---
title: "Audit Logs"
slug: "audit-logs-overview"
tags: ["reference-guides"]
status: "update"
updated: 2026-10-14T19:49:59Z
published: 2026-10-14T19:49:59Z
canonical: "docs.unqork.io/audit-logs-overview"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

Unqork logs administrative and configuration activity across the platform. Audit logs capture who performed an action, what changed, and whether it succeeded. Each entry provides a traceable record for compliance, troubleshooting, and security review.

Audit logs are not available through the UnqorkAI platform. Access is through the [API Reference](/unqorkai/docs/api-reference) using the `GET /logs/audit-logs` endpoint. Designer Administrator access is required. Events are uploaded in batches, so a new entry is not available immediately. See [Update Frequency](/unqorkai/docs/audit-logs-overview#update-frequency) for the timing by hosting platform.

## Event Structure

Each audit log entry includes the following fields. The `eventAction` values listed in this article are the values of the `action` field.

| Field | Description |
| --- | --- |
| `action` | The specific action performed. Use this field to filter events in SIEM queries. |
| `actor` | The Creator or end-user who performed the action. The user ID is in `actor.identifier.value`. The email address, name, and phone number are in `actor.attributes`. |
| `category` | The group the action belongs to, for example, `module-admin` or `user-management`. |
| `context` | Details about the request, including the environment, session ID, client IP address, host, HTTP method, URL, and user agent. |
| `object` | The resource the action affected, including its type, identifier, and attributes. |
| `outcome` | Whether the action succeeded (`success`) or failed (`failure`). Failed outcomes include a reason (`authentication`, `authorization`, or `unknown`) and details. |
| `source` | The origin of the action: `designer-api` for platform events, `express-api` for end-user data access events, or `designer-scheduled` for scheduled platform tasks. |
| `timestamp` | The date and time the action occurred, in ISO 8601 format. |

Many modification events also record the prior state of the resource in `object.priorAttributes` for before-and-after comparison. Modification events that change no values are not logged.

> [!WARNING]
> Audit log entries contain personal information, including the email address, name, and phone number of the Creator or end-user in `actor.attributes`. Store, transmit, and process exported logs according to the organization's data protection and encryption standards.

## Logged Events

The following tables list each tracked `eventAction` value by category. For the full attribute schemas returned with each event, see the attribute reference articles linked in [See Also](/unqorkai/docs/audit-logs-overview#see-also).

### Applications

| `eventAction` | Description |
| --- | --- |
| `add-application` | An application was created. |
| `modify-application` | An application's settings were changed. |
| `delete-application` | An application was deleted. |
| `promote-application` | An application was promoted to another environment. |
| `export-application` | An application was exported. |
| `move-application` | An application was moved to a different workspace. |
| `preview-application` | An application was previewed. |
| `add-application-librarymodule` | A library module was added to an application. |
| `search-application-librarymodule` | A Creator searched for an application's library module. |
| `modify-share-settings` | A library module's sharing settings were changed. |

### Client Tracker Administration

| `eventAction` | Description |
| --- | --- |
| `add-clienttracker-datadog-rum` | A Datadog RUM tracker was created. |
| `modify-clienttracker-datadog-rum` | A Datadog RUM tracker was changed. |
| `delete-clienttracker-datadog-rum` | A Datadog RUM tracker was deleted. |
| `add-clienttracker-logrocket` | A LogRocket tracker was created. |
| `modify-clienttracker-logrocket` | A LogRocket tracker was changed. |
| `delete-clienttracker-logrocket` | A LogRocket tracker was deleted. |
| `add-clienttracker-newrelic` | A New Relic tracker was created. |
| `modify-clienttracker-newrelic` | A New Relic tracker was changed. |
| `delete-clienttracker-newrelic` | A New Relic tracker was deleted. |

### Creator Roles

| `eventAction` | Description |
| --- | --- |
| `add-designer-role` | A Creator role was created. |
| `modify-designer-role` | A Creator role's settings were changed. |
| `delete-designer-role` | A Creator role was deleted. |
| `modify-designer-user-roles` | A Creator's role assignments were changed. |

### Creator Users

| `eventAction` | Description |
| --- | --- |
| `add-designer-user` | A Creator account was created. |
| `modify-designer-user` | A Creator account's profile was changed. |
| `delete-designer-user` | A Creator account was deleted. |
| `designer-user-password-change` | A Creator's password was changed. |
| `resend-designer-user` | A Creator's temporary password was resent. |
| `designer-user-login` | A Creator logged in. |
| `designer-user-logout` | A Creator logged out. |
| `designer-user-lockout` | A Creator account was locked out. |
| `require-user-password-reset` | A password reset was required for an account. |

