Audit logs reference

This reference lists the fields, filters, actor types, target types, and events that can appear in audit logs.

Audit log entries are generated from the Admin API schema and dashboard audit log constants. Metadata fields vary by event and resource type.

Note

This reference changes when Admin audit events change. Refresh it from the latest Admin API schema and dashboard audit log constants before each release that adds, removes, or renames audit events.

Response fields

Field	Type	Required	Meaning
`created_at`	`date-time string`	Yes	Time when the audit log entry was created.
`actor_type`	`ActorType`	Yes	Type of actor that performed the action.
`actor_metadata`	`object<string, string>`	Yes	Details about who performed the action.
`event_type`	`EventType`	Yes	Type of action recorded in the audit log.
`event_metadata`	`object<string, string>`	Yes	Details about the recorded action.
`target_type`	`TargetType`	Yes	Type of resource affected by the action.
`target_metadata`	`object<string, string>`	Yes	Details about the affected resource.
`log_id`	`integer`	Yes	Audit log entry ID.
`organization_uuid`	`UUID string` or `null`	No	Organization ID for the audit log entry.
`workspace_uuid`	`UUID string` or `null`	No	Workspace ID for the audit log entry.

Metadata fields

actor_metadata, event_metadata, and target_metadata are objects. They contain extra data about the actor, action, and affected resource.

The raw API schema accepts string values. The dashboard can enrich known IDs into objects for display.

Key	Appears in	Meaning
`user_uuid`	Actor metadata	User ID for the human actor. The dashboard can enrich this value with `uuid`, `email`, and `name`.
`enterprise_account_uuid`	Actor metadata	Enterprise account ID for an API key actor. The dashboard can enrich this value with `uuid` and `name`.
`organization_uuid`	Actor, event, or target metadata	Organization ID related to the actor, action, or affected resource. The dashboard can enrich this value with `uuid` and `name`.
`workspace_uuid`	Actor, event, or target metadata	Workspace ID related to the actor, action, or affected resource. The dashboard can enrich this value with `uuid`, `name`, `description`, `icon`, and `is_default`.
`uuid`	Enriched metadata	ID of the enriched user, Organization, Workspace, or enterprise account.
`email`	Enriched actor metadata	Email address for an enriched human actor.
`name`	Enriched metadata	Display name for an enriched user, Organization, Workspace, or enterprise account.
`description`	Enriched Workspace metadata	Workspace description.
`icon`	Enriched Workspace metadata	Workspace icon value.
`is_default`	Enriched Workspace metadata	Whether the Workspace is the default Workspace.

Filters

Use these query parameters with the Admin API audit logs endpoint.

Filter	Type	Default	Meaning
`actor_type`	`ActorType[]` or `null`	`None`	Actor types to include in the audit log results.
`event_type`	`EventType[]` or `null`	`None`	Event types to include in the audit log results.
`target_type`	`TargetType[]` or `null`	`None`	Target resource types to include in the audit log results.
`actor_user_uuid`	`string` or `null`	`None`	Filter logs by the UUID of the user who performed the action.
`sort`	`ascending` or `descending`	`descending`	Sort order for audit log entries.
`after`	`date-time string` or `null`	`None`	Return audit log entries after this time.
`before`	`date-time string` or `null`	`None`	Return audit log entries before this time.
`limit`	`integer`	`20`	Maximum number of results to return.

Actor types

Actor type	Meaning
`HUMAN`	A person performed the action in the dashboard, Studio, le Chat, or an authenticated product surface.
`API_KEY`	An API key performed the action.
`OTHER`	A system process, external system, or Mistral staff operation performed the action.

