View audit logs

Track changes in your env zero organization: who made each change, whether it came from the UI, CLI, or API, and which resource it affected.

The audit log records changes made in your organization: who made each change, where it came from, which resource it affected, and when. env zero records an event for most create, update, and delete requests made through the UI, the CLI, or the API, and for user logins. Some write actions are not recorded, such as canceling a deployment or approving a plan. It does not record read requests.

Permissions

Viewing the audit log, in Organization Settings or through the API, requires the View Audit Logs permission.

The Organization Admin role includes this permission. To grant it to other users, add it to a custom role. Read-only API keys keep it.

Recorded events

Each event is named after the action that triggered it. The table lists examples for each area. The Action Name filter lists every action name.

Area	Example action names
Organization	Update Policy
Projects	Create a new Project, Update a Project, Archive a Project, Upsert a project’s budget
Environments and deployments	Create Environment, Deploy Environment, Destroy Environment, Lock/Unlock environment, Update Environment TTL, Move Environment between Projects, Bulk deploy
Drift	Set Drift Detection Environment Scheduling, Remediate Drift, Ignore Drift Cause
Templates, modules, and providers	Create Template, Add Template to Project, Create module
Variables	Create or update variable, Delete a variable, Create a configuration set
Users, teams, and roles	User Login, Invite User, Remove User, Create Team, Create a Role, Create or Update a Role Assignment for a User
API keys	Create API Key, Delete an API Key, Update an API Key IP allowlist
SSO and SCIM	SSO configuration deleted, SCIM configuration created, SCIM token rotated, SCIM mode changed, SCIM reconcile applied, User provisioned, User deprovisioned, Group provisioned, Group member added
Credentials	Create Credentials, Associate credentials with project, Associate Cost Credentials with Project
VCS	Create VCS Connection, Update VCS Connection, Create a git token, Create a new SSH key, Create VCS Provider User Mapping
Agents	Create agent, Create agent secret, Revoke agent secret, Assign agents to projects
Governance	Create Approval Policy, Create Custom Flow, Create or Update Workflow Trigger
Integrations and notifications	For creating or updating log forwarding configuration, Create or update an organization CloudQuery integration, Create Notification Endpoint, Update Notification Settings
Cloud Compass	Start a Cloud Compass credential wizard draft, Delete a Cloud Compass credential, Silence A Cloud Compass Insight

Who performed an action

Performed By names the person responsible for the event, and Source shows how the request reached env zero.

How the action was made	Performed By	Source
env zero web app	The signed-in user	UI
env zero CLI after env0 login	The signed-in user	CLI
Personal API key, from the API or the CLI	The key owner	API
Admin or user API key, from the API or the CLI	The API key, with on behalf of the user who created it	API

System marks requests that one env zero service makes to another.

API keys that env zero creates automatically, such as OIDC and Terraform deployer keys, have no on behalf of user.

Filtering Performed By by a user also returns actions made with API keys that user created.

Some events show no source: events recorded before env zero tracked the source, user logins, SCIM events, and a few settings changes such as SSO configuration deleted. Select Not recorded in the Source filter to find them.

SCIM events

• Changes your identity provider makes through SCIM, such as User provisioned or Group member added, show Unknown user (SCIM) under Performed By and no source.
• Changes an admin makes to SCIM settings, such as SCIM token rotated or SCIM mode changed, show the admin under Performed By and no source.

View the audit log

1. Open the audit log

   Go to Organization Settings and select the Logs tab.

2. Narrow the results

   Pick a date range, and use the column filters on Performed By, Source, Action Name, Project, and Entity. Sort by Performed At to change the order.

3. Inspect an event

   Expand a row to see the event’s recorded details, when it has any.

4. Load more events

   Click Show more at the bottom of the table.

Column	Shows
Performed By	The person responsible. See Who performed an action.
Source	UI, CLI, API, or System
Action Name	The action that was recorded
Project	The project the event belongs to
Entity	The environment, deployment, project, or template the event changed. Click the filter icon to show only that entity’s events.
IP Address	The IP address the request came from
Performed At	When the event was recorded

When you apply filters, env zero searches a range of events per page. If it stops before the end of your date range, a note under the table shows how far it searched. Click Show more to search further.

Fetch audit logs through the API

Use Fetch Audit Logs to retrieve audit logs programmatically. It supports the same filters as the table: date range, users, projects, entity, action names, and source.

Forward audit logs

To send audit logs to an external platform such as Datadog or Splunk, enable Audit Log Forwarding in a log forwarding integration. The integrations that receive audit logs appear at the top of the Logs tab.

Next steps

For deployment counts and environment status across the organization, open the monitoring dashboards.