Audit Log
Organization-level audit events that record who did what in your Factory organization.
The Factory audit log records organization-level events so you can track who did what in your organization. Each event captures who acted, where the action originated, what was affected, and structured details about the change.
Info
Enterprise Feature -- The audit log is available to Enterprise organization owners only. Owners can view the audit log in the Factory web app under Team Settings, or via the public API.
Overview
Every audit event includes:
- Actor -- the user or service principal who initiated the action (or
nullfor system-initiated events). - Source -- the surface that originated the event (e.g. web settings pages, public API, identity provider webhooks).
- Target -- identifiers for the affected entity (e.g. user, service account, integration).
- Payload -- structured, event-specific details. Contains only IDs and enum values, never secrets.
- Timestamp -- ISO 8601 timestamp of the event.
Event categories
Audit events cover the following categories of organization activity:
- Usage limits -- per-user token usage limit changes.
- Membership -- role changes, invitations, and member removals.
- API keys -- creation and deletion of user and service-account API keys.
- Service accounts -- creation, modification, deletion, and credential/grant changes.
- Integrations -- connection, disconnection, configuration, and availability toggles.
- Organization lifecycle -- creation and deactivation of organizations.
- Managed settings -- updates to org-managed settings (with revision tracking for before/after diffing).
- Analytics settings -- updates to org-wide analytics preferences.