Audit log

Kumo.io keeps an append-only, tamper-evident record of every change made in your account and every refused attempt. Search it in Settings, export it, or pull it through the API.

Applies to: BothPlan: Business

What's recorded Open the audit log Export Read it through the API How Kumo.io protects the record Scheduled export to object storage (self-hosted)

What's recorded

Every change made in the account is recorded, whether it was made in the web app, through the API or with the CLI. For core changes to your estate, such as creating a workspace, a source or a credential, the record is written in the same transaction as the change: if the record can't be written, the change doesn't happen.

Examples of what you'll find:

Area	Examples
Access	Roles created, updated or archived; role assignments granted or removed; API tokens created or revoked; members invited
Sign-in security	Two-factor authentication turned on or off; sign-in policy changes; OpenID Connect and SAML configuration changes
Provisioning	SCIM operations from your identity provider
Your estate	Workspaces, sources, credentials, scopes, environments and views created or changed; syncs started or cancelled; workspace exports and imports
Policies	Retention and sensitive-field policies created, applied or deleted
Sharing	View shares created or revoked
Alerts and delivery	Alert rules and channels created, updated or deleted; alerts acknowledged; notification preferences; Slack connected or disconnected; webhook subscriptions created, rotated or deleted
Reports and cost	Report definitions, schedules, runs, exports, downloads and deliveries; cost analysis and allocation runs
Refusals	Attempts that were denied because the person lacked a permission

Each entry has an event type, an outcome (success, failure, denied or error), a severity (info, notice, warning or critical), who did it, what it was done to, the workspace if there was one, a reason where relevant, and the time.

What isn't recorded

Logging in and out, switching accounts, email-verification and password-reset links, and ordinary reading are not in the audit log.

Open the audit log

The audit log is part of the Business and Enterprise plans. On another plan, Settings › Audit Log shows what the plan doesn't include and a View Plans button, and the API answers 403 with the code FEATURE_NOT_ENTITLED.

Open Settings › Audit Log. You need the audit.read permission, which the Account owner, Account admin and Billing admin roles include.

Filter by date range (From and To), by outcome and by severity, or type in Filter event / actor / target….
Select an entry to see its details: actor kind, how they authenticated, whether the action was taken by someone acting on their behalf, workspace, scope, reason, the part of Kumo.io that recorded it, and when it was recorded.
Select Load More to fetch older entries.
Filters live in the page URL, so you can share a filtered view with a colleague.

Export

Two buttons export the entries currently loaded, with your filters applied:

Export CSV downloads kumo-audit-log.csv, with the columns occurredAt, eventType, outcome, severity, actor, target, workspaceId and reason.
Export PDF opens a printable page, including the account and the filters you used. Use your browser's print dialog to save it as a PDF. If nothing opens, allow pop-ups for Kumo.io and try again.

Load everything you need first: these buttons export what's on the page, not the whole log.

Read it through the API

GET /v1/accounts/{accountId}/audit-log

Optional query parameters: workspaceId, eventType, outcome, severity, since, until, limit and cursor. A page holds 100 entries by default and at most 200. Use the cursor from one page to fetch the next. The caller needs audit.read, on a plan that includes the audit log. Read API tokens to authenticate.

How Kumo.io protects the record

Append-only. Entries can't be edited or removed through the product.
Tamper-evident. Entries are linked in a hash chain. On a schedule, Kumo.io signs a checkpoint of the chain, and it checks the surviving chain against those checkpoints so that truncation or tampering after the fact can be detected.
Secrets are redacted. Kumo.io never stores tokens or secret values in an entry. A value that looks like a secret is replaced with [redacted] before the entry is written.

Scheduled export to object storage (self-hosted)

A self-hosted installation can export its audit log to object storage automatically, for your SIEM or long-term archive.

Turn it on by configuring an object store on an installation that runs the Postgres worker:

KUMO_OBJECT_STORE=s3
KUMO_S3_BUCKET=<bucket>
KUMO_S3_REGION=<region>

KUMO_OBJECT_STORE=filesystem with KUMO_OBJECT_STORE_DIR works too. With KUMO_OBJECT_STORE unset or set to inline, there is no export.

Once it's on:

Every hour, a few minutes past the hour, Kumo.io exports the previous full hour as one JSON Lines file, at a key like audit/export/2026-10-21-03.jsonl.
The export covers the whole installation, not one account.
Sensitive values are redacted in the exported file.
Files are written once and never overwritten. If an hour has already been exported, Kumo.io leaves it alone.
Each export records its own start and completion in the audit log.

For the strongest guarantee, turn on object lock (write-once-read-many retention) on the bucket, so the files can't be changed even by someone holding the storage credentials.

This scheduled export runs on self-hosted installations. On hosted Kumo.io, use the CSV, PDF and API options above.