up to 10,000 entries, newest first. The CSV has one column |
| 120 | for each field above; a cell that a spreadsheet would read as a formula is |
| 121 | written as text. |
| 122 | |
| 123 | ## What is not recorded |
| 124 | |
| 125 | - Reads by people and workspace tokens. |
| 126 | - What people do on the website itself. The API, the MCP server and git |
| 127 | are recorded. |
| 128 | - What g1t does on its own, such as closing a pull request whose agent |
| 129 | failed. Those changes are in the pull request's timeline. |