We automatically capture an audit log any time a user changes any piece of data in your Tines tenant.
These audit logs are available to tenant admins via our API, and are typically drained to a log analysis or SIEM tool for further investigation.
Logged operations
For every operation available in the user interface and API, our system automatically and consistently captures a log.
| Operation | Description |
|---|---|
| ActionDescriptionChange | An Action's description was changed |
| ActionEgressControlRuleChange | An action egress control rule was changed |
| ActionEgressControlRuleCreation | An action egress control rule was created |
| ActionEgressControlRuleDeletion | An action egress control rule was deleted |
| ActionInputAddition | An Action input was added |
| ActionInputIsCollapsedChange | An Action input was collapsed |
| ActionInputOptionsUpdate | An Action input's options were updated |
| ActionInputRemoval | An Action input was removed |
| ActionInputReorder | An Action input was reordered |
| ActionInputUpdate | An Action input was updated |
| ActionInputValueUpdate | An Action input value was updated |
| ActionIntegrationCreation | An Action integration was created |
| ActionIntegrationRemoval | An Action integration was removed |
| ActionLogsClearance | An Action's logs were cleared |
| ActionMemoryClearance | An Action's memory was cleared |
| ActionMemoryRelease | An Action's memory was released |
| ActionMetricsChange | An Action's time-saved/reporting setting was changed |
| ActionPublicTemplateDisconnect | An Action was disconnected from a public template |
| ActionRecordTypeChange | An Action's record type was changed |
| ActionRerun | An Action was rerun |
| ActionRun | An Action was run |
| ActionSizeChange | An actions size was changed |
| ActionTeamCaseTemplateUpdate | An Action's team case template was updated |
| ActionTest | An Action was tested |
| ActionsDisabledChange | Multiple Actions had their 'disabled' property changed |
| ActionsEventsDeletion | Multiple Actions' events were cleared |
| ActionsLogsClearance | Multiple Actions' logs were cleared |
| ActionsMonitoringChange | Multiple Actions' monitoring settings were changed |
| ActionsNameChange | Multiple Actions' names were changed |
| ActionsOptionsChange | Multiple Actions' options were changed |
| ActionsScheduleChange | Multiple Actions' schedules were changed |
| AiActionConversationCancellation | An AI action conversation was cancelled |
| AiActionConversationDeletion | An AI action conversation was deleted |
| AiCustomModelsChange | AI custom models were changed |
| AiProviderModelChange | AI provider model was changed |
| AnalyticsCapture | An analytics event was captured |
| AnnotationContentChange | An annotation was edited |
| AnnotationSizeChange | An annotation was resized |
| ApplyPageTemplate | A page template was applied |
| ArchivedStoryDeleteAll | A team's story trash was emptied |
| ArchivedStoryDeletion | An individual story was removed from a team's story trash |
| AuthenticationTokenCreation | A new API key was created |
| AuthenticationTokenDeletion | An API key was deleted |
| AuthenticationTokenEdit | An API key was edited |
| BatchStoryArchive | A set of stories were moved to trash |
| BoardColumnReorder | A board column was reordered |
| BoardColumnVisibility | A board column's visibility was changed |
| CredentialBulkDestruction | Multiple credentials were deleted |
| CredentialDestruction | A credential was deleted |
| CredentialIconChange | A credential's icon was changed |
| CredentialMetadataReplacement | A credential's metadata was replaced |
| CredentialMetadataToResourceReplacement | A credential's metadata was replaced with a resource |
| CredentialMovement | A credential was moved to a new team/folder |
| CredentialOauthTokenRefresh | An OAuth credential's token was refreshed |
| CredentialReplacement | A credential was replaced on a story |
| CredentialSave | A credential was created or updated |
| CredentialTest | A credential was tested |
| CustomCertificateAuthorityCreation | A custom certificate authority was created |
| CustomCertificateAuthorityDeletion | A custom certificate authority was deleted |
| CustomCertificateAuthoritySet | A custom certificate authority was set |
| CustomTeamRoleCreation | A custom team role was created |
