--- title: Audit logs url: https://www.tines.com/docs/api/audit-logs/ updated: 2025-11-11T16:40:30+00:00 description: We automatically capture an audit log any time a user changes any piece of data in your Tines tenant. --- *[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/llms.txt) › [Tines API](https://www.tines.com/llms.txt)* # Audit logs *[View on tines.com](https://www.tines.com/docs/api/audit-logs/)* We automatically capture an audit log any time a user changes any piece of data in your Tines tenant. These audit logs are available to tenant admins via our API, and are typically drained to a log analysis or SIEM tool for further investigation. ## Logged operations For every operation available in the user interface and API, our system automatically and consistently captures a log. | Operation | Description | | -------------------------------------------- | ----------------------------------------------------------------------------------------------- | | ActionDescriptionChange | An Action's description was changed | | ActionEgressControlRuleChange | An action egress control rule was changed | | ActionEgressControlRuleCreation | An action egress control rule was created | | ActionEgressControlRuleDeletion | An action egress control rule was deleted | | ActionInputAddition | An Action input was added | | ActionInputIsCollapsedChange | An Action input was collapsed | | ActionInputOptionsUpdate | An Action input's options were updated | | ActionInputRemoval | An Action input was removed | | ActionInputReorder | An Action input was reordered | | ActionInputUpdate | An Action input was updated | | ActionInputValueUpdate | An Action input value was updated | | ActionIntegrationCreation | An Action integration was created | | ActionIntegrationRemoval | An Action integration was removed | | ActionLogsClearance | An Action's logs were cleared | | ActionMemoryClearance | An Action's memory was cleared | | ActionMemoryRelease | An Action's memory was released | | ActionMetricsChange | An Action's time-saved/reporting setting was changed | | ActionPublicTemplateDisconnect | An Action was disconnected from a public template | | ActionRecordTypeChange | An Action's record type was changed | | ActionRerun | An Action was rerun | | ActionRun | An Action was run | | ActionSizeChange | An actions size was changed | | ActionTeamCaseTemplateUpdate | An Action's team case template was updated | | ActionTest | An Action was tested | | ActionsDisabledChange | Multiple Actions had their 'disabled' property changed | | ActionsEventsDeletion | Multiple Actions' events were cleared | | ActionsLogsClearance | Multiple Actions' logs were cleared | | ActionsMonitoringChange | Multiple Actions' monitoring settings were changed | | ActionsNameChange | Multiple Actions' names were changed | | ActionsOptionsChange | Multiple Actions' options were changed | | ActionsScheduleChange | Multiple Actions' schedules were changed | | AiActionConversationCancellation | An AI action conversation was cancelled | | AiActionConversationDeletion | An AI action conversation was deleted | | AiCustomModelsChange | AI custom models were changed | | AiProviderModelChange | AI provider model was changed | | AnalyticsCapture | An analytics event was captured | | AnnotationContentChange | An annotation was edited | | AnnotationSizeChange | An annotation was resized | | ApplyPageTemplate | A page template was applied | | ArchivedStoryDeleteAll | A team's story trash was emptied | | ArchivedStoryDeletion | An individual story was removed from a team's story trash | | AuthenticationTokenCreation | A new API key was created | | AuthenticationTokenDeletion | An API key was deleted | | AuthenticationTokenEdit | An API key was edited | | BatchStoryArchive | A set of stories were moved to trash | | BoardColumnReorder | A board column was reordered | | BoardColumnVisibility | A board column's visibility was changed | | CredentialBulkDestruction | Multiple credentials were deleted | | CredentialDestruction | A credential was deleted | | CredentialIconChange | A credential's icon was changed | | CredentialMetadataReplacement | A credential's metadata was replaced | | CredentialMetadataToResourceReplacement | A credential's metadata was replaced with a resource | | CredentialMovement | A credential was moved to a new team/folder | | CredentialOauthTokenRefresh | An OAuth credential's token was refreshed | | CredentialReplacement | A credential was replaced on a story | | CredentialSave | A credential was created or updated | | CredentialTest | A credential was tested | | CustomCertificateAuthorityCreation | A custom certificate authority was created | | CustomCertificateAuthorityDeletion | A custom certificate authority was deleted | | CustomCertificateAuthoritySet | A custom certificate authority was set | | CustomTeamRoleCreation | A custom team role was created | | CustomTeamRoleDestruction | A custom team role was destroyed | | CustomTeamRoleUpdate | A custom team role was updated | | DashboardChartCreation | A dashboard chart was created | | DashboardCreation | A dashboard was created | | DashboardDeletion | A dashboard was deleted | | DashboardDuplicate | A dashboard was duplicated | | DashboardElementCreation | A dashboard element was created | | DashboardElementDeletion | A dashboard element was deleted | | DashboardListCreation | A dashboard list was created | | DashboardListUpdate | A dashboard list was updated | | DashboardNoteCreation | A dashboard note was created | | DashboardNoteUpdate | A dashboard note was updated | | DashboardSubscriptionCreate | A dashboard subscription was created | | DashboardSubscriptionUpdate | A dashboard subscription was updated | | DashboardUpdate | A dashboard was updated | | DraftCredentialCreation | A draft credential was created | | DraftStoryCreation | A draft story was created | | DraftStoryDeletion | A draft story was deleted | | DraftStoryRebase | A draft story was rebased | | DraftStoryReset | A draft story was reset | | EventDeletion | An event was deleted | | EventLimitSettingCreation | An event limit setting was created | | EventLimitSettingDeletion | An event limit setting was deleted | | EventLimitSettingUpdate | An event limit setting was updated | | EventLimitUserSubscriberCreation | An event limit user subscriber was created | | EventLimitUserSubscriberDeletion | An event limit user subscriber was deleted | | EventLimitWebhookSubscriberCreation | An event limit webhook subscriber was created | | EventLimitWebhookSubscriberDeletion | An event limit webhook subscriber was deleted | | EventReEmission | An event was re-emitted | | ExampleStoryImport | A story was imported from the story library | | FolderCreation | A folder was created | | FolderDestruction | A folder was destroyed | | FolderUpdate | A folder was updated | | FormFieldAddition | A form field was added | | FormFieldDuplication | A form field was duplicated | | FormFieldRemoval | A form field was removed | | FormFieldReorder | A form field's position was reordered | | FormFieldUpdate | A form field was updated | | FormUpdate | A form was updated | | GlobalResourceCreation | A global resource was created | | GlobalResourceDestruction | A global resource was deleted | | GlobalResourceEdit | A global resource was edited | | GlobalResourceMovement | A global resource was moved to a new team/folder | | GroupExtraction | A group was extracted from a set of actions | | GroupFlatten | A group was flattened to a set of actions | | IntegrationSelection | An integration was selected | | IntegrationSelectionUndo | An integration selection was undone | | IPAccessControlRuleChange | An IP access control rule was changed | | IPAccessControlRuleCreation | An IP access control rule was created | | IPAccessControlRuleDeletion | An IP access control rule was deleted | | JobsQueuedDeletion | Currently enqueued jobs were cleared (for a self-hosted tenant) | | JobsRetryingDeletion | Currently retrying jobs were cleared (for a self-hosted tenant) | | LastEventReEmission | The most recent event was re-emitted | | LicenseApplication | A license was applied | | LicenseValidation | A license was validated | | LinkChange | A link between actions was edited | | Login | A user logged in | | LoginNoticeChange | Login notice was changed | | MergePageElementContainers | Page element containers were merged | | MoveFormFieldToExistingContainer | A form field was moved to an existing container | | MoveFormFieldToNewContainer | A form field was moved to a new container | | NotificationBulkDeletion | Multiple notifications were deleted | | NotificationBulkRead | Multiple notifications were marked as read | | NotificationDeletion | A notification was deleted | | NotificationIsReadChange | A notification's read status was changed | | NotificationSettingSave | A notification setting