Unqork logs administrative and configuration activity across the platform. Audit logs capture who performed an action, what changed, and whether it succeeded. Each entry provides a traceable record for compliance, troubleshooting, and security review.
Audit logs are not available through the UnqorkAI platform. Access is through the API Reference using the GET /logs/audit-logs endpoint. Designer Administrator access is required.
Event Structure
Each audit log entry includes the following fields:
| Field | Description |
|---|---|
userId |
The ID of the Creator who performed the action. |
eventAction |
The specific action performed. Use this field to filter events in SIEM queries. |
source |
The origin of the action. DesignerApi for platform events; ExpressApi for end-user data access events. |
outcome |
Whether the action succeeded (success) or failed (failure). Failed outcomes include a reason (authentication, authorization, or unknown) and details. |
For modification events, the log also captures the prior state of the resource for before-and-after comparison.
Logged Events
The following tables list each tracked eventAction value by category. For the full attribute schemas returned with each event, see the payload reference articles linked in See Also.
Applications
eventAction |
Description |
|---|---|
add-application |
An application was created. |
modify-application |
An application's settings were changed. |
delete-application |
An application was deleted. |
promote-application |
An application was promoted to another environment. |
export-application |
An application was exported. |
move-application |
An application was moved to a different workspace. |
preview-application |
An application was previewed. |
add-application-librarymodule |
A library module was added to an application. |
search-application-librarymodule |
A Creator searched for an application's library module. |
modify-share-settings |
A library module's sharing settings were changed. |
Client Tracker Administration
eventAction |
Description |
|---|---|
add-clienttracker-datadog-rum |
A Datadog RUM tracker was created. |
modify-clienttracker-datadog-rum |
A Datadog RUM tracker was changed. |
delete-clienttracker-datadog-rum |
A Datadog RUM tracker was deleted. |
add-clienttracker-logrocket |
A LogRocket tracker was created. |
modify-clienttracker-logrocket |
A LogRocket tracker was changed. |
delete-clienttracker-logrocket |
A LogRocket tracker was deleted. |
add-clienttracker-newrelic |
A New Relic tracker was created. |
modify-clienttracker-newrelic |
A New Relic tracker was changed. |
delete-clienttracker-newrelic |
A New Relic tracker was deleted. |
Creator Roles
eventAction |
Description |
|---|---|
add-designer-role |
A Creator role was created. |
modify-designer-role |
A Creator role's settings were changed. |
delete-designer-role |
A Creator role was deleted. |
modify-designer-user-roles |
A Creator's role assignments were changed. |
Creator Users
eventAction |
Description |
|---|---|
add-designer-user |
A Creator account was created. |
modify-designer-user |
A Creator account's profile was changed. |
delete-designer-user |
A Creator account was deleted. |
designer-user-password-change |
A Creator's password was changed. |
resend-designer-user |
A Creator's temporary password was resent. |
designer-user-login |
A Creator logged in. |
designer-user-logout |
A Creator logged out. |
designer-user-lockout |
A Creator account was locked out. |
Email Templates
eventAction |
Description |
|---|---|
modify-email-template |
An email template's content or subject line was changed. |
Environment Administration
eventAction |
Description |
|---|---|
modify-api-ratelimiting |
API rate limiting settings were changed. |
modify-attachment-limits |
Attachment upload limit settings were changed. |
modify-cors |
CORS settings were changed. |
modify-disable-safe-html-filters |
Component security (safe HTML filters) settings were changed. |
modify-express-csp |
Express Content Security Policy settings were changed. |
modify-session-administration |
Express session administration settings were changed. |
modify-express-useraccountpassword |
Express user account password settings were changed. |
modify-express-useraccountlockout |
Express user account lockout settings were changed. |
modify-execution-file-limits |
Execution file upload limit settings were changed. |
modify-hidepreview-bar |
Hide Preview Bar by Default settings were changed. |
modify-limit-componentexecution |
Component execution loop limit settings were changed. |
modify-limit-workflownodeexecution |
Workflow node execution loop limit settings were changed. |
modify-enable-offline-mode |
Offline mode settings were changed. |
modify-oauth-passwordgrant |
OAuth password grant settings were changed. |
modify-pagerduty-key |
PagerDuty key settings were changed. |
modify-password-requirements |
Password requirement settings were changed. |
modify-serverside-execution-logs |
Server-side execution log settings were changed. |
modify-site-name |
The environment site name was changed. |
modify-daystotrack-trackerrecord |
Tracker record retention settings were changed. |
modify-disable-anonymousaccess |
Anonymous user access settings were changed. |
modify-disable-loginscreen |
Login screen settings were changed. |
enable-custom-login |
Custom login and logout modules were configured. |
promote-designer-translations |
Designer translations were promoted. |
delete-superuser-access |
Designer super-user access was removed. |
upgrade-platform-version |
The platform version was upgraded. |
Excel Fill Template Administration
eventAction |
Description |
|---|---|
upload-excelfill-template |
An Excel fill template was uploaded. |
download-excelfill-template |
An Excel fill template was downloaded. |
delete-excelfill-template |
An Excel fill template was deleted. |
Express Groups
eventAction |
Description |
|---|---|
add-express-group |
An Express group was created. |
modify-express-group |
An Express group was changed. |
