Audit logs
Audit logs let organization admins review who did what in your Foxglove organization, and when. Use them to investigate unexpected layout changes, track membership and access updates, or confirm whether an action was intentional.
Audit logs are available only to organization admins on Enterprise plans. If you don't see Audit logs under organization settings, check your plan or ask an admin.
Open audit logs
- Sign in as an organization admin on an Enterprise plan.
- Open Settings → Audit logs.
The page lists recent organization events in reverse chronological order.
What each event shows
Each row includes:
| Field | Description |
|---|---|
| Time | When the event occurred |
| Event | The action name (for example layout.delete or device.update_remote_access) |
| Actor | Who performed the action — an organization member, an API key, or the system |
Select a row to open details, including event metadata such as the name of a deleted layout or other action-specific fields.
Filter events
Use the filters at the top of the page to narrow the feed:
- Event — limit results to a specific action name
- From / To — limit results to a date range
Examples of recorded activity
Audit logs cover a range of organization actions, including:
- Layout creations, renames, deletions, and restores
- Remote Access enable and disable on devices
- Member invitations, removals, and seat-type changes
- API key create, edit, and delete
- Project create, delete, and membership changes
- Device edits and device token changes
- Recording and import deletions
Personal access token activity
The event.create audit event records only requests made with personal access tokens. It identifies both the member and the token used for the action. It doesn't record events created through a signed-in session or an organization API key, so filtering by it shows personal access token activity, not a complete history of event creation.
layout.edit records every layout edit made with a personal access token, and layout renames made by any member or API key. Its metadata includes the layout's current and previous names. Other layout edits made through a signed-in session or an organization API key aren't recorded.