Every state-changing action (team and role changes, provider keys, proxy keys, budgets, routing, Auto Router, freeze, SSO, imports, exports, billing changes) and every denied attempt, with who did it, their role, when, from which IP, and whether it succeeded.

Are prompts, API keys or request bodies stored?

Never. The audit log records that a provider key was saved, not the key. Request bodies are deliberately excluded because they contain secrets.

Which plan includes the audit log?

Business. Events are recorded on every plan, so history is there when you upgrade.

Yes, as CSV, filtered by action, actor and date. The export is capped at 50,000 rows per download, and exporting is itself logged.

There is no automatic deletion today. You can query and export up to the last 400 days.

Can an admin edit or delete entries?

No. The log is append-only from the application; there is no edit or delete path in the product.

What does the Cognocient audit log record?

A searchable, exportable record of who changed what and when, including denied attempts. Request contents are never stored. Business plan.

The audit log answers who changed what, and when. Owners and Admins on the Business plan see it under Audit Log in the sidebar. Events are recorded on every plan, so the history is already there when you upgrade.

Request contents are never stored

The log records that a provider key was saved, not the key; that SSO was configured, not your IdP metadata. Request bodies contain secrets, so they are excluded on purpose.

What you see for each event

Field	Meaning
Time	When it happened (UTC in exports)
Actor	Email of the person, or "API key" / "System"
Role	The actor's role at the time
Action	What happened, e.g. `provider.save`
Target	The record acted on, when there is one
Result	The HTTP status; 403 for denied attempts
IP	The address the request came from
Details	Small structured facts, e.g. a role change's `from` and `to`

Actions

Action	Meaning
`team.invite`, `team.role_change`, `team.remove`	Inviting, changing a role (with from/to), removing someone
`sso.change`, `sso.member_provisioned`	SSO configuration changed; a person was added by SSO
`provider.save`, `provider.delete`	Provider credentials added, changed or removed
`key.create`, `key.revoke`	Proxy keys
`budget.create`, `budget.update`, `budget.delete`	Budgets
`routing_rule.`, `auto_router.`, `settings.update`	Routing, Auto Router, guardrails, failover
`freeze.engage`, `freeze.release`, `freeze.settings`	Emergency Freeze
`data.export`, `data.ingest`, `report.generate`	Exports, imports, report generation
`billing.trial_started`, `billing.plan_upgraded`, `billing.plan_changed`, `billing.subscription_canceled`, `billing.payment_failed`	Billing lifecycle, recorded as "System"
`billing.change`	Someone opened checkout or the billing portal
`access.denied`	A request refused by role or by an SSO requirement
`audit.export`	The audit log itself was exported

Denied attempts are as important as successes: a Viewer repeatedly trying to change provider keys is exactly what you want to notice.

Searching and exporting

Filter by action group, actor email and date range (up to 400 days), then Export CSV. Exports are capped at 50,000 rows, and values that could be read as spreadsheet formulas are neutralised so opening the file in Excel is safe.

Also available through the API

curl "https://api.cognocient.com/api/audit-log?days=30&action=team." \
  -H "Authorization: Bearer <session token>"

Results are newest first with a cursor (next_before_id) for paging. Access to the log itself requires the Owner or Admin role.

What does the Cognocient audit log record?

What you see for each event

Actions

Searching and exporting

Also available through the API

Frequently asked questions

On this page