Activity Log

The Activity Log provides an audit trail of activity across your WorkOS team. Use it to understand who or what changed a resource, what changed, and when the action occurred.

The Activity Log records actions involving team members, organizations, API keys, connections, webhooks, AuthKit settings, and other resources. Each event includes:

• Action: the type of activity that occurred.
• Actor: the identity, credential, team, or system that performed the action.
• Targets: the resources affected by the action.
• Occurred at: the date and time of the action.
• Details: additional event data provided as JSON.

The Activity Log is available to team Admins.

Open Settings > Activity Log in the WorkOS dashboard.

Events are shown in reverse chronological order. You can search events, filter them by event type or a date range within the previous 90 days, and select an event to inspect its metadata and JSON details. To show only actions taken in the WorkOS dashboard or through MCP, select Dashboard UI or MCP in the Source filter menu.

Log streaming continuously sends Activity Log events to a destination you manage. Use it to centralize WorkOS activity with your other security and operational data.

The supported destinations and payload formats are the same as those described in the Log Streams documentation, including SIEM providers, data warehouses, object storage, and generic HTTPS endpoints.

To set up log streaming, select Set up log streaming on the Activity Log page. The Admin Portal opens in a new tab, where you choose a destination and enter its credentials. After setup, the page shows the stream status, and Manage log streaming opens the stream settings in the Admin Portal.