### Email Templates

| `eventAction` | Description |
| --- | --- |
| `modify-email-template` | An email template's content or subject line was changed. |

### Environment Administration

| `eventAction` | Description |
| --- | --- |
| `modify-api-ratelimiting` | API rate limiting settings were changed. |
| `modify-attachment-limits` | Attachment upload limit settings were changed. |
| `modify-cors` | CORS settings were changed. |
| `modify-disable-safe-html-filters` | Component security (safe HTML filters) settings were changed. |
| `modify-express-csp` | Express Content Security Policy settings were changed. |
| `modify-googletag-manager` | Google Tag Manager settings were changed. |
| `modify-session-administration` | Express session administration settings were changed. |
| `modify-express-useraccountpassword` | Express user account password settings were changed. |
| `modify-express-useraccountlockout` | Express user account lockout settings were changed. |
| `modify-execution-file-limits` | Execution file upload limit settings were changed. |
| `modify-hidepreview-bar` | Hide Preview Bar by Default settings were changed. |
| `modify-limit-componentexecution` | Component execution loop limit settings were changed. |
| `modify-limit-workflownodeexecution` | Workflow node execution loop limit settings were changed. |
| `modify-enable-offline-mode` | Offline mode settings were changed. |
| `modify-oauth-passwordgrant` | OAuth password grant settings were changed. |
| `modify-pagerduty-key` | PagerDuty key settings were changed. |
| `modify-password-requirements` | Password requirement settings were changed. |
| `modify-serverside-execution-logs` | Server-side execution log settings were changed. |
| `modify-site-name` | The environment site name was changed. |
| `modify-daystotrack-trackerrecord` | Tracker record retention settings were changed. |
| `modify-disable-anonymousaccess` | Anonymous user access settings were changed. |
| `modify-disable-loginscreen` | Login screen settings were changed. |
| `enable-custom-login` | Custom login and logout modules were configured. |
| `promote-designer-translations` | Designer translations were promoted. |
| `delete-superuser-access` | Designer super-user access was removed. |
| `upgrade-platform-version` | The platform version was upgraded. |

### Excel Fill Template Administration

| `eventAction` | Description |
| --- | --- |
| `upload-excelfill-template` | An Excel fill template was uploaded. |
| `download-excelfill-template` | An Excel fill template was downloaded. |
| `delete-excelfill-template` | An Excel fill template was deleted. |

### Express Groups

| `eventAction` | Description |
| --- | --- |
| `add-express-group` | An Express group was created. |
| `modify-express-group` | An Express group was changed. |
| `delete-express-group` | An Express group was deleted. |
| `promote-express-groups` | Express groups were promoted to another environment. |

### Express Roles

| `eventAction` | Description |
| --- | --- |
| `add-express-roles` | An Express role was created. |
| `modify-express-roles` | An Express role was changed. |
| `delete-express-roles` | An Express role was deleted. |
| `promote-express-roles` | Express roles were promoted to another environment. |

### Express Users

| `eventAction` | Description |
| --- | --- |
| `add-express-user` | An Express user record was created. |
| `modify-express-user` | An Express user record was changed. |
| `delete-express-user` | An Express user record was deleted. |
| `export-express-user` | Express user records were exported. |
| `import-express-user` | Express user records were imported. |
| `resend-express-user` | An Express user's temporary password was resent. |
| `search-express-user` | A Creator searched for an Express user. |
| `express-login` | An Express user logged in. |
| `express-logout` | An Express user logged out. |
| `express-user-lockout` | An Express user account was locked out. |
| `convert-to-create-admin-express-user` | An Express user was converted to a Creator administrator account. |

### Global Variables

| `eventAction` | Description |
| --- | --- |
| `add-global-variable` | A was created. |
| `modify-global-variable` | A global variable was changed. |
| `delete-global-variable` | A global variable was deleted. |
| `promote-global-variable` | A global variable was promoted to another environment. |

### Managed Assets

| `eventAction` | Description |
| --- | --- |
| `upload-managed-assets` | An asset was uploaded. |
| `download-managed-assets` | An asset was downloaded. |
| `delete-managed-assets` | An asset was deleted. |
| `createfolder-managed-assets` | An asset folder was created. |