Target types

Target type	Meaning
`USER`	A user account.
`USER_GROUP`	A user group used for access management.
`ORGANIZATION`	An Organization.
`WORKSPACE`	A Workspace.
`API_KEY`	An API key.
`ADMIN_API_KEY`	An Admin API key.
`AGENT`	An agent in Studio.
`SKILL`	A skill in Studio.
`PROMPT`	A prompt in Studio.
`CUSTOM_VOICE`	A custom voice.
`DATASET`	A dataset used for files, batch jobs, or fine-tuning.
`FINE_TUNING_JOB`	A fine-tuning job.
`BATCH_JOB`	A batch job.
`DATA_CAPTURE_EXTRACT_JOB`	A data capture extract job.
`LE_CHAT_CONVERSATION`	A le Chat conversation.
`LE_CHAT_MEMORIES`	le Chat memory settings.
`LE_CHAT_FLASH_ANSWERS`	le Chat flash answer settings.
`LE_CHAT_LOCALISATION`	le Chat localisation sharing settings.
`LE_CHAT_DATA`	le Chat data training settings.
`INVOICE`	A billing invoice.
`WALLET`	A billing wallet or credit balance.
`MONTHLY_LIMIT`	An Organization monthly spend limit.
`WORKSPACE_MONTHLY_LIMIT`	A Workspace monthly spend limit.
`SHARED_BUDGET`	A shared budget.
`AUTO_RECHARGE`	Auto recharge billing settings.
`PAYMENT_METHOD`	A billing payment method.
`SUBSCRIPTION`	A billing subscription.
`BILLING_INFO`	Billing profile information.
`LIBRARY`	A Library.
`LIBRARY_DOCUMENT`	A Library document.
`INTEGRATION`	An integration or Connector configuration.
`CONNECTORS_GATEWAY`	A Connectors gateway tool call.
`FEATURE_PERMISSION`	A feature permission override.
`SECRET_STORE_ENTRY`	A secret store entry.
`CRAWLER_CONFIG`	A crawler configuration.

Event types

Each event_type names the action recorded in the audit log. Deprecated events can still appear for older logs.

User management events

Event type	Meaning
`user.create`	Records when a user is created.
`user.delete`	Records when a user is deleted.
`user.log_in`	Records when a user signs in.
`user.log_out`	Records when a user signs out.
`user.info.update`	Records when user info changes.
`user.password.update`	Records when user password changes.
`user.phone_number.verify`	Records when a user verifies a phone number.
`user.organization.leave`	Records when a user leaves an Organization.
`user.organization.role.update`	Records when user Organization role changes.
`user.organization.delete`	Records when a user is removed from an Organization.
`user.organization.join`	Records when a user joins an Organization.
`organization.create`	Records when an Organization is created.
`organization.update`	Records when Organization changes.
`organization.invite.send`	Records when an Organization invitation is sent.
`organization.invite.accepted`	Records when an Organization invitation is accepted.
`organization.invite.rejected`	Records when an Organization invitation is rejected.
`organization.invite.revoked`	Records when an Organization invitation is revoked.
`organization.join_by_email_domain`	Records when a user joins an Organization through an allowed email domain.
`organization.domain_verification.disable`	Records when Organization domain verification is disabled.
`organization.domain_verification.enable`	Records when Organization domain verification is enabled.
`organization.email_domain_authentication.enable`	Records when Organization email domain authentication is enabled.
`organization.email_domain_authentication.disable`	Records when Organization email domain authentication is disabled.
`organization.saml_authentication.enable`	Records when Organization SAML authentication is enabled.
`organization.saml_authentication.disable`	Records when Organization SAML authentication is disabled.
`organization.saml_authentication.sso_user_provisioning.update`	Records when Organization SAML authentication SSO user provisioning changes.
`organization.seat_auto_assign.enable`	Records when Organization seat auto assignment is enabled.
`organization.seat_auto_assign.disable`	Records when Organization seat auto assignment is disabled.
`organization.sso_seat_auto_assign.enable`	Records when Organization SSO seat auto assignment is enabled.
`organization.sso_seat_auto_assign.disable`	Records when Organization SSO seat auto assignment is disabled.
`workspace.create`	Records when a Workspace is created.
`workspace.update`	Records when Workspace changes.
`workspace.delete`	Records when a Workspace is deleted.
`workspace.member.add`	Records when a Workspace member is added.
`workspace.member.remove`	Records when a Workspace member is removed.
`workspace.member.role.update`	Records when Workspace member role changes.
`user_group.create`	Records when a user group is created.
`user_group.update`	Records when user group changes.
`user_group.delete`	Records when a user group is deleted.
`user_group.member.add`	Records when user group member is added.
`user_group.member.remove`	Records when user group member is removed.
`user_group.workspace.provision`	Records when user group Workspace provision occurs.
`user_group.workspace.deprovision`	Records when user group Workspace deprovision occurs.
`user_group.workspace.update`	Records when user group Workspace update occurs.

