Audit log

Review a tamper-evident record of admin activity in your Ravenna organization, including configuration changes, integrations, and access policies.

The audit log captures admin activity across your Ravenna organization. Use it to review who changed what and when, investigate incidents, and produce evidence for compliance reviews.

---

Get started

1. Open organization settings

   Click your organization name in the top left, then select Settings from the dropdown menu.

2. Select Audit log

   Click Audit log in the left sidebar.

The audit log requires the organization admin role. Members and guests cannot view audit events.

---

What gets logged

Ravenna records admin actions that change the configuration of your organization or workspaces. Each event captures the actor, target resource, action, timestamp, and a structured snapshot of the inputs.

Events are recorded for areas including:

Area	What gets recorded
Integrations	Connecting, configuring, or removing third-party integrations.
Knowledge bases	Creating, updating, syncing, or deleting knowledge sources.
Forms	Publishing, editing, archiving, or deleting forms and fields.
Agent models	Selecting or updating the LLM provider and model used by agents.
Agents	Creating, updating, or deleting agents.
Rules	Creating, updating, or deleting agent rules that govern automated behavior.
Workflows	Creating, updating, deleting, activating, or deactivating workflows.
SLAs	Creating, updating, or deleting service level agreements.
Applications	Creating, updating, deleting, archiving, or unarchiving applications, including bulk actions and workspace assignment changes.
Access and roles	Changes to admin roles and permission policies.
Members	Adding or removing workspace members, updating organization or workspace member roles, and changes to user profiles.
Users	Creating and updating Ravenna users, including users provisioned by an integration user sync (for example, Okta).

The audit log captures admin configuration changes. Day-to-day ticket activity (comments, status changes, assignments) is recorded on individual tickets, not in the audit log.

---

Review events

The audit log displays each event as a row with the actor, action, resource, and timestamp.

The actor is usually the admin who performed the action. When an integration user sync creates or updates a Ravenna user, the integration itself is the actor. These events appear in the User column with the integration’s name and logo (for example, Okta Sync) instead of a person. The same attribution appears in the detail panel and in CSV exports.

Filter events

Use the filter bar above the table to narrow results:

Filter	Narrows by
Actor	The user who performed the action.
Resource type	The kind of object changed (for example, integration, knowledge base, form, agent, rule, workflow).
Resource	A specific resource by name.
Event name	The action performed (for example, Integration created, Form updated).
Date range	A specific time window.
Outcome	Successful or failed actions only.

Filters combine with AND logic. Inline text filters save automatically when you click outside the input.

Inspect an event

Click any row to open the detail panel. The panel shows:

Section	Contents
Summary	The actor, action, resource, and outcome.
Inputs	The request payload submitted with the action, with sensitive values redacted.
Context	The originating IP address, user agent, and request ID.
Errors	The error message and code, when an action failed.

Use the request ID when contacting Ravenna support. It links the audit event to the underlying request trace.

---

Export events

Export a filtered view of the audit log for offline review or to share with auditors.

1. Apply filters

   Narrow the audit log to the events you want to export. The export respects your active filters.

2. Open the export menu

   Click Export in the top right of the audit log page.

3. Download the file

   Ravenna generates a CSV file containing the filtered events and downloads it to your browser.

Each row includes the event timestamp, actor, action, resource type, resource name, outcome, and a JSON snapshot of the action inputs.

Exports are scoped to the events visible to you. Events older than your organization’s retention window are not included.

---

Common use cases

• Investigate an unexpected change. Filter by resource and date range to find the actor and action that produced the change.
• Review admin activity for a user. Filter by actor to see every configuration change a specific admin has made.
• Provide evidence for compliance. Export events for a defined window and share the CSV with auditors.
• Detect failed admin actions. Filter by outcome failed to identify permission errors or misconfigurations.