# Audit log of organisation changes

> The audit log records who changed what in your organisation, when, and from which address. Owners and admins read it under Settings → Audit log.

> **In short**
>
> - The audit log records changes to invitations, roles, projects, keys, access tokens, claude.ai connections, recording settings, the rubric, a finding's fix links and its first handoff, and saved filters, funnels and flows.
> - Only owners and admins can see it. No one can edit or delete an entry.
> - Each entry shows who, what, when and, if Sequential recorded one, the IP address.
> - Sequential can fail to write an entry. A missing entry does not prove that nothing changed.
> - Sign-ins rarely appear. Do not use the log as a sign-in history.

## What it is for

Use the audit log to find who changed something, and when. For example:

- Replays of the sign-up form show what people type. Who changed the recording settings? Did they confirm that they loosened masking?
- A contractor has admin access. Who invited them, and with which role?

The log records changes that succeeded, not everyday use. See What makes no entry, below.

## Who can see it

Only owners and admins can see the log. For members and viewers, Sequential hides it and refuses their requests for it. See [Roles and permissions](/docs/roles-and-permissions).

Each organisation has its own log. To see the log of another organisation, select a project in that organisation in the project switcher.

## Read the log

1. Open **Settings** → **Audit log**. You can also click **Audit log** in your account menu. The newest 50 entries show first.
2. To see older entries, click **Load more**. Each click adds 50 entries. At the end, the list says "That is everything."
3. To narrow the list, choose an action from the **All actions** menu. The menu shows each action in words, in groups by area: **Sign-in and security**, **Organisation**, **Members**, **Projects**, **Agents and tokens**, **Findings** and **Billing**. An action that has no words yet shows its code under **Other**. The filter searches the whole log, not only the loaded entries.

| Column | What it shows |
|---|---|
| **When** | The time in your browser's time zone, with the date under it. |
| **Event** | A sentence that starts with who did it, such as "Ana invited bo@example.com as admin". Under it are the entry's details as `key: value` chips. |
| **Address** | The IP address the change came from, or "—" if Sequential recorded none. |

> **A missing entry is not proof**
>
> If Sequential cannot write an entry, the change still happens without an entry. So a missing entry does not prove that nothing changed.

## What is recorded

| Group | Changes that Sequential records |
|---|---|
| **Members** | Invitations, joins, role changes, removals and members who leave |
| **Organisation** | Creation, renames, the two-factor policy, two-factor reminders, and the organisation limits and the retention exemption that Sequential support sets |
| **Projects** | Creation, detail saves, archive, restore and delete. Before 13 October 2026, also a retention exemption by Sequential support |
| **Ingest keys** | Creation and revocation |
| **Access tokens** | Creation and revocation, and releases that a CI job or agent records with a token |
| **claude.ai connections** | **Allow**, the completed connection, **Disconnect**, each connection that Sequential ends, and each disconnect that the connected app reports. Not **Deny** |
| **Project settings** | Recording settings, the background judging switch and rubric changes |
| **Findings** | Fix links added and removed, and the first handoff of each finding. A token with `findings:link` can add links. Also **Draft a fix** hand-offs and its webhook settings |
| **Saved items** | Saving, renaming and deleting a saved filter, funnel or flow. Each item moved from a browser, and each **Undo** of a delete, records a save |
| **Account** | Sign-in, sign-out, password changes and resets, and two-factor codes. Most account actions never reach your organisation's log. |

`release.created` and the three saved-item codes have no sentence yet. The **Event** column shows who did it, then the raw action code, with its chips. For a token, who did it is "System".

## Changes by Sequential support

Sequential staff can make support changes to your organisation. They can change the project settings, archive or restore a project, revoke an ingest key or an access token, turn the two-factor requirement on or off, and set the organisation's limits. Each of these changes makes an entry in your audit log.

