# Audit log

> Every sign-in, access change, setting and action, with who, when and from where. Export as CSV or stream as JSON.

opsen records every event on a workspace: who did it, when (UTC), from which IP address and browser, and the detail. It is kept for the life of the workspace and cannot be edited. The audit log is included on every plan.

## What is recorded

| Group | Events |
| --- | --- |
| Sign-ins | Single sign-on sign-ins and refusals, with the reason |
| Access | Opening the workspace (once an hour per person), access granted, role changed, access removed |
| Changes | Every action opsen applied (reclaimed seats, cancelled invitations, fix pull requests, removed platform seats) with its approver, outcome and monthly value |
| Settings | Prices, budgets, platforms connected and disconnected, single sign-on configured, tested, required, removed, domains verified |
| Exports and links | Finding and access-list exports, audit-log exports, read-only links created, revoked and opened |
| Support | Support requests and their priority |

## Read it

**Settings → Audit log**, or `/o/YOUR-ORG/audit`. Filter by group, search, and export CSV. A value that begins with `=`, `+`, `-` or `@` is written with a leading apostrophe, so Excel and Google Sheets show it instead of running it as a formula; the same applies to every CSV export.

## Stream it to your SIEM

```bash
curl -s -b "opsen_session=…" "https://opsen.dev/o/YOUR-ORG/audit.json?since=1761177600"
```

```json
{"workspace": "acme", "events": [
  {"id": "evt_…", "at": 1761180000.1, "event": "change.reclaim_copilot", "actor": "priya@acme.com",
   "detail": {"payload": {"logins": ["…"]}, "ok": true, "saved_monthly": 418.0}, "ip": "203.0.113.4", "user_agent": "…"}
]}
```

Pass `since` as Unix seconds and poll; events come newest first, up to 5,000 per call. `event=change` limits to one group.