Audit log
The audit log is your organization's chronological, read-only change history. Use it to investigate configuration changes, review security activity, or follow up on an incident. Open Logs > Audit. The log covers the organization, and workspace filtering is available.
What gets recorded
The audit log captures changes to your account configuration. Message activity appears in your messaging logs and analytics instead. Audit entries include:
- API keys: creation and revocation
- Sending domains: adding, verifying, and deleting domains
- Webhooks: creating, updating, and deleting endpoints, and rotating signing secrets
- Workspaces and organization: creating, renaming, and deleting workspaces; organization setting changes
- Team: invitations, role changes, and member removals
- Security events: logins (including failed attempts), MFA changes, recovery-code regeneration, and password resets
- Billing actions: changes made through your billing settings
Day-to-day traffic is deliberately not in the audit log: individual emails sent, delivery and open events, and read-only views of pages don't generate entries. Those live in your messaging logs and analytics instead.
Reading an entry
Use these fields to read an entry:
- Actor: who. The user who clicked, or the API key that made the call. Actions taken by Bird's own systems are marked as such.
- Action: what. A name such as api_key.created, domain.verified, or member.role_updated identifies the resource and change.
- Timestamp: when. The exact time the change happened.
Entries also include the target resource and available request context, such as the source IP, client, and request ID. Sensitive values such as API key secrets do not appear.
Using it in practice
- "Why did sending break on Tuesday?" Filter to that day and review recent domain, webhook, or API key changes.
- Security review. Skim security events for failed logins you don't recognize, MFA factors being removed, or API keys created outside normal change windows.
- Offboarding check. After someone leaves, confirm their member removal is recorded and review what they changed in their final weeks.
- Incident follow-up. The actor, IP, and request ID on each entry give you a concrete trail to include in an incident write-up.
Who can see it
Workspace Admins and Analysts can read the audit log; Developers cannot. Organization Owners can read it across the organization. Entries cannot be edited or deleted in the dashboard.
Next steps
- API key management: the key events you'll see most often
- Login, password & MFA: the security events behind the log entries