- The entry starts with "Sequential support", for example "Sequential support archived the project". It never shows the name of the staff member.
- The entry has no IP address. The **Address** column shows "—".
- The chips are the same as for the same change by a member of your organisation. The entry does not show the reason that the staff member gave.
- Sequential writes the entry together with the change. If it cannot write the entry, it does not make the change.
- After a support change to the recording settings, the **Session replay** tab shows "—" in place of the name of the person who saved.
- From 13 October 2026, a change to the organisation's limits shows only its values, for example "Sequential support set the organisation limits to 15,000 sessions a month, 30 days of event retention and 30 days of replay retention". A value that Sequential does not set reads "the default monthly sessions", "the default event retention" or "the default replay retention". Older entries name one retention, for example "… and 30 days of retention". A limit that ends on its end date makes the same entry.

## A project's recent changes

The **Recent changes** card is at **Settings** → **Projects** → your project → **Overview**. It lists the last 10 entries about that project, with how long ago each happened. From 11 October 2026, each entry is a sentence that names the person, as in the audit log. For example: "Ana changed the project settings (v5)". If Sequential cannot read your member list, a short id shows in place of the name. To see the chips of an entry, click **Audit log**. It opens the full organisation log, not filtered to the project.

Key changes do not show on the card, because Sequential files them under the key, not the project. Find them in the audit log.

## Find who changed the recording settings

1. Open the project's **Overview**. In **Recent changes**, find a sentence such as "Ana changed the project settings (v5)". It names the person who saved. Note how long ago it happened.
2. Click **Audit log**.
3. From **All actions**, choose **Project settings changed** (`project.config_changed`). Each entry reads like "Ana changed the project settings (v5)". The name before the sentence is the person who saved, or "Sequential support".
4. Find the entry at the time that you noted. If it is not loaded, click **Load more** until you reach that time.
5. Read the chips of the entry. The `loosened_masking` chip is `true` if the save made recording less private.

Recordings made while the looser settings were on keep what they captured. See [Recording settings](/docs/recording-settings) and [Masking and redaction](/docs/masking-and-redaction).

## Limits

- **Sign-ins rarely appear.** Do not use the log as a sign-in history. Other account actions reach the log only in a few cases.
- **Some logs cannot be opened.** You cannot select an organisation that has only archived or deleted projects, if you also have live projects in another organisation.
- **Recording and rubric entries do not name the project.** If you have several projects, compare the time with each project's **Recent changes**.
- **A details save reads as a rename.** A **Project details** save reads "renamed a project to …", also when only the slug or environment changed.
- **Removals and cancellations do not name the person.**
- **Release, saved-item and hand-off entries show only the action code.** `release.created`, the `project.saved_view_*` codes, `finding.dispatched`, the three `finding.draft_*` codes and the `dispatch_target.*` codes have no sentence.
- **Finding entries do not name the project**, and they do not show in a project's **Recent changes**. The `number` chip is the finding number, for example `12` for F-12.
- **You can filter by action only**, not by person, project or date.
- **The app does not show the browser**, although each entry stores the browser's user agent.
- **Deleting the organisation deletes its log.** Sequential keeps its own record of the deletion outside the log. See [Retention and deletion](/docs/retention-and-deletion#delete-an-organisation). Deleting a project keeps its entries and records the deletion.
- **Entries do not expire.** Sequential keeps each entry, with its IP address, until the organisation is deleted. No setting in the app changes this. The exception is a `project.deleted` entry: after 90 days, Sequential removes the project name, the IP address and the browser from it. The entry then reads "deleted a project".

### Who sees what, and how long entries last

- For members and viewers, Sequential hides the **Audit log** tab, the **Audit log** item in the account menu and the **Recent changes** card. Sequential also refuses their requests for the log.
- The app shows the log of the organisation of the project that is selected in the project switcher. If you belong to several organisations, switch to a project in the other organisation to see its log.
- No one can edit or delete an entry. Entries do not expire. No setting controls how long Sequential keeps them.
- Sequential removes entries only when the organisation is deleted.

### What makes no entry

Everyday use makes no entry. These actions make no entry: watch a replay, run an **Ask** search, apply a saved filter, funnel or flow, give feedback on a verdict, or set a verdict on a finding.

Sequential records only changes that succeeded. A wrong password, a rejected save or a cancelled **Loosen masking?** confirmation makes no entry. Sequential never writes passwords, tokens or one-time codes into an entry.

