Platform Audit Logs

With Platform Audit Logs, WorkOS automatically sends supported Audit Log events to your customer’s audit trail and SIEM provider. These events appear alongside custom events emitted by your application.

Simply go to the WorkOS Dashboard to enable Platform Audit Logs.

Captured events count toward your Audit Logs usage and billing. See Audit Logs pricing.

Platform Audit Logs currently support the events below, with more to come. If there’s an event you’d like us to add, please reach out to us at support@workos.com or in your team’s WorkOS Slack channel.

Platform Audit Logs are turned off by default. Capture is configured per environment and applies to all organizations in that environment.

To enable Platform Audit Logs:

1. Open Audit Logs and select Platform schemas.
2. Review the available event types, then select Enable platform schemas.

Enabling Platform Audit Logs does not retrieve past activity.

WorkOS adds Platform Audit Log events to your customer’s audit trail alongside custom Audit Log events. You can view, export, and stream them in the same ways, using the WorkOS Dashboard, Admin Portal, and Log Streams. These events follow the organization’s existing Audit Logs retention settings.

• Admin Portal lets your customers view and export their organization’s events.
• You can export events as CSV through the Dashboard or API. See Exporting Events.
• Use Log Streams to send Audit Log events to your customer’s configured SIEM.