Browse docs

Audit log

The audit log answers one question: who changed what, when, and from where. It records configuration and access changes in your organization, so you can find out why a monitor stopped alerting without digging through anyone's memory.

Where to find it

Open Administration → Audit log in the sidebar. Only organization owners can view it, because entries include the IP address behind each change.

The audit log is available on the Pro and Team plans. Pro keeps 90 days of history, Team keeps one year.

What gets recorded

Monitors

Uptime and cron monitors created, updated, paused, resumed and deleted, plus cron ping URL regeneration.

Notification channels and integrations

Channels and integrations created, updated and deleted, including which integrations a channel routes to.

Members and access

Invitations sent and revoked, members joining, role changes, and removals.

Organization

Organization settings, status pages, API keys created and revoked, and plan changes.

What an entry looks like

Updates carry a field-level diff, so an entry tells you what actually changed rather than just that something did:

16:42  Alex Morgan updated monitor API Production
       Check interval: 5 min → 1 min
       Expected status: 200 → 2xx

15:18  Sam Taylor paused monitor Checkout

11:03  Alex Morgan invited [email protected]

Every entry stores the actor, the time, and the IP address the change came from. Names of monitors, channels and members are stored as a snapshot, so a deleted monitor still reads as "API Production" months later.

Changes made through the API

Changes made through the REST API or the MCP server are attributed to the API key that made them, by name — not to the person who created the key. Automated changes such as a plan change driven by billing are recorded as system events.

Secrets are never recorded

Only an explicit list of fields is diffed, and sensitive ones are recorded as changed without their values. Custom request headers and cookies, request bodies, integration connection settings such as webhook URLs and bot tokens, and API tokens never appear in the log. Regenerating a cron ping URL is recorded as an event; the new URL is not.

What the audit log is not

It records configuration and access changes only. Monitoring activity — checks, incidents and alert deliveries — lives on the monitor and incident pages instead. Sign-ins, page views and API reads are not recorded.

There is no export, no audit-log API, and no streaming to an external log system. Entries cannot be edited or deleted from the app; they leave only when the plan's retention window passes.

Start monitoring in minutes

Free plan available. No credit card required.