| CustomTeamRoleDestruction | A custom team role was destroyed |
| CustomTeamRoleUpdate | A custom team role was updated |
| DashboardChartCreation | A dashboard chart was created |
| DashboardCreation | A dashboard was created |
| DashboardDeletion | A dashboard was deleted |
| DashboardDuplicate | A dashboard was duplicated |
| DashboardElementCreation | A dashboard element was created |
| DashboardElementDeletion | A dashboard element was deleted |
| DashboardListCreation | A dashboard list was created |
| DashboardListUpdate | A dashboard list was updated |
| DashboardNoteCreation | A dashboard note was created |
| DashboardNoteUpdate | A dashboard note was updated |
| DashboardSubscriptionCreate | A dashboard subscription was created |
| DashboardSubscriptionUpdate | A dashboard subscription was updated |
| DashboardUpdate | A dashboard was updated |
| DraftCredentialCreation | A draft credential was created |
| DraftStoryCreation | A draft story was created |
| DraftStoryDeletion | A draft story was deleted |
| DraftStoryRebase | A draft story was rebased |
| DraftStoryReset | A draft story was reset |
| EventDeletion | An event was deleted |
| EventLimitSettingCreation | An event limit setting was created |
| EventLimitSettingDeletion | An event limit setting was deleted |
| EventLimitSettingUpdate | An event limit setting was updated |
| EventLimitUserSubscriberCreation | An event limit user subscriber was created |
| EventLimitUserSubscriberDeletion | An event limit user subscriber was deleted |
| EventLimitWebhookSubscriberCreation | An event limit webhook subscriber was created |
| EventLimitWebhookSubscriberDeletion | An event limit webhook subscriber was deleted |
| EventReEmission | An event was re-emitted |
| ExampleStoryImport | A story was imported from the story library |
| FolderCreation | A folder was created |
| FolderDestruction | A folder was destroyed |
| FolderUpdate | A folder was updated |
| FormFieldAddition | A form field was added |
| FormFieldDuplication | A form field was duplicated |
| FormFieldRemoval | A form field was removed |
| FormFieldReorder | A form field's position was reordered |
| FormFieldUpdate | A form field was updated |
| FormUpdate | A form was updated |
| GlobalResourceCreation | A global resource was created |
| GlobalResourceDestruction | A global resource was deleted |
| GlobalResourceEdit | A global resource was edited |
| GlobalResourceMovement | A global resource was moved to a new team/folder |
| GroupExtraction | A group was extracted from a set of actions |
| GroupFlatten | A group was flattened to a set of actions |
| IntegrationSelection | An integration was selected |
| IntegrationSelectionUndo | An integration selection was undone |
| IPAccessControlRuleChange | An IP access control rule was changed |
| IPAccessControlRuleCreation | An IP access control rule was created |
| IPAccessControlRuleDeletion | An IP access control rule was deleted |
| JobsQueuedDeletion | Currently enqueued jobs were cleared (for a self-hosted tenant) |
| JobsRetryingDeletion | Currently retrying jobs were cleared (for a self-hosted tenant) |
| LastEventReEmission | The most recent event was re-emitted |
| LicenseApplication | A license was applied |
| LicenseValidation | A license was validated |
| LinkChange | A link between actions was edited |
| Login | A user logged in |
| LoginNoticeChange | Login notice was changed |
| MergePageElementContainers | Page element containers were merged |
| MoveFormFieldToExistingContainer | A form field was moved to an existing container |
| MoveFormFieldToNewContainer | A form field was moved to a new container |
| NotificationBulkDeletion | Multiple notifications were deleted |
| NotificationBulkRead | Multiple notifications were marked as read |
| NotificationDeletion | A notification was deleted |
| NotificationIsReadChange | A notification's read status was changed |
| NotificationSettingSave | A notification setting was saved |
| OnboardingFormSubmission | Onboarding form was submitted |
| PageCollectionCreation | A page collection was created |
| PageCollectionDestruction | A page collection was destroyed |
| PageCollectionPageMove | A page collection page was moved |
| PageCollectionPageRemove | A page was removed from a page collection |
| PageCollectionPagesAdd | Pages were added to a page collection |
