> ## Documentation Index > Fetch the complete documentation index at: https://docs.envzero.com/llms.txt > Use this file to discover all available pages before exploring further. # View audit logs > Track changes in your env zero organization: who made each change, whether it came from the UI, CLI, or API, and which resource it affected. The audit log records changes made in your organization: who made each change, where it came from, which resource it affected, and when. env zero records an event for most create, update, and delete requests made through the UI, the CLI, or the API, and for user logins. Some write actions are not recorded, such as canceling a deployment or approving a plan. It does not record read requests. ## Permissions > [!WARNING] > > Viewing the audit log, in Organization Settings or through the API, requires the **View Audit Logs** permission. The Organization Admin role includes this permission. To grant it to other users, add it to a [custom role](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/custom-roles.md). [Read-only API keys](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md#read-only-api-key) keep it. ## Recorded events Each event is named after the action that triggered it. The table lists examples for each area. The **Action Name** filter lists every action name. | Area | Example action names | | :- | :- | | Organization | Update Policy | | Projects | Create a new Project, Update a Project, Archive a Project, Upsert a project's budget | | Environments and deployments | Create Environment, Deploy Environment, Destroy Environment, Lock/Unlock environment, Update Environment TTL, Move Environment between Projects, Bulk deploy | | Drift | Set Drift Detection Environment Scheduling, Remediate Drift, Ignore Drift Cause | | Templates, modules, and providers | Create Template, Add Template to Project, Create module | | Variables | Create or update variable, Delete a variable, Create a configuration set | | Users, teams, and roles | User Login, Invite User, Remove User, Create Team, Create a Role, Create or Update a Role Assignment for a User | | API keys | Create API Key, Delete an API Key, Update an API Key IP allowlist | | SSO and SCIM | SSO configuration deleted, SCIM configuration created, SCIM token rotated, SCIM mode changed, SCIM reconcile applied, User provisioned, User deprovisioned, Group provisioned, Group member added | | Credentials | Create Credentials, Associate credentials with project, Associate Cost Credentials with Project | | VCS | Create VCS Connection, Update VCS Connection, Create a git token, Create a new SSH key, Create VCS Provider User Mapping | | Agents | Create agent, Create agent secret, Revoke agent secret, Assign agents to projects | | Governance | Create Approval Policy, Create Custom Flow, Create or Update Workflow Trigger | | Integrations and notifications | For creating or updating log forwarding configuration, Create or update an organization CloudQuery integration, Create Notification Endpoint, Update Notification Settings | | Cloud Compass | Start a Cloud Compass credential wizard draft, Delete a Cloud Compass credential, Silence A Cloud Compass Insight | ## Who performed an action **Performed By** names the person responsible for the event, and **Source** shows how the request reached env zero. | How the action was made | Performed By | Source | | :- | :- | :- | | env zero web app | The signed-in user | **UI** | | env zero CLI after `env0 login` | The signed-in user | **CLI** | | Personal API key, from the API or the CLI | The key owner | **API** | | Admin or user API key, from the API or the CLI | The API key, with **on behalf of** the user who created it | **API** | **System** marks requests that one env zero service makes to another. API keys that env zero creates automatically, such as OIDC and Terraform deployer keys, have no **on behalf of** user. Filtering **Performed By** by a user also returns actions made with API keys that user created. Some events show no source: events recorded before env zero tracked the source, user logins, [SCIM events](#scim-events), and a few settings changes such as **SSO configuration deleted**. Select **Not recorded** in the **Source** filter to find them. ### SCIM events * Changes your identity provider makes through [SCIM](https://docs.envzero.com/guides/sso-integrations/scim-provisioning.md), such as **User provisioned** or **Group member added**, show **Unknown user (SCIM)** under **Performed By** and no source. * Changes an admin makes to SCIM settings, such as **SCIM token rotated** or **SCIM mode changed**, show the admin under **Performed By** and no source. ## View the audit log **1. Open the audit log** Go to **Organization Settings** and select the **Logs** tab. **2. Narrow the results** Pick a date range, and use the column filters on **Performed By**, **Source**, **Action Name**, **Project**, and **Entity**. Sort by **Performed At** to change the order. **3. Inspect an event** Expand a row to see the event's recorded details, when it has any. **4. Load more events** Click **Show more** at the bottom of the table. | Column | Shows | | :- | :- | | **Performed By** | The person responsible. See [Who performed an action](#who-performed-an-action). | | **Source** | **UI**, **CLI**, **API**, or **System** | | **Action Name** | The action that was recorded | | **Project** | The project the event belongs to | | **Entity** | The environment, deployment, project, or template the event changed. Click the filter icon to show only that entity's events. | | **IP Address** | The IP address the request came from | | **Performed At** | When the event was recorded | When you apply filters, env zero searches a range of events per page. If it stops before the end of your date range, a note under the table shows how far it searched. Click **Show more** to search further. ## Fetch audit logs through the API Use [Fetch Audit Logs](https://docs.envzero.com/api-reference/audit-events/fetch-audit-logs.md) to retrieve audit logs programmatically. It supports the same filters as the table: date range, users, projects, entity, action names, and source. ## Forward audit logs To send audit logs to an external platform such as Datadog or Splunk, enable **Audit Log Forwarding** in a [log forwarding integration](https://docs.envzero.com/guides/integrations/logs-forwarding.md#audit-logs). The integrations that receive audit logs appear at the top of the **Logs** tab. ## Next steps For deployment counts and environment status across the organization, open the [monitoring dashboards](https://docs.envzero.com/guides/admin-guide/dashboards.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.