The Audit log under Organization Settings → Enterprise Identity is an append-only, organization-scoped record of identity and access changes. Use it to troubleshoot sign-in failures, verify SCIM behavior, and review administrative actions.
The audit log stores operational metadata only—never SAML assertions, bearer tokens, or full SCIM payloads.
Viewing events
Owners can:
- Browse events in reverse chronological order
- Filter by event type, date range, and free-text search
- Open an event for full detail (actor, target user, workspace, WorkOS event ID, connection ID)
- Export filtered results to CSV
Events include a source field indicating whether the action came from SSO, Directory Sync, the dashboard, CLI, or another internal path.
Event categories
SSO sign-in
| Event type | Meaning |
|---|
sso_login_success | User completed SSO and signed in |
sso_login_failed | SSO authentication failed |
sso_enforcement_blocked | Email/password or social login blocked because Require SSO is on |
sso_rejected_deactivated_identity | SSO rejected for a previously deprovisioned IdP identity |
SSO setup and testing
| Event type | Meaning |
|---|
sso_setup_started | SSO configuration flow started |
sso_setup_saved | SSO configuration saved |
sso_test_started | Test SSO initiated from dashboard |
sso_test_succeeded | Test SSO completed successfully |
sso_test_failed | Test SSO failed |
sso_connection_activated | SSO connection became active |
JIT provisioning
| Event type | Meaning |
|---|
jit_user_provisioned | New user created on first SSO login |
jit_user_denied | JIT blocked (e.g. email domain not allowed) |
Directory Sync (users)
| Event type | Meaning |
|---|
directory_user_created | SCIM user provisioned |
directory_user_updated | SCIM user profile updated |
directory_user_deactivated | SCIM user deactivated / deprovisioned |
reactivation_attempt_rejected | Blocked attempt to restore a deprovisioned identity |
Directory Sync (groups)
| Event type | Meaning |
|---|
directory_group_created | IdP group synced |
directory_group_updated | IdP group updated |
directory_group_deleted | IdP group removed |
directory_group_user_added | User added to synced group |
directory_group_user_removed | User removed from synced group |
Group mappings
| Event type | Meaning |
|---|
group_role_mapping_created | IdP group mapped to workspace role |
group_role_mapping_updated | Mapping changed |
group_role_mapping_deleted | Mapping removed |
group_mapping_blocked_last_admin | Change blocked to preserve last workspace Admin |
scim_role_grant_blocked | Role grant blocked (e.g. disallowed role name) |
Workspace access
| Event type | Meaning |
|---|
workspace_membership_granted | User added to workspace |
workspace_membership_revoked | User removed from workspace |
workspace_role_changed | Identity-managed role updated |
workspace_role_downgrade_blocked | Downgrade blocked by last-Admin rules |
ownership_transferred | Workspace Admin ownership moved on deprovision |
workspace_orphaned | No Admin candidate after deprovision |
Policy and settings
| Event type | Meaning |
|---|
identity_settings_updated | Sign-in policy or default workspace changed |
identity_policy_version_bumped | Sessions invalidated for policy change |
require_sso_enabled | Require SSO turned on |
require_sso_disabled | Require SSO turned off |
enterprise_identity_enabled | Feature enabled for org |
enterprise_identity_disabled | Feature disabled for org |
directory_sync_activated | Directory Sync connection active |
Break-glass and MFA
| Event type | Meaning |
|---|
break_glass_login_used | Emergency access Owner signed in with email/password |
break_glass_login_blocked | Emergency login attempt blocked |
break_glass_guardrail_blocked | Action blocked by break-glass safety rules |
mfa_disabled_for_managed_user | MFA change blocked for SSO-managed member |
Operational triage
| Problem | Events to check |
|---|
| User cannot sign in with SSO | sso_login_failed, sso_rejected_deactivated_identity, jit_user_denied |
| User stuck after SSO | jit_user_provisioned without workspace_membership_granted — check mappings |
| Access removed unexpectedly | directory_user_deactivated, directory_group_user_removed, workspace_membership_revoked |
| Require SSO lockout | sso_enforcement_blocked, break_glass_login_used |
| Mapping change did not apply | group_mapping_blocked_last_admin, scim_role_grant_blocked |
| Workspace has no Admin | workspace_orphaned, ownership_transferred |
Retention and export
Audit events are stored in the identity_audit_events table in your organization’s PostgreSQL database.
Cloud (PromptLayer-hosted): Events persist for the life of your organization unless PromptLayer applies a platform retention policy. Use Export to CSV in the dashboard for ad-hoc exports. Contact PromptLayer support for long-term retention or compliance questions.
Self-hosted: You operate the database. Audit data lives in your PostgreSQL instance alongside the rest of PromptLayer metadata—you control backup, retention, and archival policies. Export from the dashboard UI or query identity_audit_events directly for compliance reporting. 
