Open INSIGHTS → History (/audit) to review org audit events.
Browse events
- Open History
- Use filters — date range, actor, event type, resource
- Click a row for detail — payload summary, IP or client hints when logged
- Copy resource IDs for correlation with Runs or support tickets
Common investigations
| Scenario | Filter approach |
|---|---|
| Unexpected workflow change | Event type = workflow, sort by time |
| Connector credential change | Event type = connector, actor = admin |
| Approval audit | Event type = approval, include decision |
| API key leak response | Event type = api_key, revoke then verify revoke event |
Export
When your role allows export:
- Set filters to the investigation window
- Choose Export (CSV or JSON per UI)
- Store according to your retention policy
API export:
code
curl -s "https://gravitre.app/api/audit/export?from=2026-06-01&to=2026-06-07" \
-H "Authorization: Bearer YOUR_API_KEY" \
-o audit-export.json
Enterprise orgs may stream to SIEM via Enterprise → Security log export.
Retention
Retention windows vary by plan. Enterprise Data residency settings may affect storage region — see Enterprise.
API
List events:
code
curl -s "https://gravitre.app/api/audit?limit=50" \
-H "Authorization: Bearer YOUR_API_KEY"
See OpenAPI for query parameters and response fields.