Sequential does not record these:

- creating an account
- regenerating backup codes
- changing your profile name
- declining an invitation
- failed sign-in attempts

### All action codes

| Action code | Recorded when | Reads as |
|---|---|---|
| `member.invited` | Someone sends or resends an invitation | "invited bo@example.com as admin" |
| `invitation.cancelled` | Someone cancels a pending invitation | "cancelled an invitation" |
| `member.joined` | Someone accepts an invitation | "joined the organisation" |
| `member.role_changed` | Someone changes a member's role | "changed Bo's role to viewer" |
| `member.removed` | Someone removes a member | "removed a member" |
| `member.left` | A member leaves | "left the organisation" |
| `organization.created` | Someone creates the organisation | "created the organisation Acme" |
| `organization.updated` | Someone renames the organisation | "renamed the organisation to Acme Ltd" |
| `organization.policy_changed` | Someone, or Sequential support, turns **Require two-factor authentication** on or off | "made two-factor authentication required for every member" or "stopped requiring two-factor authentication" |
| `organization.limits_changed` | From 13 October 2026, Sequential support sets the organisation's limits, or a limit ends on its end date. Only the values are kept | "set the organisation limits to 15,000 sessions a month, 30 days of event retention and 30 days of replay retention" |
| `organization.two_factor_reminder_sent` | From 13 October 2026, an owner or admin sends two-factor reminders. Only the number of members is kept | "sent a two-factor reminder to 2 members" |
| `organization.bootstrapped` | Sequential set up the organisation for you, not through sign-up. Each later run of that setup adds another entry, for example when it adds a project or key for you | "set up the organisation" |
| `project.created` | Someone creates a project | "created the project Checkout" |
| `project.updated` | Someone saves **Project details** on the project's **Danger** tab | "renamed a project to Checkout" |
| `project.archived`, `project.unarchived` | Someone clicks **Archive project** or **Restore project**, or Sequential support archives or restores the project | "archived the project" or "restored the project" |
| `project.deleted` | Someone deletes a project | "deleted the project Checkout" |
| `organization.retention_cap_exempt_changed` | From 13 October 2026, Sequential support exempts the events of the organisation's projects from the server-wide retention limit, or ends the exemption. The actor is "Sequential support" | the action code |
| `project.retention_cap_exempt_changed` | Before 13 October 2026, Sequential support exempted the events of one project, or ended the exemption. The actor is "Sequential support" | the action code |
| `ingest_key.created` | Someone creates a key with **Create key** or **Rotate** | "created a PostHog ingest key" |
| `ingest_key.revoked` | Someone revokes a key with **Revoke key**, or with **Revoke old key** after **Rotate**, or Sequential support revokes a key. **Keep both** leaves the old key live and records nothing | "revoked a PostHog ingest key" |
| `access_token.created` | Someone creates a token with **Create token** on the **Access tokens** tab or the **Agents** page, with **Create token** in onboarding or in the setup checklist on **Dashboard**, or with **Add an agent access token to this prompt** on **Setup** or in that checklist | "created the access token ci-deploy" |
| `access_token.revoked` | Someone revokes a token with **Revoke token**, disconnects claude.ai with **Disconnect**, or stops a claude.ai connection that is still connecting with **Cancel connection**. Or Sequential support revokes a token | "revoked the access token ci-deploy". For a connection: "disconnected Claude (claude.ai)" |
| `oauth.consent_granted` | Someone presses **Allow** on the consent page to connect claude.ai, and Sequential creates the connection | "connected an agent via claude.ai" |
| `oauth.token_issued` | claude.ai finishes the connection. No person is the actor | "completed an agent connection" |
| `oauth.grant_revoked` | Sequential ends a connection: its person lost access, changed or reset their password, or a sign-in code of the connection was used twice | "ended an agent connection (access lost)", or with the reason, for example "(password reset)" |
| `oauth.refresh_reuse_detected` | An old renewal credential of a connection was used again, so Sequential ended the connection. No person is the actor | "ended an agent connection: a refresh token was reused" |
| `oauth.revoked_by_client` | The connected app told Sequential that it disconnected. No person is the actor | "ended an agent connection: the agent disconnected itself" |