| PageCollectionReorder | A page collection was reordered |
| PageCollectionUpdate | A page collection was updated |
| PageDisplayLogoSet | A page display logo was set |
| PageElementButtonGroupToggle | A page element button group was toggled |
| PageElementClearance | Page elements were cleared |
| PageElementConditionRuleCreation | A page element condition rule was created |
| PageElementConditionRuleDestruction | A page element condition rule was destroyed |
| PageElementConditionRuleUpdate | A page element condition rule was updated |
| PageElementConditionUpdate | A page element condition was updated |
| PageElementContainerAddition | A page element container was added |
| PageElementContainerDuplication | A page element container was duplicated |
| PageElementContainerRemoval | A page element container was removed |
| PageElementContainerReplaceElements | Page element container elements were replaced |
| PageElementContainerUpdate | A page element container was updated |
| PageEmojiSet | A page emoji was set |
| PageLogoCreation | A page logo was created |
| PageLogoSet | A page logo was set |
| PageSsoGroupsUpdate | Page SSO groups were updated |
| PageThemeApplication | A page theme was applied |
| PageThemeCreation | A page theme was created |
| PageThemeDestruction | A page theme was destroyed |
| PreviewPageTemplate | A page template was previewed |
| RecordBulkDeletion | Multiple records were deleted |
| RecordElementExportRequest | A record element export was requested |
| RecordReportClone | A record report was cloned |
| RecordReportCreation | A Record report was created |
| RecordReportDeletion | A Record report was deleted |
| RecordReportElementColumnReorder | A Record report element column was reordered |
| RecordReportElementCreation | A Record report element was created |
| RecordReportElementDestruction | A Record report element was deleted |
| RecordReportElementUpdate | A Record report element was edited |
| RecordReportFiltersUpdate | A record report's filters were updated |
| RecordReportUpdate | A Record report was edited |
| RecordResultSetCreate | A record result set was created |
| RecordResultSetDestruction | A record result set was destroyed |
| RecordResultSetUpdate | A Record result set was updated |
| RecordTypeCreation | A Record type was created |
| RecordTypeDestruction | A Record type was deleted |
| RecordTypeUpdate | A Record type was updated |
| RecordWriterCreation | A Record writer was created |
| RecordWriterDestruction | A Record writer was deleted |
| RecordWriterUpdate | A Record writer was edited |
| ResourceIconChange | A resource's icon was changed |
| ResourceLockedUpdate | A resource's locked status was updated |
| ResourceReplacement | A global resource was replaced on a story |
| ResourceToCredentialMetadataReplacement | A resource was replaced with credential metadata |
| RunActionWithReceivedEvent | An action was run with a received event |
| SavedStoryRunModification | A saved story run was modified |
| SCIM/2.0/User/{operation} | A SCIM 2.0 operation (create, replace, update or destroy) on a User |
| SenderEmailAddressCreation | A sender email address was created |
| SenderEmailAddressDeletion | A sender email address was deleted |
| SharedObjectLinkCreation | A shared object link was created |
| SharedObjectLinkUpdate | A shared object link was updated |
| SharedObjectLinkViewSave | A shared object link view was saved |
| SmtpConfigurationTest | An SMTP configuration was tested |
| SsoConfigurationDefaultSet | The default SSO configuration was set to Tines-powered |
| SsoConfigurationJitConfigurationSet | The SSO JIT configuration was set |
| SsoConfigurationOidcSet | The default SSO configuration was set to OIDC |
| SsoConfigurationPageGroupAttributeNameUpdate | The SSO page group attribute name was updated |
| SsoConfigurationSamlSet | The default SSO configuration was set to SAML |
| StoryActionsAutoAlign | A set of actions were auto aligned |
| StoryActionsAutoLayout | A set of actions were auto laid-out |
| StoryActionsPositioning | A set of actions and annotations were repositioned |
| StoryAPIChange | Enable webhook API responses on a story |
| StoryArchive | A story was moved to trash |
| StoryChangeRequestApproval | A story change request was approved |
| StoryChangeRequestCancellation | A story change request was cancelled |
