Audit events and security anomalies

Open Audit log to inspect activity in the selected workspace. Management API access requires read_audit and the workspace ID.

For a dashboard investigation:

1. Select the workspace where the activity occurred and open Audit log.
2. Set a time range that includes the event you are investigating, then narrow by event type or user/actor if needed.
3. Open the relevant entry and record its time, event ID, actor, target and outcome.
4. If the list is empty, check the workspace and widen the filters. An empty filtered list alone does not establish that the action succeeded or failed.

Filter by event type, severity, actor, target, IP address or time range. API requests accept from/to timestamps, limit and a cursor. Use next_cursor to continue; do not assume offset pagination applies to this endpoint.

Application-user anomalies are a separate API authorized with the affected user's token. Listing and acknowledging an anomaly does not change workspace membership or revoke sessions. Follow up by reviewing sessions and taking the appropriate account action.

Preserve event IDs and timestamps when investigating an issue. Share sanitized records with support rather than tokens or full personal data. See audit and anomaly requests.

Reading or acknowledging an event does not correct the underlying issue. For an unexpected sign-in, review the appropriate account/application sessions; for a failed operation, use its exact response with API troubleshooting.