delete-express-group |
An Express group was deleted. |
promote-express-groups |
Express groups were promoted to another environment. |
Express Roles
eventAction |
Description |
|---|---|
add-express-roles |
An Express role was created. |
modify-express-roles |
An Express role was changed. |
delete-express-roles |
An Express role was deleted. |
promote-express-roles |
Express roles were promoted to another environment. |
Express Users
eventAction |
Description |
|---|---|
add-express-user |
An Express user record was created. |
modify-express-user |
An Express user record was changed. |
delete-express-user |
An Express user record was deleted. |
export-express-user |
Express user records were exported. |
import-express-user |
Express user records were imported. |
resend-express-user |
An Express user's temporary password was resent. |
search-express-user |
A Creator searched for an Express user. |
express-login |
An Express user logged in. |
express-logout |
An Express user logged out. |
express-user-lockout |
An Express user account was locked out. |
Global Variables
eventAction |
Description |
|---|---|
add-global-variable |
A was created. |
modify-global-variable |
A global variable was changed. |
delete-global-variable |
A global variable was deleted. |
promote-global-variable |
A global variable was promoted to another environment. |
Managed Assets
eventAction |
Description |
|---|---|
upload-managed-assets |
An asset was uploaded. |
download-managed-assets |
An asset was downloaded. |
delete-managed-assets |
An asset was deleted. |
createfolder-managed-assets |
An asset folder was created. |
Modules
eventAction |
Description |
|---|---|
add-module |
A module was created. |
delete-module |
A module was deleted. |
copy-module-admin |
A module was duplicated. |
restore-module-admin |
A module was restored from a previous save. |
save-module-update |
A module was saved. Includes the prior component tree for diff comparison. |
modify-module-settings |
Module-level settings were changed. |
modify-module-permissions |
Module access permissions were changed. |
modify-module-translation |
A translation setting was changed on a module. |
modify-workflow-settings |
Workflow settings on a module were changed. |
modify-module-editmode |
A module's edit mode setting was changed. |
add-module-transform |
A module transform was created. |
modify-module-transform |
A module transform was changed. |
delete-module-transform |
A module transform was deleted. |
save-module-snippet |
A module snippet was saved. |
Module Submissions
eventAction |
Description |
|---|---|
create-module-submissions |
Module submission data was created. |
get-module-submissions |
Multiple module submissions were retrieved. |
get-module-submission |
A single module submission was retrieved. |
get-merged-submissions |
Merged submissions were retrieved. |
get-moduleandworkflow-submissions |
Module and workflow submissions were retrieved. |
update-module-submissions |
Multiple module submissions were updated. |
update-module-submission |
A single module submission was updated. |
delete-module-submissions |
Multiple module submissions were deleted. |
delete-module-submission |
A single module submission was deleted. |
restore-module-submission |
A module submission was restored. |
PDF Template Administration
eventAction |
Description |
|---|---|
upload-pdf-template |
A PDF template was uploaded. |
download-pdf-template |
A PDF template was downloaded. |
delete-pdf-template |
A PDF template was deleted. |
Single Sign-On (SSO)
eventAction |
Description |
|---|---|
add-oidc-configuration |
An OIDC SSO configuration was created. |
modify-oidc-configuration |
An OIDC SSO configuration was changed. |
delete-oidc-configuration |
An OIDC SSO configuration was deleted. |
add-saml-configuration |
A SAML SSO configuration was created. |
modify-saml-configuration |
A SAML SSO configuration was changed. |
delete-saml-configuration |
A SAML SSO configuration was deleted. |
preview-designer-sso |
A Designer SSO configuration was previewed. |
preview-express-sso |
An Express SSO configuration was previewed. |
Smart Components
Smart Component audit events require UnqorkAI (9.0.0 and later).
eventAction |
Description |
|---|---|
add-smart-component |
A Smart Component was created. |
save-smart-component |
A Smart Component was published. Includes the prior definition for diff comparison. |
delete-smart-component |
A Smart Component was deleted. |
modify-smart-component-discoverability |
A Smart Component's visibility was changed between public and private. |
promote-smart-components |
Smart Components were promoted between environments. |
Start Node Administration
eventAction |
Description |
|---|---|
start-workflow-node |
A workflow start node was started. |
stop-workflow-node |
A workflow start node was stopped. |
Style Administration
eventAction |
Description |
|---|---|
modify-style-details |
A style was changed. |
set-style-default |
A style was set as the default. |
delete-style-default |
A style's default setting was removed. |
promote-style-details |
A style was promoted to another environment. |
Themes
Theme audit events require UnqorkAI (9.0.0 and later).
eventAction |
Description |
|---|---|
add-theme |
A Theme was created. |
modify-theme |
A Theme's variables or settings were changed. |
delete-theme |
A Theme was deleted. |
promote-theme |
A Theme was promoted between environments. |
LLM Credentials and Service Administration
LLM Credential audit events require UnqorkAI (9.0.0 and later).
eventAction |
Description |
|---|---|
add-service-administration |
A service configuration was created. |
modify-service-administration |
A service configuration was changed. |
delete-service-administration |
A service configuration was deleted. |
The
service-administrationevent action covers all service-level configurations, including LLM Credentials, Integration Gateway services, and others. Filter byobject.attributesfields in the event payload to isolate events for a specific service type.