| StoryChangeRequestCreation | A story change request was created |
| StoryChangeRequestPromotion | A story change request was promoted |
| StoryContainerFavoritedChange | A story container's favorited status was changed |
| StoryContainerOwnerDelete | A story container owner was deleted |
| StoryContainerOwnerUpdate | A story container owner was updated |
| StoryContainerSubscriberCreation | A story container subscriber was created |
| StoryContainerSubscriberDeletion | A story container subscriber was deleted |
| StoryCreation | A story was created |
| StoryDataDeletion | A story's data was deleted |
| StoryDescriptionChange | A story's description was changed |
| StoryDisabledChange | A story was disabled or enabled |
| StoryEventsDeletion | All of a story's events were deleted |
| StoryIconChange | A story's icon was changed |
| StoryImport | A story was imported |
| StoryIntegrationFieldsUpdate | A story's integration fields were updated |
| StoryItemsCreation | A set of actions/annotations were created |
| StoryItemsDestruction | A set of actions/annotations were destroyed |
| StoryItemsMovement | A set of actions/annotations were moved |
| StoryJobsClearance | A story's scheduled jobs were cleared |
| StoryKeepEventsForChange | A story's event retention settings were changed |
| StoryLegacyUnpublish | A legacy story was unpublished |
| StoryLibraryMetadataChange | A story library's metadata was changed |
| StoryLLMProductInstructionsChange | A story's LLM product instructions were changed |
| StoryLockedChange | A story was locked or unlocked |
| StoryMetricsChange | A story's metrics were changed |
| StoryMonitoringChange | A story's monitoring settings were changed |
| StoryMovement | A story was moved |
| StoryNameChange | A story's name was changed |
| StoryOnboardingFinish | Story onboarding was finished |
| StoryOnboardingStart | Story onboarding was started |
| StoryOnboardingUnpause | Story onboarding was unpaused |
| StoryPriorityChange | A story's priority was changed |
| StoryRecipientAddition | A monitoring recipient was added for a story |
| StoryRecipientRemoval | A monitoring recipient was removed for a story |
| StoryRecipientUpdate | A monitoring recipient was changed for a story |
| StoryReportingStatusChange | Reporting was enabled/disabled for a story |
| StoryRequireStoryOwnerApprovalUpdate | Story owner approval requirement was updated |
| StoryRestore | A story was restored from the trash |
| StoryRunMockPayloadMappingCreation | A story run mock payload mapping was created |
| StoryRunMockPayloadMappingDeletion | A story run mock payload mapping was deleted |
| StoryRunSaveSettingModification | A story run save setting was modified |
| StorySendToStoryChange | A story's send-to-story settings were edited |
| StoryTagsUpdate | A story's tags were updated |
| StoryVersionCreate | A story version was created |
| StoryVersionDeletion | A story version was deleted |
| StoryVersionImport | A story version was imported |
| StoryVersionNameChange | A story's version was renamed |
| StoryViewSave | A story view was saved |
| SyncDestinationDeletion | A sync destination was deleted |
| SyncDestinationManualSync | A sync destination was manually synced |
| SyncDestinationSave | A sync destination was saved |
| SyncedStoryDetach | A synced story was detached |
| TagChange | A tag was changed |
| TagCreation | A tag was created |
| TagDeletion | A tag was deleted |
| TeamAllocationChange | A team's allocation was changed |
| TeamCaseAddCommentReaction | A reaction was added to a case comment |
| TeamCaseBlockCreation | A team case block was created |
| TeamCaseBlockDeletion | A team case block was deleted |
| TeamCaseBlockElementUpdate | A team case block element was updated |
| TeamCaseBlockUpdate | A team case block was updated |
| TeamCaseBoardMovement | A team case board movement occurred |
| TeamCaseBulkCommentCreation | Comments were bulk created on team cases |
| TeamCaseBulkDeletion | Team cases were bulk deleted |
| TeamCaseBulkLinkCase | Team cases were bulk linked |
| TeamCaseBulkUpdate | Team cases were bulk updated |
| TeamCaseButtonCreation | An action (button) was added to a case |
| TeamCaseButtonDeletion | A team case button was deleted |
| TeamCaseButtonsBulkUpdate | Team case buttons were bulk updated |
