Audit logs

Audit logs record every configuration change made in your project: what changed, who made the change, and when. They give owners and compliance teams a complete, attributable history of the account.

What gets logged

Monitor changes: created, edited, paused, resumed, or deleted monitors.
Status page changes: settings, services, and published incidents.
Alerting changes: escalation policies, on-call schedules, and notification channels.
Team changes: teammate invitations, removals, and role updates.
Integration changes: connected or removed integrations.
API key activity: changes made with an API key, over the REST API or the MCP server, appear as ApiKeyWriteAction entries with the key as their target. A read-only key that attempts a change leaves an ApiKeyPermissionDenied entry.

What each entry contains

Every entry records the action that was performed, the teammate who performed it, and a precise timestamp. This makes it easy to answer questions like "who disabled this monitor last Tuesday" or "when was this escalation policy changed".

Common use cases

Compliance: provide an audit trail for SOC 2, ISO 27001, or internal security reviews. Logs can be exported for compliance reporting.
Incident retros: reconstruct configuration changes that happened around an incident.
Debugging alerting: find out when and by whom an escalation policy or notification channel was modified.
Offboarding: review the activity of a teammate before removing them from the project. See Invite teammates.