> ## Documentation Index
> Fetch the complete documentation index at: https://docs.centure.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Track user actions and API activity across your organization

Audit logs track user actions within the Centure platform. These logs are separate from [System Events](/logs/system-events), which track authentication and identity-related activity through WorkOS.

## Audit Logging Add-on

Audit logging records all API activity and user actions across your organization. This feature requires the Audit Logging add-on to be enabled.

<Info>
  See [Add-ons pricing](/pricing/add-ons) for audit logging costs and retention options.
</Info>

## Getting Started

To enable audit logging for your organization:

<Steps>
  <Step title="Navigate to Audit Logs Page">
    In your organization's dashboard, navigate to the **Audit Logs** page from the sidebar (visible to organization administrators only).
  </Step>

  <Step title="Subscribe to Audit Logging">
    If you do not have an active audit logging subscription, you will see a banner at the top of the page. Click **Subscribe Now** to start the checkout process.
  </Step>

  <Step title="Complete Payment">
    You will be redirected to Stripe to complete your subscription.
  </Step>

  <Step title="Access Audit Logs">
    After your subscription is active, you can access audit logs through the WorkOS portal by clicking **View Audit Logs** or **Configure Log Streams** on the Audit Logs page.
  </Step>
</Steps>

<Note>
  Cancellation of audit logging will be effective at the end of the billing period.
</Note>

## What Audit Logs Track

Audit logs capture user actions within the Centure platform:

* **API key operations** - Creation, updates, revocations, and access
* **Project management** - Project creation, settings changes, and member access
* **Organization changes** - Organization settings, domains, and configuration
* **MCP proxy operations** - Proxy configuration, OAuth flows, and connections
* **Member management** - User access grants and permission changes
* **Analytics access** - Usage analytics and metrics views

Audit logs require the Audit Logging add-on and follow a standardized event schema.

## WorkOS Integration

Centure uses WorkOS Audit Logs to provide enterprise-grade audit logging. Each event includes:

* **Actor**: The user who performed the action
* **Targets**: The resources affected by the action
* **Context**: IP address, user agent, and location information
* **Metadata**: Additional details specific to the action

WorkOS provides:

* Event retention based on your subscription tier (30 days or 12 months)
* Export capabilities for compliance and analysis
* SIEM integrations for security monitoring
* Search and filtering through the audit logs portal

## Accessing Audit Logs

Access your organization's audit logs through the WorkOS portal. Only organization administrators can view audit logs.

<Steps>
  <Step title="Navigate to Audit Logs">
    In your organization's sidebar, click **Audit Logs** (visible to admins only).
  </Step>

  <Step title="Open WorkOS Portal">
    Click the **View Audit Logs** button to generate a secure portal URL and open the WorkOS Audit Logs portal in a new tab.
  </Step>

  <Step title="Search and Filter Events">
    Use the search and filter tools to find specific events by actor, action, date range, or target resource.
  </Step>

  <Step title="Export Events">
    Export filtered events as CSV for analysis or compliance reporting.
  </Step>
</Steps>

## Event Categories

Centure logs audit events across multiple resource types:

* [API Keys](/logs/events/api-keys) - Key creation, updates, and revocations
* [MCP Proxies](/logs/events/mcp-proxies) - Proxy configuration and OAuth flows
* [Projects](/logs/events/projects) - Project creation and settings changes
* [Project Memberships](/logs/events/project-memberships) - User access management
* [Organizations](/logs/events/organizations) - Organization settings and domains
* [External Apps](/logs/events/external-apps) - OAuth consent flows
* [SSO](/logs/events/sso) - Single sign-on configuration
* [Directory Sync](/logs/events/directory-sync) - User provisioning events
* [Audit Log Streams](/logs/events/audit-log-streams) - Portal access events
* [Users](/logs/events/users) - User profile views
* [Analytics](/logs/events/analytics) - Usage analytics access

See [Audit Log Events](/logs/audit-events) for the complete event schema and detailed documentation for each event type.