| TeamCaseButtonUpdate | A team case button was updated |
| TeamCaseButtonWebhookTrigger | A team case button webhook was triggered |
| TeamCaseCommentCreation | A comment was added to a case |
| TeamCaseCommentDeletion | A team case comment was deleted |
| TeamCaseCommentUpdate | A comment was updated on a case |
| TeamCaseCreation | A case was created |
| TeamCaseDeletion | A team case was deleted |
| TeamCaseDescriptionUpdate | A team case's description was updated |
| TeamCaseFileAttach | A file or comment and file was attached to a case |
| TeamCaseFileBlockCreation | A team case file block was created |
| TeamCaseFileBlockDeletion | A team case file block was deleted |
| TeamCaseFileBlockElementCreation | A team case file block element was created |
| TeamCaseFileDeletion | A team case file was deleted |
| TeamCaseInputCreation | A team case input was created |
| TeamCaseInputDeletion | A team case input was deleted |
| TeamCaseInputUpdate | A team case input was updated |
| TeamCaseInputValueDeletion | A team case input value was deleted |
| TeamCaseInputValueUpsert | A team case input value was upserted |
| TeamCaseLinkCase | A team case was linked to another case |
| TeamCaseMetadataCreation | Team case metadata was created |
| TeamCaseMetadataUpdate | A team case's metadata was updated |
| TeamCaseNoteBlockCreation | A team case note block was created |
| TeamCaseNoteDeletion | A team case note was deleted |
| TeamCaseNoteUpdate | A team case note was updated |
| TeamCaseRecordFieldsUpdate | Team case record fields were updated |
| TeamCaseRecordResultSetBulkDestruction | Team case record result sets were bulk destroyed |
| TeamCaseRecordResultSetCreation | A team case record result set was created |
| TeamCaseRecordResultSetDestruction | A team case record result set was destroyed |
| TeamCaseRemoveCommentReaction | A reaction was removed from a comment on a case |
| TeamCasesExportCreation | A team cases export was created |
| TeamCaseSlaCreation | A team case SLA was created |
| TeamCaseSlaDeletion | A team case SLA was deleted |
| TeamCaseSlaUpdate | A team case SLA was updated |
| TeamCasesSavedViewCreation | A saved view was created for a teams cases |
| TeamCasesSavedViewDestruction | A saved view was deleted from a teams cases |
| TeamCasesSavedViewUpdate | A team cases saved view was updated |
| TeamCaseStatusCreation | A team case status was created |
| TeamCaseStatusDeletion | A team case status was deleted |
| TeamCaseStatusUpdate | A team case status was updated |
| TeamCaseSubscriberBulkCreation | Team case subscribers were bulk created |
| TeamCaseSubscriberCreation | A subscriber was added to a case |
| TeamCaseSubscriberDeletion | A subscriber was removed from a case |
| TeamCaseTagsUpdate | A tag was added to or removed from a case |
| TeamCaseTemplateCreation | A team case template was created |
| TeamCaseTemplateDeletion | A team case template was deleted |
| TeamCaseTemplateUpdate | A team case template was updated |
| TeamCaseUnlinkCase | A team case was unlinked |
| TeamCaseUpdate | A case was assigned, renamed, completed or its description updated |
| TeamCaseWebhookUpdate | A case notification webhook was set or updated for the team |
| TeamCreation | A team was created |
| TeamDestruction | A team was destroyed |
| TeamMemberRemoval | A team member was removed |
| TeamMembersAddition | A team member was added |
| TeamNotificationSettingsUpdate | Team notification settings were updated |
| TeamSettingUpdate | A team setting was updated |
| TeamTunnelMembershipUpdate | A team tunnel membership was updated |
| TeamUpdate | A team was updated |
| TemplateActionTagUpdate | A template action tag was updated |
| TemplateCreation | A template was created |
| TemplateDestruction | A template was deleted |
| TemplateDuplication | A template was duplicated |
| TemplateTestRun | A template test was run |
| TemplateUpdate | A template was updated |
| TenantAiEnabledToggle | Tenant AI was enabled/disabled |
| TenantAiProviderChange | A tenant AI provider was changed |
| TenantAiProviderDeletion | A tenant AI provider was deleted |
| TenantAiProviderRestoreDefault | Tenant AI provider was restored to default |
| TenantAiDefaultProviderSelect | A default tenant AI provider was selected |
| TenantAiProviderTest | Tenant AI provider was tested |
