Audit Log: See Who Did What in Your Project or Workspace

Workspace and Project admins can now read an Audit log under Usage → Activity. It answers "who did what, when" without asking us, and it's available on every plan, including Free.

Each entry records who acted, what they acted on, the IP address they acted from, and when. Filter by user, by action, or by date range, and combine them.

What's New

• Security-relevant actions in one place. Sign-ins and failed sign-ins, password and two-factor changes, membership and role changes, API key and access token creation and revocation, billing and plan changes, content publishing and deletion, and deletion of media, Object types, Buckets, Projects and Workspaces.

• The paths content takes out of Cosmic. Backup downloads, webhook creation and endpoint changes, Bucket sharing changes, and integration, extension and custom domain changes.

• Cosmic support access is recorded, and attributed to us. When a member of our team signs into your account to work a support ticket, the entry names the staff member and the customer they acted as. It never appears as activity by you.

• Agent actions are attributed to the agent. An Agent that deletes an Object is recorded under the Agent's name, not under a borrowed human identity. Where a person prompted it, the entry names both. Where it ran on a schedule with nobody present, the entry says so rather than blaming whoever owns the account.

• Filters served from the whole log. The user and action lists come from every event in scope rather than from what's on screen, so filtering by someone whose activity predates the first page still works.

• Two scopes. A Project log covers every Bucket in that Project. A Workspace log covers every Project, plus the events that belong to no single Project such as billing and Workspace membership.

Why This Matters

Reconstructing what happened after the fact used to mean emailing support. Now it's a filter.

The property that makes the log worth consulting is that nobody can edit it. Records are append-only: Cosmic exposes no way to change or remove an entry, and no such tool exists internally either, because the database layer rejects updates and deletes on this collection outright. A record an administrator could quietly amend would answer the question it was consulted for, and answer it wrongly.

How It Works

1. Open a Project or Workspace and go to Usage → Activity.

2. Filter by user, by action, or by date range. Combine them to narrow to a single incident.

3. Read the entry: the actor, the target, the IP address and the timestamp. Where the actor was an Agent or a Cosmic staff member acting on a ticket, the entry says so.

Reading the log requires admin access to the Project or Workspace.

Retention

Set by plan: 30 days on Free and Builder, 90 days on Team, 180 days on Business, and 365 days on Small Workspace, Large Workspace and Enterprise. Enterprise agreements can set a longer window. Workspace and Enterprise plans hold a year of history across every Project in the account, which is the window most security reviews and customer audits ask for.

Two details worth knowing:

• Sign-ins and credential changes are kept for 365 days on every plan, including Free. They belong to a person rather than to a Project, and they're the records that matter most if an account is compromised, so they aren't shortened.

• A longer window applies going forward, not retroactively. An entry's expiry is written the moment the entry is recorded, and nothing can rewrite it afterwards, which is the same immutability that makes the log trustworthy.

What It Doesn't Cover

Worth stating plainly, because an empty filter result reads as "this didn't happen":

• Reads aren't recorded. Viewing content leaves no entry.

• Media uploads and replacements aren't recorded, only deletions. Uploads remain visible in the Media library.

• Draft edits that stop short of publishing are captured by revision history on the Object, not here.

• Destructive Agent actions are recorded here; the full turn-by-turn history of an Agent run lives in the Agent's Runs view for 90 days.

Get Started

• Read your log: Project or Workspace → Usage → Activity

• Documentation: Audit log

• Related: Roles and permissions

• Security overview: Trust and security at Cosmic

• Start building for free