### Modules

| `eventAction` | Description |
| --- | --- |
| `add-module` | A module was created. |
| `delete-module` | A module was deleted. |
| `copy-module-admin` | A module was duplicated. |
| `restore-module-admin` | A module was restored from a previous save. |
| `save-module-update` | A module was saved. Includes the prior component tree for diff comparison. |
| `modify-module-settings` | Module-level settings were changed. |
| `modify-module-permissions` | Module access permissions were changed. |
| `modify-module-translation` | A translation setting was changed on a module. |
| `modify-module-workflow-settings` | Workflow settings on a module were changed. |
| `modify-module-editmode` | A module's edit mode setting was changed. |
| `add-module-transform` | A module transform was created. |
| `modify-module-transform` | A module transform was changed. |
| `delete-module-transform` | A module transform was deleted. |
| `save-module-snippet` | A module snippet was saved. |

### Module Submissions

| `eventAction` | Description |
| --- | --- |
| `create-module-submissions` | Module submission data was created. |
| `get-module-submissions` | Multiple module submissions were retrieved. |
| `get-module-submission` | A single module submission was retrieved. |
| `get-merged-submissions` | Merged submissions were retrieved. |
| `get-moduleandworkflow-submissions` | Module and workflow submissions were retrieved. |
| `update-module-submissions` | Multiple module submissions were updated. |
| `update-module-submission` | A single module submission was updated. |
| `delete-module-submissions` | Multiple module submissions were deleted. |
| `delete-module-submission` | A single module submission was deleted. |
| `restore-module-submission` | A module submission was restored. |

### Queries

| `eventAction` | Description |
| --- | --- |
| `execute-query` | A query was executed. |

### PDF Template Administration

| `eventAction` | Description |
| --- | --- |
| `upload-pdf-template` | A PDF template was uploaded. |
| `download-pdf-template` | A PDF template was downloaded. |
| `delete-pdf-template` | A PDF template was deleted. |

### Single Sign-On (SSO)

| `eventAction` | Description |
| --- | --- |
| `add-oidc-configuration` | An OIDC SSO configuration was created. |
| `modify-oidc-configuration` | An OIDC SSO configuration was changed. |
| `delete-oidc-configuration` | An OIDC SSO configuration was deleted. |
| `add-saml-configuration` | A SAML SSO configuration was created. |
| `modify-saml-configuration` | A SAML SSO configuration was changed. |
| `delete-saml-configuration` | A SAML SSO configuration was deleted. |
| `preview-designer-sso` | A Designer SSO configuration was previewed. |
| `preview-express-sso` | An Express SSO configuration was previewed. |

### Smart Components

> *Smart Component audit events require UnqorkAI (9.0.0 and later).*

| `eventAction` | Description |
| --- | --- |
| `add-smart-component` | A Smart Component was created. |
| `save-smart-component` | A Smart Component was published. Includes the prior definition for diff comparison. |
| `delete-smart-component` | A Smart Component was deleted. |
| `modify-smart-component-discoverability` | A Smart Component's visibility was changed between public and private. |
| `promote-smart-components` | Smart Components were promoted between environments. |
| `duplicate-smart-component` | A Smart Component was duplicated. |
| `restore-smart-component-revision` | A Smart Component was restored to a previous revision. |
| `open-smart-component-edit` | An edit session was opened on a Smart Component. |
| `take-over-smart-component-edit` | An edit session on a Smart Component was taken over by another Creator. |
| `apply-smart-component-edit` | The changes from an edit session were applied to a Smart Component. |
| `discard-smart-component-edit` | The changes from an edit session on a Smart Component were discarded. |

### Start Node Administration

| `eventAction` | Description |
| --- | --- |
| `start-workflow-node` | A workflow start node was started. |
| `stop-workflow-node` | A workflow start node was stopped. |

### Style Administration

| `eventAction` | Description |
| --- | --- |
| `modify-style-details` | A style was changed. |
| `set-style-default` | A style was set as the default. |
| `delete-style-default` | A style's default setting was removed. |
| `promote-style-details` | A style was promoted to another environment. |

### Themes

> *Theme audit events require UnqorkAI (9.0.0 and later).*

| `eventAction` | Description |
| --- | --- |
| `add-theme` | A Theme was created. |
| `modify-theme` | A Theme's variables or settings were changed. |
| `delete-theme` | A Theme was deleted. |
| `promote-theme` | A Theme was promoted between environments. |

### LLM Credentials and Service Administration

> *LLM Credential audit events require UnqorkAI (9.0.0 and later).*

| `eventAction` | Description |
| --- | --- |
| `add-service-administration` | A service configuration was created. |
| `modify-service-administration` | A service configuration was changed. |
| `delete-service-administration` | A service configuration was deleted. |

> [!NOTE]
> The `service-administration` event action covers all service-level configurations, including LLM Credentials, Integration Gateway services, and others. Filter by the `serviceProtocol` or `authType` fields in `object.attributes` to isolate events for a specific service type.