| `release.created` | A CI job or agent records a release with an access token. No person is the actor | the action code |
| `finding.handed_off` | The first time a finding is handed off: someone clicks **Copy fix brief** or **Open a GitHub issue**, or a token reads the finding or its fix brief. Later handoffs make no entry | "handed off F-12" |
| `finding.link_added` | Someone, or a token with `findings:link`, adds a fix link. Adding a link that is already there makes no entry | "linked a fix to F-12" |
| `finding.link_removed` | Someone removes a fix link. A token cannot remove one | "removed a fix link from F-12" |
| `finding.dispatched` | An owner or admin uses **Draft a fix** on a finding: **Get a prompt for your agent** or **Send to your webhook** | the action code |
| `finding.draft_requested` | An agent asks for a draft fix with the tool `request_fix_draft` (a token with `findings:draft`). No person is the actor | the action code |
| `finding.draft_approved` | An owner or admin approves an agent's request on the finding: **Approve: send to your webhook** or **Approve: get a prompt** | the action code |
| `finding.draft_declined` | An owner or admin clicks **Decline** on an agent's request | the action code |
| `billing.pack_granted` | Sequential support gives your organisation a session pack. The actor is "Sequential support" | "granted the 2,000-session pack until 3 Nov 2026" |
| `billing.pack_revoked` | Sequential support takes that pack back | "revoked the granted pack" |
| `billing.checkout_started` | An owner or admin clicks **Continue to payment** for a pack | "started checkout for the 30,000-session pack" |
| `billing.pack_upgraded` | An owner or admin upgrades the pack | "upgraded the pack, paying $50.00" (before tax). It adds "(waiting for the payment to be confirmed)" when the bank asks for a check. A declined card reads "tried to upgrade the pack for $50.00; the card was declined, so the change was reversed" |
| `billing.pack_downgrade_scheduled` | An owner or admin schedules a smaller pack | "scheduled a smaller pack from 3 Nov 2026" |
| `billing.pack_cancel_scheduled` | An owner or admin schedules the return to the free tier | "scheduled the return to the free tier on 3 Nov 2026" |
| `billing.pending_cancelled` | An owner or admin cancels a scheduled change, or an upgrade that waits for payment | "cancelled the scheduled pack change" or "abandoned an unpaid upgrade". If the change was set in Stripe's portal, it reads "tried to cancel a scheduled change that was set in the billing portal" |
| `billing.portal_opened` | An owner or admin opens Stripe's billing portal with the button on **Billing**: **Payment details and invoices**, **Update payment method** or **Finish payment** | "opened the billing portal" |
| `billing.state_changed` | Sequential takes a new billing state or a new pack from Stripe. The actor is "System" | "moved billing from the free tier to active" |
| `billing.upgrade_swept` | Sequential reverses an upgrade that was not paid in time. The actor is "System" | "reversed an unfinished upgrade" |
| `billing.upgrade_paid_off_target` | A payment for an upgrade arrives after the pack changed again. Sequential checks it for a refund. The actor is "System" | "flagged an upgrade payment for a refund check" |
| `billing.org_delete_refused_after_cancel` | A delete of the organisation was refused after Sequential had cancelled its subscription | "tried to delete the organisation; the delete was refused (…) after billing had already been cancelled, so the subscription ended" |
| `dispatch_target.updated` | An owner or admin saves the webhook under **Settings** → **Projects** → your project → **Draft a fix** | the action code |
| `dispatch_target.rotated` | An owner or admin clicks **New signing secret** on that page | the action code |
| `project.config_changed` | Someone saves settings on the project's **Session replay** tab, switches background judging on the **Insights** tab, or Sequential support changes the project settings | "changed the project settings (v5)". For the switch: "turned off background judging (v6)" |
| `project.rubric_changed` | Someone saves the rubric on the project's **Insights** tab | "changed the rubric to v4 (2 questions changed)" |
| `project.rubric_reset` | Someone clicks **Reset to default** on the **Insights** tab | "reset the rubric to default" |
| `project.saved_view_created` | Someone saves a filter, funnel or flow, moves one from their browser, or clicks **Undo** after a delete | the action code |
| `project.saved_view_updated` | Someone renames a saved filter, funnel or flow | the action code |
| `project.saved_view_deleted` | Someone deletes a saved filter, funnel or flow | the action code |

Account actions have no action code in this table.

