Audit Logs
The WarpBuild audit log: what is recorded, who can see it, the monthly fee, filters and CSV export, retention and data residency.
The audit log records every change made in your WarpBuild organization: who made it, what changed, when, and from where. Organization admins can view it, filter it and download it as CSV from Organization → Security → Audit logs.
What you need
You must be an organization admin, and your organization needs an active subscription. Audit logs add $400/month once you turn them on.
What is recorded
Every change made through the WarpBuild dashboard or the WarpBuild API is recorded. Reads are not. Changes are recorded for:
- Runners and infrastructure: runner sets, runner images and pull secrets, BYOC stacks and cloud integrations, GitHub and other VCS integrations, Docker builder profiles, network addons, snapshots, sandboxes and agent runner configuration.
- Members and access: sign-ins, members and their roles, invitations, API keys, connected OAuth apps, SSO and SCIM configuration, SSO enforcement, and members created or changed by your identity provider through SCIM.
- Organization and billing: organization settings such as telemetry, the data region and the audit log itself, report exports, billing details, spending limits, payment methods, subscription changes, credits and promotion codes.
A request that was refused because the caller was not allowed to make the change is recorded with the outcome Denied. Requests that fail for other reasons, such as invalid input or an error on our side, are not recorded.
Each event has the following fields.
| Field | What it holds |
|---|---|
| Actor | Who made the change: a user, WarpBuild staff or a WarpBuild service. A change made with an API key is attributed to the user who owns the key and marked as made with an API key. Changes made by WarpBuild staff appear as WarpBuild support. |
| Action | What was done, as <resource>.<verb>, for example runner_set.updated or member.removed. |
| Target | The type, id and name of what was changed, for example a runner set or a member. |
| Outcome | Success, or Denied when the caller was not allowed to make the change. Nothing changes on a denied request. |
| Time | When it happened, in UTC. |
| Changes | For some actions, the fields that changed with their values before and after, for example a member's role or an API key's scopes. |
| Request | The IP address, user agent, HTTP method and path, status code and request id of the request that made the change. |
| Source | The WarpBuild service that recorded the event: WarpBuild for runners and infrastructure, Auth for members and access, or Billing. |
Who can see it
Only organization admins can open the page or call the API. Members and viewers cannot.
Turning it on and the fee
Turning the audit log on adds a flat $400/month to your subscription. Organization admins can then read, filter and export the log.
To turn it on, open Organization → Security → Audit logs and click Turn on audit logs. The fee is not prorated: nothing is charged for the rest of the current billing period, and each invoice after that carries the full amount.
To turn it off, open the ⋯ menu at the top of the page and choose Turn off audit logs. The fee comes off your subscription from the next invoice, with no credit for the rest of the current period. Admins lose access to the log until it is turned on again.
Turning the log on or off is itself recorded, as org.audit_logs_updated.
Organizations billed through AWS Marketplace cannot add the fee from the page. Contact [email protected] and we turn it on for you.
Filtering
The page shows the last 30 days by default, newest first, 20 events per page. Pick another date range at the top of the page, and filter by:
- Action: one action name, chosen from the actions that appear in your log.
- Actor: one member of your organization, or a kind of actor: API keys, WarpBuild staff or services.
- Outcome: Success or Denied.
- Source: WarpBuild, Auth or Billing.
Click an event to open it. The panel shows what changed, the actor, the target and the request, and the raw event as JSON on a second tab. From the panel you can filter the log by the same actor or the same target, for example every change to one runner set. The filters and the open event are in the page URL, so a link to a filtered view or to a single event can be shared with another admin.
Export
Open the More actions menu (⋯) and choose Export CSV. The export uses the current date range and filters.
- Up to 10,000 matching events download right away as a CSV file.
- For more than 10,000 events, the export is prepared in the background and you get an email with a download link when it is ready, like the other report exports.
Retention and data residency
The log holds the last 13 months of events. Each event is also written, as it happens, to write-once storage, where it is locked. Nobody, including WarpBuild, can change or delete it.
Events are stored in your organization's data region: the United States by default, or the European Union for organizations on the EU region. The data region is shown under Organization → Data residency.
API
The log is available through the API for organization admins. Authenticate with an API key, as for the rest of the API. GET /api/v1/audit-events lists events, newest first, with the same filters as the page, and format=csv downloads them as CSV. See GET /audit-events in the API reference. The API answers 402 while the log is turned off.
curl "https://api.warpbuild.com/api/v1/audit-events?start_date=2026-10-01T00:00:00Z&action=runner_set.updated" \
-H "Authorization: Bearer wkey-…"Last updated on