Audit Logs

​

Overview

Audit Logs provide a read-only record of user actions across your OneSignal organization. Use audit logs to:

• Investigate security incidents by reviewing login activity, IP addresses, and user sessions.
• Meet compliance requirements by providing evidence for SOC 2, HIPAA, and internal audits.
• Maintain accountability by tracking who created, updated, or deleted templates, journeys, and notifications.
• Export data to JSONL for offline analysis, or query the REST API for programmatic access and SIEM integration.

Audit logs are immutable. You cannot edit or delete entries, ensuring an accurate and trustworthy audit trail.

​

Plan availability

Audit log retention varies by plan.

---

​

Accessing Audit Logs

​

Org Level Audit Logs

Audit logs are available at the Organization level and include activity across all apps in that organization. Requirements:

• You must be an Organization Admin. See Manage Team Members to update roles.

To access audit logs:

1. Navigate to Organizations
2. Select your organization
3. Click Audit Logs

​

App Level Audit Logs

In addition to organization-level audit logs, you can view audit logs for a specific app:

1. Navigate to your App
2. Go to Settings
3. Click Audit Logs

App-level audit logs show only activity for that specific app, making it easier to investigate app-specific changes. Requirements:

• You must be an App Admin or Organization Admin

---

​

Understanding the Audit Log

Each row represents a single user action. You can customize visible columns using the Columns button in the top-right corner.

---

​

Tracked events

Audit logs track user actions across your organization, including logins, template changes, notification activity, journey updates, member management, billing events, and more. For a comprehensive list of all tracked events, see the Complete event reference.

---

​

Viewing event details

Click the expand arrow (›) next to any event to view additional details: Expanded details include:

---

​

Search and filters

Use the search and filter options to find specific events:

​

Search by email

Enter an email address in the search bar to find all actions performed by a specific user.

​

Date range

Select from the following preset date ranges:

• Last 24 hours
• Last 48 hours (default)
• Last 7 days
• Last 30 days
• Last 90 days (requires extended retention)
• Custom - Select specific start and end dates

​

Filters

Click Filters to narrow results by:

​

Item type values

Filter audit logs by the type of object affected:

---

​

Exporting audit logs

Export audit log data to a zipped .json file for offline analysis, compliance reporting, or integration with external tools. To export audit logs:

1. Navigate to the Audit Logs page (at the organization or app level).
2. Apply any desired filters and date range.
3. Click Export.
4. The .json.gz file(s) will be emailed to you.

You’ll have 3 days from creation to download your file before it expires.

​

Export availability

The export window matches your plan’s retention period.

---

​

API access

Query audit logs programmatically using the REST API. The API supports pagination, time-scoped queries, and filtering by app, action type, actor, target, and IP address. Requirements:

• Enterprise plan with the audit logs entitlement enabled
• Organization API Key for authentication (app-level keys are not accepted)

See the List audit logs API reference for endpoint details, parameters, and example responses.

---

​

Data retention

Audit log data is retained based on your plan:

• Free and Growth plans: 48-hour retention
• Professional plan: 48-hour retention by default, or 90-day retention with the Legal & Security Package add-on
• Enterprise plan: 90-day retention included

After the retention period, audit log entries are automatically removed and cannot be recovered.

---

​

Complete event reference

The following is a comprehensive list of all events tracked in audit logs, organized by category.

---

​

FAQ

​

Who can access audit logs?

Organization-level audit logs: Organization Admins can access audit logs for the entire organization. App-level audit logs: App Admins can access audit logs for apps they administer. Organization Admins can also access app-level audit logs for all apps in their organization. See Manage Team Members to update roles.

​

Can I view audit logs for a specific app?

Yes. Navigate to your app’s Settings page and select Audit Logs to view activity for that specific app only. This is useful for investigating changes to a particular app without seeing activity from other apps in your organization.

​

Can I export audit logs?

Yes. Click Export on the Audit Logs page to download a .jsonl file of the currently filtered results. The export window depends on your plan — see Export availability for details. For programmatic access, use the List audit logs API (Enterprise plans only).

​

Can audit logs be deleted?

No. Audit logs are immutable and cannot be deleted by any user.

​

Are API actions logged?

Yes, for select actions. API actions performed with Organization and App API keys are logged for auth token management (create, update, rotate, delete), app management (create, update), segment management (create, update, delete), template management (create, update, delete, copy to app), and subscription CSV export. The actor type displays as “API Key” with the key’s name and scope. Additional API actions are planned for future releases.

​

How do I increase my retention period?

Enterprise customers receive 90-day retention automatically. Professional customers can upgrade to 90-day retention by adding the Legal & Security Package. Contact your Account Manager or our Sales Team to discuss your requirements.

---