Audit log
Who did what in your workspace, and when.
The audit log records changes to content, publishing, members, roles, security settings, keys, webhooks and exports, and every tool call an AI agent makes. Open it from Audit log in the dashboard menu. You need the "See the audit log" permission.
Each entry has:
- the action, such as
content.publishedormember.role_changed; - the actor: a person, an API key, a connected app (by name) or SCIM;
- the target, such as the tour or the member it changed;
- details of the change, the IP address and the user agent, and the time.
Secrets never appear in entries. Entries are kept for 400 days.
Filter and export
Filter by action (exact, or a whole area like content.*), actor, target and date range.
Export downloads the filtered entries as CSV, newest first, up to 100,000 rows; narrow the dates for more. Each export is itself recorded as audit.exported.
From the API:
curl "https://app.cueston.com/api/audit-events?action=content.*&from=2026-10-01&limit=50" \
-H "Authorization: Bearer $CUESTON_API_KEY"The response has events and a nextCursor; pass it as cursor for the next page. /api/audit-events/export takes the same filters and returns CSV.
Some of the actions
| Area | Actions |
|---|---|
| Content | content.created, content.updated, content.deleted, content.published, content.unpublished, content.rolled_back |
| Reviews | publish_request.created, .approved, .rejected, .canceled |
| Team | member.invited, member.joined, member.role_changed, member.removed, member.left, role.created, role.updated, role.deleted |
| Security | auth.login, auth.login_failed, auth.password_changed, sso.updated, sso.domain_verified, identity_verification.updated, scim.* |
| Keys and integrations | api_key.created, api_key.revoked, webhook.*, workspace.key_rotated |
| Data | analytics.exported, end_user.exported, end_user.deleted, audit.exported |