> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/administration/admin-console/audit-logs.md).
# Audit Logs
The Audit Logs page records every action taken via the dashboard, provided it’s classified as an action. This visibility ensures accountability and is especially valuable for compliance and regulatory requirements
Audit Logs dashboard
## Audit Log Events
The tables below list every event that can appear in your audit log, grouped by product area. Each event has an action name, a description of what happened, and a type: **Write** events change configuration or data, while **Read** events record sensitive read or trigger operations (such as exports and connection tests).
### Users, Roles, and Authentication
| Action Name | Description | Type |
| -------------------------------- | ------------------------------ | ----- |
| `customer.authentication.update` | Updated authentication options | Write |
| `customer.role.create` | Created custom role | Write |
| `customer.role.delete` | Deleted custom role | Write |
| `customer.role.update` | Updated custom role | Write |
| `customer.users.add` | Added new user | Write |
| `customer.users.delete` | Deleted user | Write |
| `customer.users.update` | Updated user | Write |
### API Keys, Tokens, and OIDC
| Action Name | Description | Type |
| --------------------------------------- | ------------------------------------------------------ | ----- |
| `customer.api-key.rotate` | Rotated customer API key | Write |
| `customer.fine-grained-api-keys.mint` | Minted tenant fine-grained API key | Write |
| `customer.fine-grained-api-keys.revoke` | Revoked tenant fine-grained API key | Write |
| `customer.oidc-trust-policies.create` | Created OIDC trust policy | Write |
| `customer.oidc-trust-policies.delete` | Deleted OIDC trust policy | Write |
| `customer.oidc.token-exchanged` | Exchanged GitHub OIDC token for StepSecurity API token | Write |
| `customer.tokens.mint` | Minted short-lived token | Write |
| `customer.tokens.revoke` | Revoked short-lived token | Write |
| `github.fine-grained-api-keys.mint` | Minted org fine-grained API key | Write |
| `github.fine-grained-api-keys.revoke` | Revoked org fine-grained API key | Write |
| `github.oidc-trust-policies.create` | Created org OIDC trust policy | Write |
| `github.oidc-trust-policies.delete` | Deleted org OIDC trust policy | Write |
### Detection Rules, Suppression, and Notifications
| Action Name | Description | Type |
| ----------------------------------------- | ------------------------------------------- | ----- |
| `customer.custom_detection_rule.create` | Created custom detection rule | Write |
| `customer.custom_detection_rule.update` | Updated custom detection rule | Write |
| `customer.default_slack_channel.set` | Set default Slack channel for customer | Write |
| `customer.default_slack_channel.test` | Tested customer default Slack channel | Read |
| `customer.detection_rule.create` | Created detection rule | Write |
| `customer.detection_rule.delete` | Deleted detection rule | Write |
| `customer.detection_rule.update` | Updated detection rule | Write |
| `customer.notification_settings.update` | Updated customer notification settings | Write |
| `customer.slack_oauth.disconnect` | Disconnected Slack OAuth | Write |
| `detection-suppression-resolution.update` | Updated detection suppression or resolution | Write |
| `org.notification_settings.test` | Tested notification connection | Read |
| `org.notification_settings.update` | Updated notification settings | Write |
### Harden-Runner Policies and Settings
| Action Name | Description | Type |
| ---------------------------------------- | ---------------------------------------- | ----- |
| `customer.harden_runner_settings.delete` | Reset harden runner settings to defaults | Write |
| `customer.harden_runner_settings.update` | Updated harden runner settings | Write |
| `customer.run_policy.create` | Created workflow run policy | Write |
| `customer.run_policy.delete` | Deleted workflow run policy | Write |
| `customer.run_policy.update` | Updated workflow run policy | Write |
| `jobs.baseline.delete` | Deleted Job baseline | Write |
| `org.attach_harden_runner_policy.add` | Attached/Updated harden runner policy | Write |
| `org.attach_harden_runner_policy.delete` | Deleted harden runner policy attachment | Write |
| `org.harden_runner_policy.add` | Added/Updated harden runner policy | Write |
| `org.harden_runner_policy.delete` | Deleted harden runner policy | Write |
| `org.tls_inspection_settings.update` | Updated tls inspection settings | Write |
| `repo.harden-runner-checks.update` | Updated harden-runner baseline check | Write |
### Secure Registry
| Action Name | Description | Type |
| ------------------------------------------ | ------------------------------------------ | ----- |
| `customer.secure_registry_controls.reset` | Reset secure registry controls to defaults | Write |
