MainBranch

Audit Log Events

The full reference of audit log event types, the structure of each log entry, and the entities they apply to.

This page is the reference for every audit log event MainBranch records. For the live, in-app view, see Audit Logs.

Audit logs are available to workspace owners and admins. They capture notable actions across the product so you can review who did what, when, and from where.

Log structure

Every audit log entry has the same shape. Each row in the audit log corresponds to one event.

FieldTypeDescription
createdAtdatetimeWhen the event happened, in UTC.
actionAuditActionThe event name (see Recorded events).
actorobjectWho performed the action — { id, type } where type is user, api_key, or system.
entityobjectWhat the action was performed on — { id, type, name?, parent_id? }. See Entities.
org_idstringThe workspace the event belongs to.
details.beforeobject(Optional) Snapshot of the entity before the change.
details.afterobject(Optional) Snapshot of the entity after the change.
details.infoobject(Optional) Additional context specific to the action (e.g. share recipients, export format, integration provider).
context.request_idstringThe request that triggered the event. Used for tracing.
context.ip_addressstring(Optional) IP address of the actor at the time of the event.
context.user_agentstring(Optional) Browser or client identifier of the actor.
context.session_idstring(Optional) The actor's session, if applicable.

Click any row in the in-app audit log to expand it and see details and context as readable JSON.

Entities

Every event is attached to an entity. The entity.type field tells you what kind of object the event applies to.

EntityWhat it represents
chatA chat conversation.
fileA Vault file.
folderA Vault folder.
meetingA meeting (live-recorded or uploaded).
orgThe workspace itself. Used for workspace-wide changes.
presentationA presentation deck.
smart_formA smart form (PDF form fill).
userA user — either the actor themselves or a user being acted upon (e.g. an invited member).

entity.name is the human-readable label when available (file name, meeting title, etc.). entity.parent_id is set when the entity sits inside another (e.g. a file inside a folder).

Recorded events

The table below lists every audit action MainBranch records, the entity it applies to, and the date the event first started being recorded.

Chat

EventEntityAvailable from
chat.createdchat2026-04-21
chat.namedchat2026-04-21
chat.renamedchat2026-04-21
chat.deletedchat2026-04-21
chat.branchedchat2026-04-21
chat.exportedchat2026-04-21
chat.message.sentchat2026-04-21
chat.message.responsechat2026-04-21
chat.message.regeneratedchat2026-04-21
chat.archivedchat2026-04-26
chat.archived_alluser2026-04-26
chat.unarchivedchat2026-04-26
chat.pinnedchat2026-04-26
chat.unpinnedchat2026-04-26

Meetings

EventEntityAvailable from
meeting.createdmeeting2026-04-21
meeting.renamedmeeting2026-04-21
meeting.deletedmeeting2026-04-21
meeting.bot_scheduledmeeting2026-04-21
meeting.sharedmeeting2026-04-21
meeting.share_revokedmeeting2026-04-21
meeting.unsharedmeeting2026-04-21

Presentations

EventEntityAvailable from
presentation.generatedpresentation2026-04-21
presentation.slides_updatedpresentation2026-04-21
presentation.regeneratedpresentation2026-05-05
presentation.image_generatedpresentation2026-05-05
presentation.message.sentpresentation2026-05-05
presentation.exportedpresentation2026-05-05
presentation.deletedpresentation2026-05-05
presentation.sharedpresentation2026-05-12
presentation.share_revokedpresentation2026-05-12
presentation.unsharedpresentation2026-05-12

Smart forms

EventEntityAvailable from
smart_form.createdsmart_form2026-04-21
smart_form.filledsmart_form2026-04-21
smart_form.submittedsmart_form2026-04-21
smart_form.deletedsmart_form2026-04-21

Vault — files

EventEntityAvailable from
vault.file.uploadedfile2026-04-21
vault.file.movedfile2026-04-21
vault.file.sharedfile2026-04-21
vault.file.share_revokedfile2026-04-21
vault.file.trashedfile2026-04-21
vault.file.restoredfile2026-04-21
vault.file.deletedfile2026-04-21
vault.file.updatedfile2026-05-12

Vault — folders

EventEntityAvailable from
vault.folder.createdfolder2026-04-21
vault.folder.renamedfolder2026-04-21
vault.folder.movedfolder2026-04-21
vault.folder.deletedfolder2026-04-21

Users

EventEntityAvailable from
user.loginuser2026-04-21
user.logoutuser2026-04-21
user.updateduser2026-04-21
user.password_changeduser2026-04-21
user.password_reset_requesteduser2026-04-21
user.2fa_enableduser2026-04-21
user.2fa_disableduser2026-04-21
user.integration_connecteduser2026-04-21
user.integration_disconnecteduser2026-04-21
user.invite_accepteduser2026-04-21
user.account_deletion_scheduleduser2026-04-21
user.account_deletion_cancelleduser2026-04-21

Workspace

EventEntityAvailable from
org.settings_updatedorg2026-04-21
org.security_settings_updatedorg2026-04-21
org.member.inviteduser2026-04-21
org.member.role_changeduser2026-04-21
org.data_export.requestedorg2026-04-21
org.data_export.downloadedorg2026-04-21
org.audit_log_export.requestedorg2026-05-05

Filtering and searching

In the in-app Audit Logs view you can:

  • Filter by date range — Pick a start and end date.
  • Search — Full-text over action labels and entity names.
  • Sort — Click the Time column header to toggle ascending or descending.
  • Paginate — Older entries load automatically as you scroll.

Exporting

Click Export in the Audit Logs page to download a CSV of the currently filtered results. The export runs in the background; you'll receive an email with a download link when it's ready. Download links expire after a set period — usually 7 days.

The export itself is captured as an org.audit_log_export.requested event in the log.

Retention

Audit log entries are retained for the lifetime of the workspace. Contact support if you need a copy after a workspace is closed.

See also

Audit Logs

Searchable record of every notable action in your workspace.

Data Export

Generate downloadable archives of organization activity.

On this page

Log structureEntitiesRecorded eventsChatMeetingsPresentationsSmart formsVault — filesVault — foldersUsersWorkspaceFiltering and searchingExportingRetentionSee also