Billing events

Event type	Meaning
`billing.information.updated`	Records when billing information changes.
`billing.payment_method.added`	Records when a billing payment method is added.
`billing.payment_method.removed`	Records when a billing payment method is removed.
`billing.payment_method.default_changed`	Records when billing payment method changes.
`billing.invoice.retried`	Records when billing invoice is retried.
`billing.subscription.subscribe`	Records when a billing subscription starts.
`billing.subscription.unsubscribe`	Records when a billing subscription is set to end.
`billing.subscription.cancel_unsubscribe`	Records when a scheduled subscription cancellation is canceled.
`billing.subscription.add_seats`	Records when seats are added to a billing subscription.
`billing.subscription.remove_seats`	Records when seats are removed from a billing subscription.
`billing.subscription.termination_date.updated`	Records when billing subscription termination date changes.
`billing.credits.added`	Records when billing credits are added.
`billing.gift_code.used`	Records when billing gift code is used.
`billing.monthly_limit.updated`	Records when billing monthly limit changes.
`billing.workspace_monthly_limit.updated`	Records when billing Workspace monthly limit changes.
`billing.shared_budget_override.updated`	Records when billing shared budget override changes.
`billing.auto_recharge.updated`	Records when billing auto recharge changes.
`billing.seat.grant`	Records when a billing seat is granted.
`billing.seat.revoke`	Records when a billing seat is revoked.

le Chat events

Event type	Meaning
`le_chat.conversation.created`	Records when a le Chat conversation is created.
`le_chat.conversation.deleted`	Records when a le Chat conversation is deleted.
`le_chat.conversation_batch.deleted`	Records when le Chat conversation batch is deleted.
`le_chat.conversation.public_sharing.enabled`	Records when le Chat conversation public sharing is enabled.
`le_chat.conversation.public_sharing.disabled`	Records when le Chat conversation public sharing is disabled.
`le_chat.flash_answers.enabled`	Records when le Chat flash answers is enabled.
`le_chat.flash_answers.disabled`	Records when le Chat flash answers is disabled.
`le_chat.localisation_sharing.enabled`	Records when le Chat localisation sharing is enabled.
`le_chat.localisation_sharing.disabled`	Records when le Chat localisation sharing is disabled.
`le_chat.memories.enabled`	Records when le Chat memories is enabled.
`le_chat.memories.disabled`	Records when le Chat memories is disabled.
`le_chat.data.training_enabled`	Records when le Chat data training is enabled.
`le_chat.data.training_disabled`	Records when le Chat data training is disabled.
`le_chat.actions.external_link`	Records when a user opens an external link from le Chat actions.

