Audit Log
Who published the incident? Who set the component to major outage? Who changed the status page password?
Under Status Pages → Audit Log you find every change in your workspace, with the time, the person and the object affected.
Plans
- Pro: the last 30 days.
- Business: everything kept — a year.
Recording happens on every plan. When you move to Pro or Business, the history is already there, even though you could not see it before.
What is recorded
Creation, changes and deletion of incidents and their updates, maintenances, components, component groups, templates, integrations, metrics, HTTP checks, subscribers, your own mail server (SMTP), and the status page settings themselves.
And who has access to the workspace:
- Team: who joined and who was removed, and every role change with the old and the new role
- Invitations: sent (with the intended role) and withdrawn; an accepted one shows up as someone joining
- API tokens: created (read-only or read and write) and revoked
Each entry carries:
- When the change happened, to the second
- Who made it — a person, an API token, or the system
- What changed: the object, its name, and every field that changed with its value before and after
- the IP address it came from
Changes that only touch timestamps produce no entry. A log that fills with noise is one nobody reads.
Filters and details
Narrow the list by action (created, changed, deleted), origin (person, API token, automatic), status page, kind of object (component, incident, maintenance, team member …), person and period. The person list includes colleagues who have since left the workspace.
The eye next to an entry shows every changed field with its value before and after. The before value exists for entries from 12 November 2026; older ones show only the new value.
Person, token or system
Three kinds of actor, and the difference matters to an audit:
- Person — somebody was signed in to the dashboard.
- API token — a script acted, using a person's token. The name is there, but it was automation, not a human.
- Automatic — the scheduler started a maintenance, a job reset a status. Nobody pressed anything.
If someone leaves the company and their account is deleted, their name stays on the existing entries. A log that empties exactly when someone leaves would not be one.
What is not in it
No secrets. If someone changes your status page password, the log records that the password changed — never the value, neither the old nor the new one. The same goes for webhook secrets, API tokens, the addresses of chat integrations (Slack, Teams, Discord, Google Chat) and the credentials of checks.
No subscriber addresses. For subscribers the log says one was created or deleted, by whom and when — but not which one. Addresses are stored encrypted, and repeating them in the clear in a log would undo that. Who it was belongs in the subscriber list.
No content. Of long text, only the first 120 characters are recorded, before and after. The log tells you the message was changed and how it began — not the whole text.
The log cannot be edited
There is no way to change or delete an entry — not for you, and not for us through the interface. A log somebody can adjust afterwards answers no audit question.
Through the API
You can read the same log over the REST API too: GET /api/v1/audit-log, newest first, filtered by action (action), actor (actor_type: user, api_token, system), status page (statuspage_id), kind of object (subject_type, e.g. Incident) and period (since, until). Each changed field reads {from, to}. The same rules apply: no secrets, no subscriber addresses, and your plan's window — a Pro token sees the last 30 days even with since. Details in the API reference.
Retention
Entries are kept for 365 days and then deleted automatically — on every plan. How far back you see depends on the plan (see above). That covers the usual review cycles and is at the same time a period we can state to you and your auditors, rather than "indefinitely".
If an audit needs a longer window or an export, talk to us.