Workflow Submissions
eventAction |
Description |
|---|---|
get-workflow-submissions |
Multiple workflow submissions were retrieved. |
get-workflow-submission |
A single workflow submission was retrieved. |
get-moduleandworkflow-submissions |
Module and workflow submissions were retrieved. |
update-workflow-submission |
A single workflow submission was updated. |
delete-workflow-submissions |
Multiple workflow submissions were deleted. |
delete-workflow-submission |
A single workflow submission was deleted. |
restore-workflow-submission |
A workflow submission was restored. |
Workspaces
eventAction |
Description |
|---|---|
add-workspace |
A workspace was created. |
modify-workspace |
A workspace's settings were changed. |
delete-workspace |
A workspace was deleted. |
view-workspace |
A workspace was viewed. |
add-workspace-user |
A Creator was added to a workspace. |
delete-workspace-user |
A Creator was removed from a workspace. |
add-data-model |
A data model was created in a workspace. |
modify-data-model |
A data model was changed. |
delete-data-model |
A data model was deleted. |
archive-data-model |
A data model was archived. |
add-schema |
A JSON schema was added to a data model. |
modify-schema |
A data model's JSON schema was changed. |
delete-schema |
A data model's JSON schema was deleted. |
archive-schema |
A data model's JSON schema was archived. |
export-records |
Records were exported from Record Collections. |
import-records |
Records were imported into Record Collections. |
Application Versioning
Application Versioning audit events require the Branch & Merge Beta.
eventAction |
Description |
|---|---|
version-control-create-branch |
A branch was created. |
version-control-update-branch |
A branch's settings were changed. |
version-control-discard-branch |
A branch was discarded. |
version-control-remove-branch |
A branch was removed. |
version-control-submit-pull-request |
A pull request was submitted for review. |
version-control-approve-pull-request |
A pull request was approved. |
version-control-reject-pull-request |
A pull request was rejected. |
version-control-cancel-pull-request |
A pull request was cancelled. |
version-control-merge-branch |
A branch was merged. |
Bring Your Own Component (BYO)
eventAction |
Description |
|---|---|
install-package |
A BYO component package was installed. |
uninstall-package |
A BYO component package was uninstalled. |
verify-package |
A BYO component package was verified. |
Comments
eventAction |
Description |
|---|---|
add-comment |
A comment was created. |
modify-comment |
A comment was changed. |
delete-comment |
A comment was deleted. |
Search Configuration
eventAction |
Description |
|---|---|
create-search-config |
A search configuration was created. |
update-search-config |
A search configuration was changed. |
fetch-search-config |
A search configuration was retrieved. |
fetch-search-configs |
Multiple search configurations were retrieved. |
archive-search-config |
A search configuration was archived. |
remove-search-config |
A search configuration was removed. |
execute-search |
A search was executed. |
Workflow Access
eventAction |
Description |
|---|---|
access-workflow |
A workflow was accessed. |
execute-workflow |
A workflow execution was triggered. |
Querying Audit Logs
Endpoint: GET /logs/audit-logs
Access: Designer Administrator only.
Query Parameters
| Parameter | Required | Description |
|---|---|---|
startDatetime |
Yes | The start of the query window in ISO 8601 format. Seconds and milliseconds must be 0. |
endDatetime |
Yes | The end of the query window in ISO 8601 format. Seconds and milliseconds must be 0. |
unzip |
No | When true, returns decompressed log content. Defaults to false. |
schemaVersion |
No | The event schema version to use. Defaults to 1.0. |
The query window must not exceed one hour, and start time must be before end time.
Example request:
GET /logs/audit-logs?startDatetime=2026-04-13T10:00:00.000Z&endDatetime=2026-04-13T11:00:00.000Z
Both startDatetime and endDatetime must be set to the exact minute — seconds and milliseconds must be 0. The window in this example is exactly one hour, which is the maximum allowed.
Response
{
"logLocations": ["string"]
}
The response returns an array of signed URLs pointing to the log files for the requested time window. Each URL expires 15 minutes after the response is returned. Log files are stored in gzip (.gz) format — set unzip: true to receive decompressed content.
Changelog
| Date | Change |
|---|---|
| 2026-09-11 | Expanded Logged Events to include all eventAction categories; added payload schema sub-articles (EN-8100). |
| 2026-09-11 | Full rewrite — added eventAction values for all existing categories; added Smart Components, Themes, and LLM Credentials sections (EN-8100). |
| — | Initial publication. |