was saved | | OnboardingFormSubmission | Onboarding form was submitted | | PageCollectionCreation | A page collection was created | | PageCollectionDestruction | A page collection was destroyed | | PageCollectionPageMove | A page collection page was moved | | PageCollectionPageRemove | A page was removed from a page collection | | PageCollectionPagesAdd | Pages were added to a page collection | | PageCollectionReorder | A page collection was reordered | | PageCollectionUpdate | A page collection was updated | | PageDisplayLogoSet | A page display logo was set | | PageElementButtonGroupToggle | A page element button group was toggled | | PageElementClearance | Page elements were cleared | | PageElementConditionRuleCreation | A page element condition rule was created | | PageElementConditionRuleDestruction | A page element condition rule was destroyed | | PageElementConditionRuleUpdate | A page element condition rule was updated | | PageElementConditionUpdate | A page element condition was updated | | PageElementContainerAddition | A page element container was added | | PageElementContainerDuplication | A page element container was duplicated | | PageElementContainerRemoval | A page element container was removed | | PageElementContainerReplaceElements | Page element container elements were replaced | | PageElementContainerUpdate | A page element container was updated | | PageEmojiSet | A page emoji was set | | PageLogoCreation | A page logo was created | | PageLogoSet | A page logo was set | | PageSsoGroupsUpdate | Page SSO groups were updated | | PageThemeApplication | A page theme was applied | | PageThemeCreation | A page theme was created | | PageThemeDestruction | A page theme was destroyed | | PreviewPageTemplate | A page template was previewed | | RecordBulkDeletion | Multiple records were deleted | | RecordElementExportRequest | A record element export was requested | | RecordReportClone | A record report was cloned | | RecordReportCreation | A Record report was created | | RecordReportDeletion | A Record report was deleted | | RecordReportElementColumnReorder | A Record report element column was reordered | | RecordReportElementCreation | A Record report element was created | | RecordReportElementDestruction | A Record report element was deleted | | RecordReportElementUpdate | A Record report element was edited | | RecordReportFiltersUpdate | A record report's filters were updated | | RecordReportUpdate | A Record report was edited | | RecordResultSetCreate | A record result set was created | | RecordResultSetDestruction | A record result set was destroyed | | RecordResultSetUpdate | A Record result set was updated | | RecordTypeCreation | A Record type was created | | RecordTypeDestruction | A Record type was deleted | | RecordTypeUpdate | A Record type was updated | | RecordWriterCreation | A Record writer was created | | RecordWriterDestruction | A Record writer was deleted | | RecordWriterUpdate | A Record writer was edited | | ResourceIconChange | A resource's icon was changed | | ResourceLockedUpdate | A resource's locked status was updated | | ResourceReplacement | A global resource was replaced on a story | | ResourceToCredentialMetadataReplacement | A resource was replaced with credential metadata | | RunActionWithReceivedEvent | An action was run with a received event | | SavedStoryRunModification | A saved story run was modified | | SCIM/2.0/User/{operation} | A SCIM 2.0 operation (create, replace, update or destroy) on a User | | SenderEmailAddressCreation | A sender email address was created | | SenderEmailAddressDeletion | A sender email address was deleted | | SharedObjectLinkCreation | A shared object link was created | | SharedObjectLinkUpdate | A shared object link was updated | | SharedObjectLinkViewSave | A shared object link view was saved | | SmtpConfigurationTest | An SMTP configuration was tested | | SsoConfigurationDefaultSet | The default SSO configuration was set to Tines-powered | | SsoConfigurationJitConfigurationSet | The SSO JIT configuration was set | | SsoConfigurationOidcSet | The default SSO configuration was set to OIDC | | SsoConfigurationPageGroupAttributeNameUpdate | The SSO page group attribute name was updated | | SsoConfigurationSamlSet | The default SSO configuration was set to SAML | | StoryActionsAutoAlign | A set of actions were auto aligned | | StoryActionsAutoLayout | A set of actions were auto laid-out | | StoryActionsPositioning | A set of actions and annotations were repositioned | | StoryAPIChange | Enable webhook API responses on a story | | StoryArchive | A story was moved to trash | | StoryChangeRequestApproval | A story change request was approved | | StoryChangeRequestCancellation | A story change request was cancelled | | StoryChangeRequestCreation | A story change request was created | | StoryChangeRequestPromotion | A story change request was promoted | | StoryContainerFavoritedChange | A story container's favorited status was changed | | StoryContainerOwnerDelete | A story container owner was deleted | | StoryContainerOwnerUpdate | A story container owner was updated | | StoryContainerSubscriberCreation | A story container subscriber was created | | StoryContainerSubscriberDeletion | A story container subscriber was deleted | | StoryCreation | A story was created | | StoryDataDeletion | A story's data was deleted | | StoryDescriptionChange | A story's description was changed | | StoryDisabledChange | A story was disabled or enabled | | StoryEventsDeletion | All of a story's events were deleted | | StoryIconChange | A story's icon was changed | | StoryImport | A story was imported | | StoryIntegrationFieldsUpdate | A story's integration fields were updated | | StoryItemsCreation | A set of actions/annotations were created | | StoryItemsDestruction | A set of actions/annotations were destroyed | | StoryItemsMovement | A set of actions/annotations were moved | | StoryJobsClearance | A story's scheduled jobs were cleared | | StoryKeepEventsForChange | A story's event retention settings were changed | | StoryLegacyUnpublish | A legacy story was unpublished | | StoryLibraryMetadataChange | A story library's metadata was changed | | StoryLLMProductInstructionsChange | A story's LLM product instructions were changed | | StoryLockedChange | A story was locked or unlocked | | StoryMetricsChange | A story's metrics were changed | | StoryMonitoringChange | A story's monitoring settings were changed | | StoryMovement | A story was moved | | StoryNameChange | A story's name was changed | | StoryOnboardingFinish | Story onboarding was finished | | StoryOnboardingStart | Story onboarding was started | | StoryOnboardingUnpause | Story onboarding was unpaused | | StoryPriorityChange | A story's priority was changed | | StoryRecipientAddition | A monitoring recipient was added for a story | | StoryRecipientRemoval | A monitoring recipient was removed for a story | | StoryRecipientUpdate | A monitoring recipient was changed for a story | | StoryReportingStatusChange | Reporting was enabled/disabled for a story | | StoryRequireStoryOwnerApprovalUpdate | Story owner approval requirement was updated | | StoryRestore | A story was restored from the trash | | StoryRunMockPayloadMappingCreation | A story run mock payload mapping was created | | StoryRunMockPayloadMappingDeletion | A story run mock payload mapping was deleted | | StoryRunSaveSettingModification | A story run save setting was modified | | StorySendToStoryChange | A story's send-to-story settings were edited | | StoryTagsUpdate | A story's tags were updated | | StoryVersionCreate | A story version was created | | StoryVersionDeletion | A story version was deleted | | StoryVersionImport | A story version was imported | | StoryVersionNameChange | A story's version was renamed | | StoryViewSave | A story view was saved | | SyncDestinationDeletion | A sync destination was deleted | | SyncDestinationManualSync | A sync destination was manually synced | | SyncDestinationSave | A sync destination was saved | | SyncedStoryDetach | A synced story was detached | | TagChange | A tag was changed | | TagCreation | A tag was created | | TagDeletion | A tag was deleted | | TeamAllocationChange | A team's allocation was changed | | TeamCaseAddCommentReaction | A reaction was added to a case comment | | TeamCaseBlockCreation | A team case block was created | | TeamCaseBlockDeletion | A team case block was deleted | | TeamCaseBlockElementUpdate | A team case block element was updated | | TeamCaseBlockUpdate | A team case block was updated | | TeamCaseBoardMovement | A team case board movement occurred | | TeamCaseBulkCommentCreation | Comments were bulk created on team cases | | TeamCaseBulkDeletion | Team cases were bulk deleted | | TeamCaseBulkLinkCase | Team cases were bulk linked | | TeamCaseBulkUpdate | Team