opsen records every event on a workspace: who did it, when (UTC), from which IP address and browser, and the detail. It is kept for the life of the workspace and cannot be edited. The audit log is included on every plan.
What is recorded
| Group | Events |
|---|---|
| Sign-ins | Single sign-on sign-ins and refusals, with the reason |
| Access | Opening the workspace (once an hour per person), access granted, role changed, access removed |
| Changes | Every action opsen applied (reclaimed seats, cancelled invitations, fix pull requests, removed platform seats) with its approver, outcome and monthly value |
| Settings | Prices, budgets, platforms connected and disconnected, single sign-on configured, tested, required, removed, domains verified |
| Exports and links | Finding and access-list exports, audit-log exports, read-only links created, revoked and opened |
| Support | Support requests and their priority |
Read it
Settings → Audit log, or /o/YOUR-ORG/audit. Filter by group, search, and export CSV. A value that begins with =, +, - or @ is written with a leading apostrophe, so Excel and Google Sheets show it instead of running it as a formula; the same applies to every CSV export.
Stream it to your SIEM
Terminal
curl -s -b "opsen_session=…" "https://opsen.dev/o/YOUR-ORG/audit.json?since=1761177600"
JSON
{"workspace": "acme", "events": [
{"id": "evt_…", "at": 1761180000.1, "event": "change.reclaim_copilot", "actor": "[email protected]",
"detail": {"payload": {"logins": ["…"]}, "ok": true, "saved_monthly": 418.0}, "ip": "203.0.113.4", "user_agent": "…"}
]}
Pass since as Unix seconds and poll; events come newest first, up to 5,000 per call. event=change limits to one group.