Find and interpret an event
Open Audit Log for the intended workspace with audit-read permission.
Filter by the offered action, actor, project, or date controls
Clear filters if the expected event is missing.
Read the event time, actor identity/type, action, target, and recorded metadata
Compare these with the change you are investigating.
For access changes, inspect related membership/device/MCP settings as well; one event is not proof that every independent authorization was revoked.
Coverage and retention limits
The log shows recorded actions, not every security or configuration event. Use it to investigate activity alongside the relevant account, workspace, or project settings. It is not a tamper-proof compliance archive.
For required retention or export, contact support to confirm what is available for your account.