### Account actions and sign-ins

Sequential also records account actions: sign-in, sign-out, password changes and resets, and two-factor codes. The two-factor codes include the code that turns on two-factor. Turning off two-factor and revoking sessions are account actions too.

Sequential files an account action under the organisation that the person's session had selected at that time. A new sign-in has no selected organisation yet, so sign-ins normally do not reach your log. An empty log still shows "Sign-ins, membership and project changes are recorded here."

Account actions other than sign-in, such as a password change or a sign-out, reach an organisation's log only in these cases. Earlier in that same sign-in, the person did one of these:

- created the organisation
- accepted an invitation to it
- used the project switcher to move into it from another organisation

Do not use the log as a sign-in history.

### The Recent changes card

- Only owners and admins see the card.
- The card lists entries as sentences, as in the audit log. These are creation, detail saves, archive and restore, recording settings and rubric changes. An entry that has no sentence shows its action code.
- Changes to saved filters, funnels and flows do not show on the card. Find them in the audit log.

### More about the limits

- **Why some logs cannot be opened:** the project switcher lists only live projects. An organisation can have only archived or deleted projects. If you also have live projects in another organisation, you cannot select that organisation. So you cannot open its log from the app.
- **Project names:** recording and rubric entries carry a version and details only. Key entries carry a `project_id` chip. It is the same id as in the address of that project's settings.
- **Details saves:** the chips show the values after the save, not before.
- **Removals and cancellations:** "removed a member" has only the member's id, in a `memberIdOrEmail` chip. "cancelled an invitation" has only an `invitationId` chip.

### How names, ids and counts show

- Names come from your current member list. A person who left the organisation shows as a short id.
- If no person and no support staff made the change, the entry starts with "System".
- If Sequential support made the change, the entry starts with "Sequential support".
- The app shortens long ids in chips to 8 characters. To see the full value, hover over the chip.
- The count beside the title is the number of loaded entries. It shows a "+" while there are more.
- `release.created` has no sentence. The row shows "System", then the raw action code.
- `release.created`, the three `project.saved_view_*` codes, `finding.dispatched`, the three `finding.draft_*` codes, the two `dispatch_target.*` codes, `organization.retention_cap_exempt_changed` and `project.retention_cap_exempt_changed` show in the **All actions** menu only when a loaded entry uses them, as their code under **Other**. The other actions always show in the menu, in words. The menu always lists twelve billing actions under **Billing**: the two for support packs, and ten for paid packs. The menu also always lists five actions of claude.ai connections under **Agents and tokens**. It does not list `oauth.consent_denied`: Sequential records a **Deny** without an organisation, so no organisation's log shows it.

