Skip to content
Start free

Audit log

See who did what in your workspace, when and from which network. Filter by category, person, agent or date, and export the log as CSV or JSON Lines.

On this page

The audit log records the security and admin actions in your workspace: who did it, what they did and to what, when, and from which network. Workspace owners and administrators can see it in Settings › Audit log.

What's recorded

Every change made through M1rror is recorded, by people, by agents and by M1rror itself. These kinds of change also get a category, so you can filter for them:

CategoryWhat it covers
MembersInvitations sent and revoked, role changes, members removed or leaving
Agent accessAgent tokens created and revoked, agents connected through OAuth, agent auto-approval limits
IntegrationsFigma, Mobbin, fal, the GitHub App, App Store Connect, Google Play and staging access connected or disconnected
RepositoriesRepositories connected or disconnected, check variables set or deleted, builds and pull requests authorised
Releases & approvalsRelease candidates, review requests, approvals and rejections, approval and review policies
BillingPlan, seat and spend cap changes, checkouts, cancellations, credit purchases
Workspace settingsRenames, deletion scheduled, cancelled or carried out
ProjectsProjects created, archived, restored or deleted
SecurityCapabilities M1rror switched off or back on for your workspace, and audit log exports

An attempt that was refused because the person lacked permission is recorded too, with the outcome Denied.

Each event shows:

  • When it happened (the export uses UTC).
  • Who did it: a person, an agent (with the person who connected it), M1rror itself (scheduled jobs) or M1rror staff.
  • What they did, in plain words, and the category.
  • The target: the member, token, repository, release or project it changed.
  • The network: the first part of the IP address (for example 203.0.113.0/24), and the browser or client. M1rror never stores the full address.
  • The request: events with the same request id happened together. Open an event and choose Events from this request to see them.

The log never contains passwords, tokens, keys, cookies or other secrets. Agent tokens are recorded by name; check variables by name, never value.

Filter

Filter by category, actor, actor type (people, agents or system), outcome, part of the event name, or a date range. Open an event to see its details, then show every event by the same actor, for the same target or from the same request.

Export

Choose Export, pick a date range and a format, and download:

  • CSV opens in a spreadsheet. Cells that start with =, +, -, @, a tab or a carriage return get a leading apostrophe, so no cell runs as a formula.
  • JSON Lines has one event per line, in the same shape as the API.

The export uses the filters you applied and is streamed, so large ranges download without waiting for a file to be built. One export holds up to 500,000 events; choose a shorter range if you need more. Every export is itself recorded in the audit log.

From the API, with an owner or administrator session:

HTTP
GET /v1/workspaces/{workspace_id}/audit-events?category=members&since=2026-10-01T00:00:00Z
GET /v1/workspaces/{workspace_id}/audit-events/export?format=csv&since=2026-10-01T00:00:00Z&until=2026-11-01T00:00:00Z

The list returns 50 events by default (up to 200) and a next_cursor for the next page. Agents can't read the audit log.

How long it's kept

Audit events are kept for 7 years, then deleted by a daily job. Nobody can change an event once it's recorded, including M1rror staff. Events stay after a member leaves and after the workspace is deleted, as Data and privacy describes.

Last updated

Edit this page on GitHub