### Integration Gateway

| `eventAction` | Description |
| --- | --- |
| `create-workato-widget-token` | A Workato widget token was created. |

### Workflow Submissions

| `eventAction` | Description |
| --- | --- |
| `create-workflow-submissions` | Workflow submission data was created. |
| `get-workflow-submissions` | Multiple workflow submissions were retrieved. |
| `get-workflow-submission` | A single workflow submission was retrieved. |
| `update-workflow-submission` | A single workflow submission was updated. |
| `delete-workflow-submissions` | Multiple workflow submissions were deleted. |
| `delete-workflow-submission` | A single workflow submission was deleted. |
| `restore-workflow-submission` | A workflow submission was restored. |

### Workspaces

| `eventAction` | Description |
| --- | --- |
| `add-workspace` | A workspace was created. |
| `modify-workspace` | A workspace's settings were changed. |
| `delete-workspace` | A workspace was deleted. |
| `view-workspace` | A workspace was viewed. |
| `add-workspace-user` | A Creator was added to a workspace. |
| `delete-workspace-user` | A Creator was removed from a workspace. |
| `add-data-model` | A data model was created in a workspace. |
| `modify-data-model` | A data model was changed. |
| `delete-data-model` | A data model was deleted. |
| `archive-data-model` | A data model was archived. |
| `add-schema` | A JSON schema was added to a data model. |
| `modify-schema` | A data model's JSON schema was changed. |
| `delete-schema` | A data model's JSON schema was deleted. |
| `archive-schema` | A data model's JSON schema was archived. |
| `restore-schema` | A data model's JSON schema was restored. |
| `export-records` | Records were exported from Record Collections. |
| `import-records` | Records were imported into Record Collections. |
| `create-model-records` | Records were created in a data model. |
| `get-model-record` | A single record was retrieved. |
| `get-model-records` | Multiple records were retrieved. |
| `get-model-records-revisions` | The revision history of records was retrieved. |
| `update-model-record` | A record was changed. |
| `update-records` | Records were changed in a bulk operation. |
| `archive-model-records` | Records were archived. |
| `delete-model-records` | Records were deleted. |
| `delete-records` | Records were deleted in a bulk operation. |

### Application Versioning

> *Application Versioning audit events require the Branch & Merge Beta.*

| `eventAction` | Description |
| --- | --- |
| `version-control-create-branch` | A branch was created. |
| `version-control-update-branch` | A branch's settings were changed. |
| `version-control-discard-branch` | A branch was discarded. |
| `version-control-remove-branch` | A branch was removed. |
| `version-control-submit-pull-request` | A pull request was submitted for review. |
| `version-control-approve-pull-request` | A pull request was approved. |
| `version-control-reject-pull-request` | A pull request was rejected. |
| `version-control-cancel-pull-request` | A pull request was cancelled. |
| `version-control-merge-branch` | A branch was merged. |

### Bring Your Own Component (BYO)

| `eventAction` | Description |
| --- | --- |
| `install-package` | A BYO component package was installed. |
| `uninstall-package` | A BYO component package was uninstalled. |
| `verify-package` | A BYO component package was verified. |
| `download-package` | A BYO component package was downloaded. |
| `promote-package` | A BYO component package was promoted to another environment. |

### Comments

| `eventAction` | Description |
| --- | --- |
| `add-comment` | A comment was created. |
| `modify-comment` | A comment was changed. |
| `delete-comment` | A comment was deleted. |

### Search Configuration

| `eventAction` | Description |
| --- | --- |
| `create-search-config` | A search configuration was created. |
| `update-search-config` | A search configuration was changed. |
| `fetch-search-config` | A search configuration was retrieved. |
| `fetch-search-configs` | Multiple search configurations were retrieved. |
| `archive-search-config` | A search configuration was archived. |
| `remove-search-config` | A search configuration was removed. |
| `execute-search` | A search was executed. |

### Workflow Access

| `eventAction` | Description |
| --- | --- |
| `access-workflow` | A workflow was accessed. |
| `execute-workflow` | A workflow execution was triggered. |

## Querying Audit Logs

**Endpoint**: `GET /logs/audit-logs`

**Access**: Designer Administrator only.

### Update Frequency

Unqork uploads audit log events in batches instead of writing each event as it occurs. A new event is not available to query until its batch uploads. A batch uploads when the upload interval elapses or the batch reaches its size limit, whichever comes first.

