> ## Documentation Index > Fetch the complete documentation index at: https://docs.langchain.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit logs > Track and review administrative actions across your LangSmith organization for security, compliance, and operational visibility. Audit logs are available on [**Enterprise** plans](/langsmith/pricing-plans). If you're interested in upgrading to Enterprise, [contact our sales team](https://www.langchain.com/contact-sales). LangSmith audit logs provide a tamper-resistant record of administrative and configuration actions taken within your organization. They help you answer questions like: * **Who** deleted an API key, a dataset, or a deployment? * **When** was a new member invited, a role modified, or examples updated? * **What** billing, SSO, or data retention configuration was changed? * **Which** datasets, tracing projects, or prompt webhooks were modified? Audit logs are useful for security reviews, compliance requirements, and general operational visibility. ## Prerequisites * Your organization must be on an [**Enterprise** plan](/langsmith/pricing-plans). * You must have the **Organization Admin** or **Organization Operator** role ([`organization:manage` permission](/langsmith/rbac#organization-admin)) to view audit logs. ## What gets logged Audit logs record changes to organization settings, membership, credentials, workspaces, and other resources. Each event includes the timestamp, the actor, the operation name, the affected resources, and whether it succeeded. For the complete list of operation names, see the [tracked operations reference](#tracked-operations-reference). ## Retention Audit logs are retained for up to **400 days**. Events older than 400 days may be removed automatically. ## Enable audit logs for self-hosted deployments Audit logs are available for [self-hosted](/langsmith/self-hosted) LangSmith instances running Helm chart **0.12.33** or later (application version **0.12.33**). Once you've upgraded, use one of the following options to enable audit logs: * **Enable for a specific organization:** Run the following against your LangSmith PostgreSQL database, replacing `` with the ID copied from the organization settings page in the UI: ```sql theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}} UPDATE organizations SET config = config || '{"can_use_audit_logs": true}' WHERE id = '' AND NOT is_personal; ``` * **Enable for all organizations:** Add the following environment variable to `commonEnv` in your `values.yaml`: ```yaml theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}} DEFAULT_ORG_FEATURE_CAN_USE_AUDIT_LOGS: "true" ``` This environment variable has no effect on personal organizations. For more details on self-hosted releases, see the [self-hosted changelog](/langsmith/self-hosted-changelog). ## Query audit logs via API Use the `GET /api/v1/audit-logs` endpoint ([API reference](https://api.smith.langchain.com/redoc#tag/audit-logs)) to retrieve audit log events. Results follow the [OCSF API Activity](https://schema.ocsf.io/1.7.0/classes/api_activity) schema. ### Example request ```bash theme={"theme":{"light":"catppuccin-latte","dark":"catppuccin-mocha"}} curl -G \ 'https://api.smith.langchain.com/api/v1/audit-logs' \ -H 'accept: application/json' \ -H 'X-API-Key: lsv2_sk_...' \ -H 'X-Organization-Id: abc123...' \ -d 'limit=2' \ --data-urlencode 'start_time=2026-01-01T18:35:16.232Z' \ --data-urlencode 'end_time=2026-01-13T18:35:16.232Z' \ --data-urlencode 'operations=create_api_key' \ --data-urlencode 'operations=delete_api_key' ``` ## Response format Audit log events are returned in [OCSF v1.7.0 API Activity (Class UID 6003)](https://schema.ocsf.io/1.7.0/classes/api_activity) format. Key fields: | Field | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `actor.user.uid` | UUID of the user who performed the action. | | `actor.user.credential_uid` | UUID of the API key, PAT, or service key used to authenticate the request. `null` if the user authenticated via session (e.g., the UI). | | `api.operation` | The LangSmith operation name (e.g., `create_api_key`, `delete_workspace`). See [tracked operations reference](#tracked-operations-reference) for all values. | | `status` | `Success`, `Failure`, or `Unknown`. | | `resources` | List of UUIDs for the resources affected by the operation (e.g., the role that was updated, the workspace that was created). | | `metadata.uid` | Unique identifier for this audit log event. | | `unmapped.original_audit_log` | The full LangSmith-native audit log record, including `organization_id` and `workspace_id`. | ## Forwarding to external systems To forward audit log events to an external SIEM or logging platform, you can run a scheduled function that pulls the previous hour of events every hour. For example, with [AWS Lambda + EventBridge Scheduler](https://docs.aws.amazon.com/lambda/latest/dg/with-eventbridge-scheduler.html), failures land in a dead-letter queue so you know which windows to retry. ## Tracked operations reference | Category | Operations (`api.operation`) | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **API keys & credentials** | `create_api_key`, `delete_api_key`, `create_personal_access_token`, `delete_personal_access_token`, `create_service_key`, `delete_service_key`, `create_service_account`, `delete_service_account`, `list_org_personal_access_tokens`, `list_org_service_keys` | | **Roles** | `create_role`, `update_role`, `delete_role` | | **Organizations** | `create_organization`, `create_provisioned_saas_org`, `create_tenant`, `invite_provisioned_org_member`, `claim_pending_organization_invite`, `delete_pending_organization_invite` | | **Organization members** | `invite_user_to_org`, `invite_users_to_org_batch`, `update_org_member`, `delete_org_member`, `delete_org_pending_member`, `add_basic_auth_users_to_org`, `update_basic_auth_user` | | **SSO & authentication** | `create_sso_settings`, `update_sso_settings`, `delete_sso_settings`, `update_login_methods`, `update_default_sso_provision_organization`, `get_sso_settings`, `get_sso_settings_current`, `get_login_methods`, `send_sso_email_confirmation`, `confirm_sso_user_email`, `login` | | **SCIM provisioning** | `create_scim_token`, `update_scim_token`, `delete_scim_token`, `create_scim_user`, `update_scim_user`, `delete_scim_user`, `create_scim_group`, `update_scim_group`, `delete_scim_group` | | **Billing & business info** | `update_organization_info`, `update_business_info`, `update_payment_plan`, `update_payment_method`, `create_payment_setup_intent`, `create_payment_checkout_session`, `create_payment_account_link` | | **Workspaces** | `create_workspace`, `update_workspace`, `delete_workspace`, `add_member_to_workspace`, `add_members_to_workspace_batch`, `delete_workspace_member`, `update_workspace_member`, `delete_workspace_pending_member`, `claim_pending_workspace_invite`, `delete_pending_workspace_invite`, `update_workspace_secrets`, `unshare_entities`, `set_tenant_handle` | | **Data retention & usage limits** | `update_ttl_settings`, `update_usage_limit`, `delete_usage_limit` | | **Tracing projects** | `update_tracer_session`, `delete_tracer_session`, `delete_tracer_sessions` | | **Runs & traces** | `query_run`, `query_runs`, `query_trace`, `query_trace_messages`, `batch_query_trace_messages`, `query_threads`, `query_thread_traces`, `read_run`, `read_runs`, `delete_runs`, `get_run_cluster`, `generate_runs_query` | | **Datasets** | `create_dataset`, `create_csv_dataset`, `update_dataset`, `delete_dataset`, `delete_datasets`, `update_dataset_version`, `update_dataset_splits`, `share_dataset`, `unshare_dataset`, `clone_dataset`, `download_dataset`, `generate_dataset`, `generate_shared_dataset_query`, `get_dataset_comparison_view`, `stream_dataset_comparison_view`, `read_dataset_delta`, `read_shared_delta`, `read_shared_delta_stream`, `create_experiment_via_upload`, `create_playground_experiment`, `create_comparative_experiment`, `delete_comparative_experiment` | | **Examples** | `create_example`, `create_examples`, `update_example`, `update_examples`, `delete_example`, `delete_examples`, `read_example`, `read_examples`, `get_example`, `list_examples`, `sync_examples`, `validate_example`, `validate_examples` | | **Experiments** | `create_experiment_view_override`, `update_experiment_view_override`, `delete_experiment_view_override`, `get_experiment_view_override`, `get_experiment_view_overrides`, `evaluate_experiment` | | **Evaluators** | `create_evaluator`, `update_evaluator`, `delete_evaluator`, `bulk_delete_evaluators`, `execute_custom_code` | | **Feedback** | `create_feedback_config`, `update_feedback_config`, `delete_feedback_config`, `create_feedback_formula`, `update_feedback_formula`, `delete_feedback_formula`, `read_feedback`, `read_feedbacks`, `stream_feedback_delta` | | **Annotation queues** | `create_annotation_queue`, `update_annotation_queue`, `delete_annotation_queue`, `delete_annotation_queues`, `populate_annotation_queue`, `export_annotation_queue`, `add_annotation_queue_reviewer`, `remove_annotation_queue_reviewer`, `add_runs_to_annotation_queue`, `create_annotation_queue_run_status`, `update_annotation_queue_run`, `get_annotation_queue_run`, `get_annotation_queue_runs`, `delete_annotation_queue_run`, `delete_annotation_queue_runs`, `resolve_annotation_queue_run`, `get_pairwise_queue`, `list_pairwise_queues`, `list_pairwise_entries` | | **Alerts** | `create_alert_rule`, `update_alert_rule`, `delete_alert_rule`, `test_alert_rule` | | **Filter views** | `create_filter_view`, `update_filter_view`, `delete_filter_view`, `rename_filter_view` | | **Prompt commits & hub** | `create_commit`, `create_directory_commit`, `delete_directory`, `create_hub_environment`, `update_hub_environment`, `delete_hub_environment` | | **Prompt canvas quick actions** | `create_prompt_canvas_quick_action`, `update_prompt_canvas_quick_action`, `delete_prompt_canvas_quick_action` | | **Prompt webhooks** | `create_prompt_webhook`, `update_prompt_webhook`, `delete_prompt_webhook`, `test_prompt_webhook` | | **Deployments** | `create_deployment`, `update_deployment`, `delete_deployment` | | **Bulk exports** | `create_bulk_export`, `cancel_bulk_export`, `get_bulk_export`, `get_bulk_export_run`, `get_bulk_export_runs`, `get_bulk_export_runs_filtered`, `list_bulk_exports`, `create_bulk_export_destination`, `update_bulk_export_destination`, `read_bulk_export_destination`, `list_bulk_export_destinations` | | **Resource tags** | `create_tag_key`, `update_tag_key`, `delete_tag_key`, `create_tag_value`, `update_tag_value`, `delete_tag_value`, `create_tagging`, `delete_tagging` | | **Access policies** | `create_access_policy`, `delete_access_policy`, `list_access_policies`, `read_access_policy`, `attach_access_policies`, `read_role_access_policies` | | **Custom charts** | `create_chart`, `update_chart`, `delete_chart`, `read_chart`, `read_charts`, `read_chart_preview`, `create_chart_section`, `update_chart_section`, `delete_chart_section`, `clone_chart_section`, `read_chart_section`, `create_org_chart`, `update_org_chart`, `delete_org_chart`, `create_org_chart_section`, `update_org_chart_section`, `delete_org_chart_section`, `read_tracing_dashboard` | | **Model pricing** | `create_model_price_map`, `update_model_price_map`, `delete_model_price_map` | | **MCP servers & tools** | `create_mcp_server`, `update_mcp_server`, `delete_mcp_server`, `register_mcp_server_oauth`, `mcp_proxy`, `create_mcp_vendor_settings`, `update_mcp_vendor_settings`, `delete_mcp_vendor_settings`, `invalidate_mcp_tools_cache`, `create_tool`, `update_tool`, `delete_tool` | | **Gateway policies** | `create_gateway_policy`, `update_gateway_policy`, `delete_gateway_policy` | | **Forge configurations** | `create_forge_configuration`, `update_forge_configuration`, `delete_forge_configuration`, `trigger_forge_configuration` | | **Insights jobs** | `create_insights_job`, `update_insights_job`, `delete_insights_job`, `create_insights_job_config`, `update_insights_job_config`, `delete_insights_job_config`, `generate_insights_job_config`, `get_insights_job_runs` | | **Fleet usage limits & webhooks** | `create_fleet_usage_limit`, `update_fleet_usage_limit`, `delete_fleet_usage_limit`, `create_fleet_webhook`, `update_fleet_webhook`, `delete_fleet_webhook`, `test_fleet_webhook` | | **Sandbox proxy profiles** | `create_sandbox_proxy_profile`, `update_sandbox_proxy_profile`, `delete_sandbox_proxy_profile` | | **Playground settings** | `create_playground_settings`, `update_playground_settings`, `delete_playground_settings` | | **Self-hosted licensing** | `create_self_hosted_customer`, `update_self_hosted_customer`, `mint_self_hosted_license`, `update_self_hosted_license` | | **Feature model defaults** | `upsert_feature_default_model`, `delete_feature_default_model`, `upsert_feature_disabled_model`, `delete_feature_disabled_model` | | **Onboarding** | `create_onboarding_state`, `update_onboarding_state` | | **NPS** | `submit_nps_response` | ## FAQ Users with the [**Organization Admin**](/langsmith/rbac#organization-admin) or [**Organization Operator**](/langsmith/rbac#organization-operator) role (which grant the `organization:manage` permission) can access audit logs. Workspace-level roles do not provide audit log access. No. Audit logs are an Enterprise feature. See [pricing](https://www.langchain.com/pricing-langsmith) for plan details. Not currently. Audit logs are available via the [API](#query-audit-logs-via-api). Audit logs currently primarily focused on write operations. Support for more read operations may be added in the future. Yes. We intend to expand the set of tracked operations over time. The [tracked operations reference](#tracked-operations-reference) always reflects the current set of supported operations. The API returns events exclusively in OCSF format. The `unmapped.original_audit_log` field within each event contains the raw LangSmith audit log record if you need the data in a different shape. The [Open Cybersecurity Schema Framework (OCSF)](https://schema.ocsf.io/) is an open standard for security event data. LangSmith returns audit log events as OCSF v1.7.0 API Activity (Class 6003) objects. ***
[Connect these docs](/use-these-docs) to Claude, VSCode, and more via MCP for real-time answers. [Edit this page on GitHub](https://github.com/langchain-ai/docs/edit/main/src/langsmith/audit-logs.mdx) or [file an issue](https://github.com/langchain-ai/docs/issues/new/choose).