| `customer.secure_registry_controls.update` | Updated secure registry controls | Write |
### Dev Machine Guard
| Action Name | Description | Type |
| ------------------------------------------------------ | -------------------------------------------- | ----- |
| `customer.developer_mdm.agent_update_policy.update` | Updated developer MDM agent update policy | Write |
| `customer.developer_mdm.device.delete` | Deleted developer MDM device | Write |
| `customer.developer_mdm.feature_configurations.update` | Updated developer MDM feature configurations | Write |
| `customer.developer_mdm.hook_policy.update` | Updated developer MDM hook policy | Write |
| `customer.developer_mdm.policy.create` | Created developer MDM policy | Write |
| `customer.developer_mdm.policy.delete` | Deleted developer MDM policy | Write |
| `customer.developer_mdm.policy.update` | Updated developer MDM policy | Write |
| `customer.developer_mdm.profile.create` | Created developer MDM profile | Write |
| `customer.developer_mdm.profile.delete` | Deleted developer MDM profile | Write |
| `customer.developer_mdm.profile.export` | Exported developer MDM profile | Read |
| `customer.developer_mdm.profile.update` | Updated developer MDM profile | Write |
| `customer.developer_mdm.telemetry_key.rotate` | Rotated developer MDM telemetry key | Write |
| `customer.host.trigger-update` | Triggered agent update for host | Write |
### Controls and Feature Configurations
| Action Name | Description | Type |
| -------------------------------------- | ------------------------------------------ | ----- |
| `org-and-repo.control-settings.update` | Updated control settings for org and repo | Write |
| `org-or-repo.control-settings.reset` | Reset feature configs for an owner or repo | Write |
| `org-or-repo.control-settings.update` | Updated feature configs for org or repo | Write |
| `org.control-settings.update` | Updated control settings for org | Write |
| `org.controls.inprogress.update` | Update control check in-progress status | Write |
| `org.controls.update` | Suppressed/Unsuppressed control | Write |
| `org.exempted-controls.update` | Updated exempted controls for org | Write |
| `repo.controls.refresh` | Triggered controls refresh | Read |
| `repo.feature-configurations.update` | Updated feature configurations for repo | Write |
### GitHub Organization and Repository
| Action Name | Description | Type |
| -------------------------------------------- | ----------------------------------------- | ----- |
| `customer.github-job-markdown-config.update` | Updated GitHub job markdown configuration | Write |
| `github.checks-config.update` | Updated checks config | Write |
| `github.checks.update` | Updated checks | Write |
| `org.actions.activate-subscription` | Activated subscription | Write |
| `org.apps-pats.refresh` | Triggered Apps & PATs refresh | Read |
| `org.artifact.add` | Added artifact | Write |
| `org.artifact.delete` | Deleted artifact | Write |
| `org.maintained_action.request` | Requested maintained action for action | Write |
| `org.pr-template.update` | Updated PR template for org | Write |
| `org.suppress-imposter-commit.suppress` | Suppressed imposter commit | Write |
### Integrations (S3 and Webhook)
| Action Name | Description | Type |
| ------------------------------------- | --------------------------- | ----- |
| `customer.s3-integration.test` | Tested s3 integration | Write |
| `customer.s3-integration.update` | Updated s3 integration | Write |
| `customer.s3-integration.verify` | Verified s3 integration | Write |
| `customer.webhook-integration.update` | Updated webhook integration | Write |
### Servers (GitHub Enterprise Server and GitLab)
| Action Name | Description | Type |
| -------------------------------------------------- | ----------------------------- | ----- |
| `customer.github_server.advanced_app.installation` | Install advanced app in GHES | Write |
| `customer.github_server.advanced_app.setup` | Setup advanced app in GHES | Write |
| `customer.github_server.delete` | Deleted github server | Write |
| `customer.github_server.setup` | Setup github server | Write |
| `customer.github_server.update` | Created/Updated github server | Write |
| `customer.gitlab_server.update` | Created/Updated gitlab server | Write |
### Azure DevOps
| Action Name | Description | Type |
| -------------------------- | --------------------------------- | ----- |
| `ado.jobs.baseline.delete` | Deleted ADO job baseline endpoint | Write |
| `ado.organization.create` | Created ado organization | Write |
| `ado.organization.delete` | Deleted ado organization | Write |
| `ado.server.create` | Created ado server | Write |
| `ado.server.delete` | Deleted ado server | Write |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/administration/admin-console/audit-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.