| TenantChangeControlSettingsUpdate | Tenant change control settings were updated |
| TenantConfigChange | A tenant's config was changed |
| TenantFeatureFlagToggle | A feature flag was enabled/disabled |
| TenantLimitsChange | Tenant limits were changed |
| TenantPlanUpgradeRequest | A plan upgrade was requested |
| TenantSessionTimeoutChange | Tenant session timeout was changed |
| TenantSettingsChange | Tenant settings were changed |
| TestStoryCreation | Change control was enabled for a story |
| TestStoryDeletion | Change control was disabled for a story |
| ToolLinkCreation | A tool link was created |
| ToolLinkDeletion | A tool link was deleted |
| ToolLinkGroupCreation | A tool link group was created |
| ToolLinkStsCreation | A tool link STS was created |
| ToolLinkTemplatesCreation | Tool link templates were created |
| TunnelDestruction | A tunnel was destroyed |
| TunnelUpdate | A tunnel was updated |
| UpdatePageFromTemplate | A page was updated from a template |
| UploadImage | An image was uploaded |
| UserCredentialDestruction | A user credential was destroyed |
| UserCredentialHttpRequestRun | A user credential HTTP request was run |
| UserCredentialMovement | A user credential was moved |
| UserCredentialSave | A user credential was saved |
| UserDeletion | A user was deleted |
| UserEdit | A user was edited |
| UserFavoriteIntegrationProductChange | A user's favorite integration product was changed |
| UserFavoriteTemplateChange | A user's favorite template was changed |
| UserImpersonationDisabled | User impersonation was disabled |
| UserImpersonationEnabled | User impersonation was enabled |
| UserRecoveryCodesDeletion | User recovery codes were deleted |
| UserRecoveryCodesGeneration | User recovery codes were generated |
| UserReinvitation | A user's invitation was resent |
| UsersInvitation | A user was invited |
| UserSessionExpiryChange | User session expiry was changed |
| UserTeamRoleChange | A user's team role was changed |
| WorkbenchConfigurationCreation | A Workbench preset was created |
| WorkbenchConfigurationDeletion | A Workbench preset was permanently deleted |
| WorkbenchConfigurationDuplication | A Workbench configuration was duplicated |
| WorkbenchConfigurationUpdate | A Workbench preset was updated |
| WorkbenchConfiguredProductUpdate | A user enabled/disabled a product or changed its credential in Workbench |
| WorkbenchConfiguredStoryUpdate | A story was enabled/disabled in Workbench |
| WorkbenchConversationDeletion | A Workbench conversation was permanently deleted |
| WorkbenchConversationFork | A new conversation was created, with context up to a fixed point from the original conversation |
| WorkbenchConversationRename | A Workbench conversation was renamed |
| WorkbenchConversationStart | A new conversation was started in Workbench |
| WorkbenchConversationSubmitForEvaluation | A Workbench conversation was submitted for evaluation |
| WorkbenchConversationToggleFavorite | Favorite was enabled/disabled for a conversation |
| WorkbenchCustomSlackIntegrationCreation | A Workbench integration was created for Slack |
| WorkbenchDraftStoryCreation | A draft story was created from a Workbench conversation |
| WorkbenchEnableProductTemplates | A user enabled/disabled templates for a product in Workbench |
| WorkbenchInstructionChange | Custom instructions for a user were updated |
| WorkbenchIntegrationCreation | A Workbench integration was created |
| WorkbenchPresetCreation | A Workbench preset was created |
| WorkbenchPresetUpdate | A Workbench preset updated |
| WorkbenchToolUseCancel | User canceled the use of a tool |
| WorkbenchToolUseConfirm | User confirmed the use of a tool |
| WorkbenchUserMessageSend | User sent a message to Workbench |
| WorkbenchUserMessageStop | User stopped a reply from Workbench |
Log format
Each log contains enriched user information, as well as metadata related to the operation carried out. Extremely sensitive information, for example credential values, are never included.
{
"created_at": "2022-10-04T19:03:18Z",
"id": 123456,
"inputs": {
"inputs": {
"teamId": 1772
}
},
"request_ip": "11.22.33.44",
"request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36",
"tenant_id": 9,
"updated_at": "2022-10-04T19:03:18Z",
"user_email": "user@example.com",
"user_id": 9,
"user_name": "Example User",
"operation_name": "StoryCreation"
}