### Access token, finding and saved-item chips

- `access_token.created`: `project_id`, `name` and `scopes`.
- `access_token.revoked`: `project_id`, `name`, `scopes` and `kind`. `kind` is `pat` for the tokens that you create, and `oauth` for a claude.ai connection. A revocation by Sequential support also has `kind`.
- `oauth.consent_granted`: `client_id`, `redirect_host`, `project_id`, `grant_id`, `scopes`, `preset` and `step_up`. `step_up` is `totp_or_backup` or `not_enrolled`.
- `oauth.grant_revoked`, `oauth.refresh_reuse_detected` and `oauth.revoked_by_client`: `project_id`, `kind`, `reason` and `client_id`. When the connected app ends only one of its access credentials, `oauth.revoked_by_client` also has `token_kind`.
- These entries never hold the token itself.
- `release.created` from a token: `token_id`, `project_id`, `version`, `environment` and `commit_sha`. The entry has no person as actor.
- `finding.link_added`: `number`, `kind` and `url`. From a token, also `token_id`, and the entry has no person as actor.
- `finding.link_removed`: `number` and `url`.
- `finding.handed_off`: `number` and `via`, and from a token also `token_id`. `via` tells how the finding was handed off: `copy`, `issue`, `rest` or `mcp`. The app shows `via` as a chip only on this action.
- `finding.dispatched`: `number`, `kind` (`issue`, `prompt` or `webhook`) and `outcome`, and `failure` when a webhook send failed.
- `finding.draft_requested`: `number` and `token_id`. `finding.draft_approved`: `number`, `kind`, `outcome`, and `failure` when a webhook send failed. `finding.draft_declined`: `number`. None of them holds the brief or an address.
- `billing.pack_granted`: `pack`, `sessions` and `expires_at`. `billing.pack_revoked`: `pack`.
- `organization.retention_cap_exempt_changed` and `project.retention_cap_exempt_changed`: `retention_cap_exempt` and `previous`, each `true` or `false`.
- `dispatch_target.updated`: `project_id` and `enabled`. `dispatch_target.rotated`: `project_id` and `generation`. Neither holds the webhook address or the secret.
- From a token, a finding entry starts with "System", for example "System linked a fix to F-12".
- `project.saved_view_created`, `project.saved_view_updated` and `project.saved_view_deleted`: `kind`, `name` and `project_id`, then `before` and `after`. `kind` is `filter`, `funnel` or `flow`. `before` and `after` hold the name, the conditions or steps and the version, as raw JSON. A save has no `before` and a delete has no `after`. So the log keeps the conditions of a deleted item, including any values in them.

See [Findings and fixes](/docs/findings).

### Recording settings chips

- `version`: the settings version that this save created. The **Session replay** tab shows the current version and who saved it.
- `diff`: each setting that changed, as its path with the value before and after. For example: `{"/replay/masking/mask_all_inputs":[true,false]}`.
- `loosened_masking`: `true` if the save made recording less private. To save it, the person typed the project slug into the **Loosen masking?** sheet.
- `loosening`: what the person confirmed. For example: "inputs are no longer masked".

### Find who invited whom

1. Open **Settings** → **Audit log**.
2. From **All actions**, choose **Member invited**. Each entry reads like "Ana invited bo@example.com as admin". A resent invitation adds another entry.
3. To see when people accepted, choose **Member joined**.
4. To see later role changes, choose **Member role changed**. For example: "Ana changed Bo's role to viewer".
5. To see cancelled invitations and removed members, choose **Invitation cancelled** or **Member removed**. These entries do not name the person. See Limits.

### Find who changed the rubric

1. Open the project's **Overview**. In **Recent changes**, look for "changed the rubric" or "reset the rubric to default".
2. Click **Audit log**. From **All actions**, choose **Rubric changed** or **Rubric reset to default**. Entries read like "Ana changed the rubric to v4 (2 questions changed)".
3. To see which questions changed, read the `summary` chip. It lists the ids of the questions that were `added`, `removed` and `reworded`.

About the version and the count:

- The version in the entry matches the version in the "Customised · v4 · …" stamp on the project's **Insights** tab.
- The count is the number of questions added, removed or reworded. If you turn off a question, it counts as removed.
- If no questions were added, removed or reworded, the entry has no count.

As the rubric editor says, a rubric change applies to sessions judged after the change. Sequential does not re-judge old sessions in bulk. See [Customise the rubric](/docs/rubric).

### What a new project records

A new project gets one default key per source. A staging or development project also gets its first recording-settings version, v1. None of these has its own entry. Sequential records only `project.created`.

So a staging project's **Session replay** tab can show v1 and who saved it, with no `project.config_changed` entry to match.

### More questions the log answers

- Watch shows different sessions this week. Did someone edit the rubric?
- PostHog events stopped. Did someone revoke the key, or archive the project?

## Related

- [Roles and permissions](/docs/roles-and-permissions)
- [Sign-up and invitations](/docs/sign-up-and-invitations)
- [Two-factor and security](/docs/two-factor-and-security)
- [Organisations, projects and keys](/docs/organisations-and-projects)
- [Recording settings](/docs/recording-settings)
- [Masking and redaction](/docs/masking-and-redaction)
- [Customise the rubric](/docs/rubric)