Audit log
The audit log answers "who did what, when" without asking Cosmic. It records security-relevant actions across a Project or Workspace, and every entry names the person or agent who acted, what they acted on, the IP address they acted from, and the time.
It is available on every plan, including Free. The retention window is set by plan.
Where to find it
Go to Usage > Activity > Audit log, at either scope:
- Project: everything that happened in that Project, across all of its Buckets. Requires the Project Admin role.
- Workspace: everything across every Project in the Workspace, plus the Workspace-level events that belong to no single Project, such as billing and Workspace membership. Requires the Workspace Admin role.
This is deliberately narrower than the neighbouring activity tabs. The audit log spans every Bucket and includes billing, role and API key events, so it is a wider view than a Manager otherwise has. See Roles and permissions.
Personal projects are not part of a Workspace, so they have no Workspace-level log. Open the Project's Usage page instead.
What gets recorded
Authentication and credentials. Sign-in, failed sign-in, sign-out, password change, password reset request, two-factor enabled or disabled, email address change, account deactivation and deletion.
Cosmic support access. When Cosmic staff access your account to help with a support request, the entry names the staff member and the customer they acted as. Support access is never recorded as the customer.
Team and roles. Invitations sent, accepted and revoked, members added and removed, and role changes at Workspace, Project and Bucket level. Grants and revocations of Cosmic staff admin are recorded too.
Keys and tokens. API key creation, rotation and revocation, and access token lifecycle.
Billing. Plan changes, subscription changes and payment method changes.
Content. Object publishing and deletion, Object type deletion, and clearing the content from an Object type. Media is recorded on deletion only: a deleted file leaves no other trace, while uploads and replacements remain visible in the Media library.
Tenancy. Bucket, Project and Workspace deletion, Project transfer between Workspaces, and changes to Bucket sharing settings.
Configuration and integrations. Webhook creation, update and deletion; connecting and disconnecting integrations such as Slack, WhatsApp and Telegram; extension install, update and removal; and domain connection and disconnection.
Data leaving Cosmic. Backup downloads, recorded when the download link is issued.
Session activity. A daily record that an account was active, which is what makes a dormant account visible.
Actions taken by AI agents
An agent that deletes an Object is recorded the same way a person is, under the agent's name rather than under a borrowed human identity.
Where a person prompted the agent, the entry names both. Where the agent ran on a schedule with nobody present, it is marked as an unattended run and the account it belongs to is recorded as the owner rather than as the actor. An autonomous action is never attributed to a human who was not there.
What is not recorded
Being explicit about this matters more than the list looks. A filter that returns an empty table reads as "this did not happen", so anything the log does not cover is stated rather than left to be inferred.
- Reads. Viewing content is not recorded. API request volume is in Usage and Cosmic Insights, but not per-user reads.
- Media uploads and replacements. Only deletions are recorded.
- Every individual agent tool call. Destructive agent actions are recorded here. The full turn-by-turn history of an agent run lives in the agent's run history for 90 days.
- Object edits that stop short of publishing. Draft edits are captured by revision history on the Object, not here.
Filtering
Filter by user, by action, or by date range, and combine them. The user and action lists are served from the whole log rather than from the page on screen, so filtering by someone whose activity is older than the first page still works.
Retention
| Plan | Retention |
|---|---|
| Free | 30 days |
| Builder | 30 days |
| Team | 90 days |
| Business | 180 days |
| Small Workspace | 365 days |
| Large Workspace | 365 days |
| Enterprise | 365 days, extendable by agreement |
Two things are worth knowing about how this behaves.
Sign-ins and credential changes are kept for 365 days on every plan, including Free. These belong to a person rather than to a Project, so there is no plan to derive a window from, and they are the entries that matter most if an account is compromised. They are held at the longest window unconditionally.
A longer window applies going forward, not retroactively. An entry's expiry is written at the moment the entry is recorded, and nothing can rewrite it afterwards. Upgrading extends retention for what happens next; it does not restore entries that have already expired.
Immutability
Records are append-only. Cosmic exposes no way to edit or delete an entry, and no such tool exists internally either: the database layer rejects updates and deletes on this collection outright. Entries leave only by reaching the end of the retention window.
This is the property that makes the log worth reading. A record that an administrator could quietly amend would answer the question it was consulted for and answer it wrongly.
Related
- Roles and permissions, for who can read the log
- Security overview, for the wider security posture
- Revision history, for tracking content changes rather than security events