Read the audit log
Who did what in your workspace, when, from which address, and whether it worked.
Your workspace keeps a record of the actions people take in it. Open it at Settings → Audit. Anyone signed in to the workspace can read it, and everyone's actions appear in the same list, including yours.
Each row answers five questions about one action: when it happened, who did it, what they did, which thing they did it to, and whether it succeeded. The address the request came from is recorded alongside, which is what lets you tell a normal sign-in from one you did not expect.
What a row contains
| Column | What it holds |
|---|---|
| When | The moment the action was recorded. |
| Actor | The email address of the person who did it. Blank for actions the platform took on its own. |
| Action | A dotted name such as monitor.create or auth.login. |
| Resource | What was acted on: a type and its identifier, for example a monitor or a notification channel. |
| Outcome | Whether the action succeeded or failed. |
| IP | The address the request came from. |
Some rows also carry extra detail specific to that action. It is stored with the event and comes back through the API described below.
What gets recorded
Not everything a person clicks is an audit event. The log is for actions that change who can do what, what is being monitored, or where money and alerts go. Today that covers:
auth.login and auth.logout, with the address each came from.
monitor.create, monitor.delete, and a region being removed from a monitor.
Creating, promoting, merging, acknowledging, resolving and deleting, plus changes to incident roles and affected services.
Creating, updating and deleting a channel, and a delivery that failed.
Inviting, removing, changing a role, resending or revoking an invitation, and transferring ownership of the workspace.
API tokens created and deleted, tax details changed, a promo redeemed, a refund, a subscription paused or resumed, a scheduled downgrade cancelled.
Deleting the workspace, cancelling that deletion, and deleting an account are recorded too.
Finding one event
Two filters sit above the table. Actor matches part of an email address, so typing a name or a domain narrows the list to one person or one company. Action narrows to a single kind of event.
If a filter returns nothing, that means no event of that kind is stored, not that the action was never taken. Actions are only recorded once something writes them, and the list above is what is written today.
Reading it from the API
curl -H "Authorization: Bearer $HOWLOPS_TOKEN" \
"https://api.howlops.com/api/v1/workspace/audit-events?action=auth.login&per_page=100"
| Parameter | Meaning |
|---|---|
actor | Match part of an actor's email address. |
action | Exact action name, for example monitor.delete. |
since | An ISO timestamp. Only events after it are returned. |
page | Page number. Defaults to 1. |
per_page | Events per page. Defaults to 50, maximum 200. |
The response is the standard paginated envelope: items, total, page, per_page,
total_pages. Each item carries occurred_at, actor_email, actor_ip, action,
resource_type, resource_id, outcome and, where the action recorded any, metadata.
Events are scoped to your workspace. A token can never read another workspace's log.
Taking it with you
The workspace export includes your audit events as a JSON array. See Export workspace data for how to start an export and download the result.
Was this page helpful?