cases were bulk updated | | TeamCaseButtonCreation | An action (button) was added to a case | | TeamCaseButtonDeletion | A team case button was deleted | | TeamCaseButtonsBulkUpdate | Team case buttons were bulk updated | | TeamCaseButtonUpdate | A team case button was updated | | TeamCaseButtonWebhookTrigger | A team case button webhook was triggered | | TeamCaseCommentCreation | A comment was added to a case | | TeamCaseCommentDeletion | A team case comment was deleted | | TeamCaseCommentUpdate | A comment was updated on a case | | TeamCaseCreation | A case was created | | TeamCaseDeletion | A team case was deleted | | TeamCaseDescriptionUpdate | A team case's description was updated | | TeamCaseFileAttach | A file or comment and file was attached to a case | | TeamCaseFileBlockCreation | A team case file block was created | | TeamCaseFileBlockDeletion | A team case file block was deleted | | TeamCaseFileBlockElementCreation | A team case file block element was created | | TeamCaseFileDeletion | A team case file was deleted | | TeamCaseInputCreation | A team case input was created | | TeamCaseInputDeletion | A team case input was deleted | | TeamCaseInputUpdate | A team case input was updated | | TeamCaseInputValueDeletion | A team case input value was deleted | | TeamCaseInputValueUpsert | A team case input value was upserted | | TeamCaseLinkCase | A team case was linked to another case | | TeamCaseMetadataCreation | Team case metadata was created | | TeamCaseMetadataUpdate | A team case's metadata was updated | | TeamCaseNoteBlockCreation | A team case note block was created | | TeamCaseNoteDeletion | A team case note was deleted | | TeamCaseNoteUpdate | A team case note was updated | | TeamCaseRecordFieldsUpdate | Team case record fields were updated | | TeamCaseRecordResultSetBulkDestruction | Team case record result sets were bulk destroyed | | TeamCaseRecordResultSetCreation | A team case record result set was created | | TeamCaseRecordResultSetDestruction | A team case record result set was destroyed | | TeamCaseRemoveCommentReaction | A reaction was removed from a comment on a case | | TeamCasesExportCreation | A team cases export was created | | TeamCaseSlaCreation | A team case SLA was created | | TeamCaseSlaDeletion | A team case SLA was deleted | | TeamCaseSlaUpdate | A team case SLA was updated | | TeamCasesSavedViewCreation | A saved view was created for a teams cases | | TeamCasesSavedViewDestruction | A saved view was deleted from a teams cases | | TeamCasesSavedViewUpdate | A team cases saved view was updated | | TeamCaseStatusCreation | A team case status was created | | TeamCaseStatusDeletion | A team case status was deleted | | TeamCaseStatusUpdate | A team case status was updated | | TeamCaseSubscriberBulkCreation | Team case subscribers were bulk created | | TeamCaseSubscriberCreation | A subscriber was added to a case | | TeamCaseSubscriberDeletion | A subscriber was removed from a case | | TeamCaseTagsUpdate | A tag was added to or removed from a case | | TeamCaseTemplateCreation | A team case template was created | | TeamCaseTemplateDeletion | A team case template was deleted | | TeamCaseTemplateUpdate | A team case template was updated | | TeamCaseUnlinkCase | A team case was unlinked | | TeamCaseUpdate | A case was assigned, renamed, completed or its description updated | | TeamCaseWebhookUpdate | A case notification webhook was set or updated for the team | | TeamCreation | A team was created | | TeamDestruction | A team was destroyed | | TeamMemberRemoval | A team member was removed | | TeamMembersAddition | A team member was added | | TeamNotificationSettingsUpdate | Team notification settings were updated | | TeamSettingUpdate | A team setting was updated | | TeamStaticExternalIdDestruction | A team static external ID was destroyed | | TeamTunnelMembershipUpdate | A team tunnel membership was updated | | TeamUpdate | A team was updated | | TemplateActionTagUpdate | A template action tag was updated | | TemplateCreation | A template was created | | TemplateDestruction | A template was deleted | | TemplateDuplication | A template was duplicated | | TemplateTestRun | A template test was run | | TemplateUpdate | A template was updated | | TenantAiEnabledToggle | Tenant AI was enabled/disabled | | TenantAiProviderChange | A tenant AI provider was changed | | TenantAiProviderDeletion | A tenant AI provider was deleted | | TenantAiProviderTest | Tenant AI provider was tested | | TenantChangeControlSettingsUpdate | Tenant change control settings were updated | | TenantConfigChange | A tenant's config was changed | | TenantFeatureFlagToggle | A feature flag was enabled/disabled | | TenantLimitsChange | Tenant limits were changed | | TenantPlanUpgradeRequest | A plan upgrade was requested | | TenantSessionTimeoutChange | Tenant session timeout was changed | | TenantSettingsChange | Tenant settings were changed | | TestStoryCreation | Change control was enabled for a story | | TestStoryDeletion | Change control was disabled for a story | | ToolLinkCreation | A tool link was created | | ToolLinkDeletion | A tool link was deleted | | ToolLinkGroupCreation | A tool link group was created | | ToolLinkStsCreation | A tool link STS was created | | ToolLinkTemplatesCreation | Tool link templates were created | | TunnelDestruction | A tunnel was destroyed | | TunnelUpdate | A tunnel was updated | | UpdatePageFromTemplate | A page was updated from a template | | UploadImage | An image was uploaded | | UserCredentialDestruction | A user credential was destroyed | | UserCredentialHttpRequestRun | A user credential HTTP request was run | | UserCredentialMovement | A user credential was moved | | UserCredentialSave | A user credential was saved | | UserDeletion | A user was deleted | | UserEdit | A user was edited | | UserFavoriteIntegrationProductChange | A user's favorite integration product was changed | | UserFavoriteTemplateChange | A user's favorite template was changed | | UserImpersonationDisabled | User impersonation was disabled | | UserImpersonationEnabled | User impersonation was enabled | | UserRecoveryCodesDeletion | User recovery codes were deleted | | UserRecoveryCodesGeneration | User recovery codes were generated | | UserReinvitation | A user's invitation was resent | | UsersInvitation | A user was invited | | UserSessionExpiryChange | User session expiry was changed | | UserTeamRoleChange | A user's team role was changed | | WorkbenchConfigurationCreation | A Workbench preset was created | | WorkbenchConfigurationDeletion | A Workbench preset was permanently deleted | | WorkbenchConfigurationDuplication | A Workbench configuration was duplicated | | WorkbenchConfigurationUpdate | A Workbench preset was updated | | WorkbenchConfiguredProductUpdate | A user enabled/disabled a product or changed its credential in Workbench | | WorkbenchConfiguredStoryUpdate | A story was enabled/disabled in Workbench | | WorkbenchConversationDeletion | A Workbench conversation was permanently deleted | | WorkbenchConversationFork | A new conversation was created, with context up to a fixed point from the original conversation | | WorkbenchConversationRename | A Workbench conversation was renamed | | WorkbenchConversationStart | A new conversation was started in Workbench | | WorkbenchConversationSubmitForEvaluation | A Workbench conversation was submitted for evaluation | | WorkbenchConversationToggleFavorite | Favorite was enabled/disabled for a conversation | | WorkbenchCustomSlackIntegrationCreation | A Workbench integration was created for Slack | | WorkbenchDraftStoryCreation | A draft story was created from a Workbench conversation | | WorkbenchEnableProductTemplates | A user enabled/disabled templates for a product in Workbench | | WorkbenchInstructionChange | Custom instructions for a user were updated | | WorkbenchIntegrationCreation | A Workbench integration was created | | WorkbenchPresetCreation | A Workbench preset was created | | WorkbenchPresetUpdate | A Workbench preset updated | | WorkbenchToolUseCancel | User canceled the use of a tool | | WorkbenchToolUseConfirm | User confirmed the use of a tool | | WorkbenchUserMessageSend | User sent a message to Workbench | | WorkbenchUserMessageStop | User stopped a reply from Workbench | ## Log format Each log contains enriched user information, as well as metadata related to the operation carried out. Extremely sensitive information, for example credential values, are never included. ```json { "created_at": "2022-10-04T19:03:18Z", "id": 123456, "inputs": { "inputs": { "teamId": 1772 } }, "request_ip": "11.22.33.44", "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36", "tenant_id": 9, "updated_at": "2022-10-04T19:03:18Z", "user_email": "user@example.com", "user_id": 9, "user_name": "Example User", "operation_name": "StoryCreation" } ```