Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Skip to main content
🐰 New: Triage — a self-updating cross-repository queue that prioritizes pull requests by value and risk, so you always know what to review next. Now in beta! Explore Triage →
Audit Logs
Track and review administrative actions across your organization with a tamper-resistant audit log.
The Audit Logs give Enterprise organizations a searchable record of administrative actions taken across workspace settings, billing controls, seat management, and more. Use them to answer “who changed what, and when?” whether you’re investigating an incident, satisfying a compliance review, or just keeping an eye on operational changes.
CodeRabbit attributes each Knowledge base row to the initiating Slack user. The row summarizes counts of changed knowledge files, skill files, and supporting files instead of listing the changed content or paths.
Accessing Audit Logs
Settings UI
Open the CodeRabbit dashboard and navigate to Settings → Audit Logs. The page is visible to users with an admin role on the Enterprise plan. The log table shows four columns:| Column | Description |
|---|---|
| User | The actor who performed the action, with their role (Admin, Member, Billing Admin, Slack user, Bot, or System) |
| Action | What happened, e.g. “Added repository” or “Created API key” |
| Resource Summary | A short description of the specific resource affected |
| Recency / Time | Relative and absolute timestamp of when the action occurred |
Searching and filtering
Use the search bar to find entries by actor name. Narrow results further using the filter controls:- Action — select one or more event types
- Resource type — select one or more resource categories
- Date range — set an inclusive start and end date/time
REST API
The same data is available programmatically. This is useful for exporting entries to a SIEM, building custom compliance reports, or integrating audit data into internal tooling. See the Audit Logs API reference for the complete parameter list, response schema, and code samples.What is logged
The Audit Logs capture high-signal administrative changes across your workspace:| Resource | Events tracked |
|---|---|
| Organization | Creation and deletion, including organization creation during Enterprise SSO workspace onboarding and attach flows |
| Repositories | Adding and removing repositories, including provider sync and Slack install paths |
| Subscription | Subscription creation, updates, and cancellation |
| Seat management | Organization and workspace seat assignments and removals |
| Configuration | Organization-wide, repository-level, and workspace-level config changes |
| User roles | Workspace role changes and organization-scoped role changes |
| API keys | API key creation and deletion |
| Knowledge base | Committed and pushed CodeRabbit Agent updates to shared knowledge-base facts and reusable skills. Only updates that were successfully committed and pushed are eligible for logging |
Coverage expands as more admin flows are instrumented. Events are logged when the action is instrumented, so historical coverage before a given release date may be incomplete.
Knowledge base audit rows exclude changed file paths and file contents. Publication is best effort and asynchronous: a failure to record an audit row does not delay, fail, or reverse the completed knowledge-base or skill update.CodeRabbit skips publication when it lacks trusted organization, workspace, Slack integration, or initiating Slack-actor attribution. Unattributed activity does not enter the audit log.
Common use cases
Security review — Search for a specific user to see all actions they have taken. Filter byapi_key_create or api_key_delete to audit API key lifecycle. Use the date range filter to focus on a specific incident window.
Access management audit — Filter on seat assignment and role change events to review who was granted or removed access, and by which admin.
Configuration change investigation — Filter on configuration events to identify when a setting was changed and who changed it.
Compliance reporting — Export entries for a date range via the API to demonstrate administrative controls and a clear chain of custody.
What’s next
Audit Logs API reference
Full parameter reference, response schema, and interactive playground for the
audit-logs endpointRole-based access
Learn about Admin, Member, and Billing Admin roles and what each can access in your organization
Was this page helpful?