The following table lists the approximate upload interval and batch size limit by hosting platform.

| Hosting Platform | Upload Interval | Batch Size Limit |
| --- | --- | --- |
| Amazon Web Services (AWS) | About 5 minutes | 10 MB |
| Google Platform (GCP) | About 5 minutes | 10 MB |
| Azure | About 30 minutes | 200 MB |

> [!NOTE]
> A query window that ends in the most recent upload interval can return incomplete results. Rerunning the query after the interval elapses returns the missing events.

### Query Parameters

| Parameter | Required | Description |
| --- | --- | --- |
| `startDatetime` | Yes | The start of the query window in ISO 8601 format. Seconds and milliseconds must be `0`. The window includes the start minute. |
| `endDatetime` | Yes | The end of the query window in ISO 8601 format. Seconds and milliseconds must be `0`. The window excludes the end minute. |
| `unzip` | No | Accepts `true` or `false`. When `true`, returns decompressed log content. Defaults to `false`. |

> [!WARNING]
> The query window must not exceed one hour, and start time must be before end time.

**Example request**:

```
GET /logs/audit-logs?startDatetime=2026-04-13T10:00:00.000Z&endDatetime=2026-04-13T11:00:00.000Z
```

Both `startDatetime` and `endDatetime` must be set to the exact minute. Seconds and milliseconds must be `0`. The window in this example is exactly one hour, which is the maximum allowed.

### Response

```json
{
  "logLocations": ["string"]
}
```

The response returns an array of download links for the log files in the requested time window. Each link expires 15 minutes after the response is returned. Log files are stored in gzip (`.gz`) format. Set `unzip` to `true` to receive decompressed content.

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-10-14 | Added Update Frequency by hosting platform; corrected Event Structure fields, `source` values, and query parameters; added missing eventAction values. |
| 2026-09-11 | Expanded Logged Events to include all eventAction categories; added payload schema sub-articles. |
| 2026-09-11 | Full rewrite — added eventAction values for all existing categories; added Smart Components, Themes, and LLM Credentials sections. |
| — | Initial publication. |

An API endpoint is the location where an API receives requests for a specific resource on its server. It's the point of contact between an API client and an API server, and is usually a uniform resource locator (URL) that provides the location of the resource.

A query lets you retrieve, access, manipulate, and delete data in a database.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

The Internet Protocol (IP) address is a unique identifier for a device or network connected to the internet.

HTTP (Hypertext Transfer Protocol) is an application-layer protocol used to transmit hypermedia documents like HTML.

A URL (uniform resource locator) is a unique identifier used to locate a resource on the internet. Also known as a web address.

A standard format for representing dates and times. ISO 8601 format is represented in the following order: year, month, day, hour, minutes, seconds, and milliseconds.

APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services.

API rate limiting is a form of security and quality control for managing access to an API. Rate limiting an API increases security by preventing malicious actors from overwhelming the API with requests that violate the policies set by the API's Owner. Rate limiting also increases quality control by increasing relability and minimizing response times for end-users accessing the API.

Cross-Origin Resource Sharing (CORS) lets you control access to resources located outside a given domain.

HTML (Hyper Text Markup Language) is the standard markup language for for achieving font, color, graphic, and hyperlink effects when creating web pages.

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

OAuth, or Open Authorization, is an authorization protocol that lets users grant third-party access to their information without sharing their passwords. OAuth is an industry standard that's used by many companies, including Google, Amazon, and Microsoft.

A key-value pair is a fundamental data structure where a unique "key" is associated with a specific "value," used for organizing and retrieving data efficiently, like in dictionaries or databases.

A query lets you retrieve, access, manipulate, and delete data in a database.

PDF (Portable Document Format) is a file format that allows users to share and print documents without modifying them.

OIDC (OpenID Connect) is an identity authentication protocol that lets two applications share user information without exposing user credentials.

Single Sign-On is an authentication scheme that enables users to use one set of login credentials across multiple services.

Security Assertion Markup Language (SAML) is a protocol that allows an identity provider (IdP) to send a user's credentials to a service provider (SP) to verify their identity and grant them access to a service.

Large Language Models (LLM) are artificial intelligence (AI) programs that use deep learning algorithms to analyze and generate text and other content based on large amounts of data.

JSON (JavaScript Object Notation) is an open standard file and data interchange format. Unqork uses JSON for submission (record) data.

Schema is a declarative language that defines the structure, content, and constraints of the data.

In Unqork an application is a program used to perform specific tasks. An application can be one of two types: workflow or module.

An array is a type of object that stores one or more data types. Data types supported in arrays include numbers, strings, and objects.

Gzip is a file format and software application used for file compression and decompression.