Studio events

Event type	Meaning
`admin_api_key.created`	Records when an Admin API key is created.
`admin_api_key.delete`	Records when an Admin API key is deleted.
`api_key.create`	Records when an API key is created.
`api_key.rotate`	Records when an API key is rotated.
`api_key.delete`	Records when an API key is deleted.
`secret_store.entry.create`	Records when a secret store entry is created.
`secret_store.entry.update`	Records when secret store entry changes.
`secret_store.entry.delete`	Records when a secret store entry is deleted.
`agent.create`	Records when an agent is created.
`agent.delete`	Records when an agent is deleted.
`agent.update`	Records when an agent changes.
`skill.create`	Records when a skill is created.
`skill.delete`	Records when a skill is deleted.
`skill.enable`	Records when skill is enabled.
`skill.disable`	Records when skill is disabled.
`skill.update`	Records when a skill changes.
`skill.share`	Records when a skill is shared.
`skill.unshare`	Records when a skill is unshared.
`skill.load`	Records when a skill is loaded.
`skill.force_load`	Records when a skill is force loaded.
`skill.version.create`	Records when a skill version is created.
`prompt.create`	Records when a prompt is created.
`prompt.delete`	Records when a prompt is deleted.
`prompt.update`	Records when a prompt changes.
`prompt.version.create`	Records when a prompt version is created.
`custom_voice.create`	Records when a custom voice is created.
`custom_voice.update`	Records when a custom voice changes.
`custom_voice.delete`	Records when a custom voice is deleted.
`feature_permission.override.created`	Records when a feature permission override is created.
`feature_permission.override.deleted`	Records when a feature permission override is deleted.
`la_plateforme.training.enabled`	Records when La Plateforme training is enabled.
`la_plateforme.training.disabled`	Records when La Plateforme training is disabled.

Jobs and files events

Event type	Meaning
`fine_tuning_job.create`	Records when a fine-tuning job is created.
`fine_tuning_job.cancel`	Records when a fine-tuning job is canceled.
`batch_job.create`	Records when a batch job is created.
`batch_job.cancel`	Records when a batch job is canceled.
`batch_job.delete`	Records when a batch job is deleted.
`data_capture.extract_job.create`	Records when a data capture extract job is created.
`data_capture.extract_job.cancel`	Records when a data capture extract job is canceled.
`dataset.create`	Records when a dataset is created.
`dataset.delete`	Records when a dataset is deleted.

Library and integration events

Event type	Meaning
`library.create`	Records when a Library is created.
`library.delete`	Records when a Library is deleted.
`library.update`	Records when a Library changes.
`library.share`	Records when a Library is shared.
`library.unshare`	Records when a Library is unshared.
`library.document.create`	Records when a Library document is created.
`library.document.delete`	Records when a Library document is deleted.
`library.document.bulk_delete`	Records when Library documents are deleted in bulk.
`library.document.update`	Records when a Library document changes.
`library.document.reprocess`	Records when a Library document is reprocessed.
`integration.connected`	Records when an integration is connected.
`integration.disconnected`	Records when an integration is disconnected.
`indexing.workflow.completed`	Records when a legacy indexing workflow completes.
`indexing.deleted`	Records when a legacy index is deleted.
`connection.admin.setup_index`	Records when an admin connection index is set up.
`connection.admin.deleted`	Records when a connection admin is deleted.
`integration.activated_for_org`	Records when an integration is activated for an Organization.
`integration.deactivated_for_org`	Records when an integration is deactivated for an Organization.
`integration.activated_for_workspace`	Records when an integration is activated for a Workspace.
`integration.deactivated_for_workspace`	Records when an integration is deactivated for a Workspace.
`integration.activated_for_user`	Records when an integration is activated for a user.
`integration.deactivated_for_user`	Records when an integration is deactivated for a user.
`integration.created`	Records when an integration is created.
`integration.updated`	Records when integration changes.
`integration.deleted`	Records when an integration is deleted.
`integration.tool_called`	Records when integration tool is called.
`integration.credentials.created_or_updated`	Records when integration credentials change.
`integration.credentials.deleted`	Records when integration credentials are deleted.
`integration.preferences.created_or_updated`	Records when integration preferences change.
`integration.preferences.deleted`	Records when integration preferences are deleted.
`integration.authentication_method.created_or_updated`	Records when integration authentication method changes.
`integration.connection.created`	Records when an integration connection is created.
`connectors_gateway.tool_called`	Records when Connectors gateway tool is called.
`crawler.config.create`	Records when a crawler config is created.
`crawler.config.update`	Records when a crawler configuration changes.
`crawler.config.delete`	Records when a crawler config is deleted.
`crawler.run.create`	Records when a crawler run is created.
`crawler.run.cancel`	Records when a crawler run is canceled.