Audit Log

Applicable plans: Enterprise

The Audit Log helps enterprise admins review important administrative operation records within the organization, including operations related to organization settings, members and invitations, user groups, authentication, subscriptions and billing, models, usage configuration, IM channels, and more.

Through the Audit Log, admins can trace “who performed what operation on which management object at what time, and whether the operation was successful,” useful for security investigations, permission accountability, configuration tracing, and internal compliance documentation.

Viewable Scope

The Audit Log is only visible to Admin roles in the enterprise organization. Members cannot see the Audit Log entry, nor can they query or export audit logs.

The Audit Log records administrative operations from both the admin console and Open APIs, including successful operations and failed attempts. Some system-triggered events, such as invitation expiration or seat expiration, may also appear in the audit log to preserve a complete operation chain.

Content Not Recorded

The Qoder Audit Log only records administrative operation metadata and configuration change summaries — it does not record user business content.

The following content will NOT appear in audit logs:

• User Prompts
• Model responses
• Code snippets, Diffs, file content
• Terminal commands and terminal output
• IDE, CLI, or Agent execution processes
• MCP tool call parameters
• Tokens, API Keys, secrets, or certificate plaintext

When sensitive configurations such as secrets, Tokens, or certificates are involved, the audit log only records status changes like created, updated, deleted, or revoked, or records redacted identifiers — plaintext content is never displayed.

Currently Supported Operation Events

The following events are categorized by their location in the admin console.

“Console location” indicates the page or functional area corresponding to the event; “Page operation” indicates the write operation performed by the admin in the console; “Operation event” indicates the system event identifier displayed in the audit log.

Settings

Records changes to organization basic information, organization bindings, email domains, authentication, default quotas, and other settings.

Organization Basic Settings

Console Location	Page Operation	Operation Event	Description
Settings	Create organization	CreateOrganization	Organization was created
Settings	Update organization info	UpdateOrganizationInfo	Organization name or basic info was modified
Settings	Delete organization	DeleteOrganization	Organization was deleted or closed
Settings	Bind organization	BindOrganization	Organization was bound to an external entity or tenant

Domain Verification

Console Location	Page Operation	Operation Event	Description
Settings / Domain Verification	Add email domain	AddEmailDomain	Enterprise email domain was added
Settings / Domain Verification	Delete email domain	DeleteEmailDomain	Enterprise email domain was deleted
Settings / Domain Verification	Verify email domain	VerifyEmailDomain	Enterprise email domain was verified

Authentication & SAML

Console Location	Page Operation	Operation Event	Description
Settings / Security & Identity / SAML	Create SAML config	CreateSAMLConfig	SAML configuration was created
Settings / Security & Identity / SAML	Update SAML config	UpdateSAMLConfig	SAML configuration was modified
Settings / Security & Identity / SAML	Delete SAML config	DeleteSAMLConfig	SAML configuration was deleted
Settings / Security & Identity / SAML	Enable SAML config	EnableSAMLConfig	SAML login was enabled
Settings / Security & Identity / SAML	Disable SAML config	DisableSAMLConfig	SAML login was disabled

Default Usage Quota

Console Location	Page Operation	Operation Event	Description
Settings / Advanced Settings	Update Shared Add-on Credits default limit	UpdateSharedResourcePackageDefaultLimit	Default Shared Add-on Credits limit for new members joining the organization was modified

Members

Records member joins, member information changes, member removals, member logins, invitations, and user group operations.

Member Management

Console Location	Page Operation	Operation Event	Description
Members	Create member	CreateMember	Member was created or joined the organization
Members	Update member info	UpdateMember	Member basic info, role, or attributes were modified
Members	Remove member	RemoveMember	Member was removed from the organization
Members / Login	Member login	MemberLogin	Member login event was recorded

Member Invitations

Console Location	Page Operation	Operation Event	Description
Members / All Members	Invite member	InviteMember	Admin initiated a member invitation
Members / All Members	Create invitation	CreateInvitation	Invitation record was created
Members / All Members	Accept invitation	AcceptInvitation	Invitation was accepted
Members / All Members	Reject invitation	RejectInvitation	Invitation was rejected
Members / All Members	Revoke invitation	RevokeInvitation	Invitation was revoked by admin
Members / Email Invitation	Invite member by email	InviteMemberByEmail	Email invitation was sent
Members / Email Invitation	Accept email invitation	AcceptEmailInvitation	Email invitation was accepted
Members / Email Invitation	Cancel email invitation	CancelEmailInvitation	Email invitation was cancelled
Members / Email Invitation	Delete email invitation	DeleteEmailInvitation	Email invitation record was deleted
Members / Email Invitation	Email invitation expired	ExpireEmailInvitation	Email invitation expired
Members / Email Invitation	Resend email invitation	ResendEmailInvitation	Email invitation was resent

User Groups & Group Policies

Console Location	Page Operation	Operation Event	Description
Members / Groups	Create user group	CreateGroup	User group was created
Members / Groups	Update user group	UpdateGroup	User group name, description, or attributes were modified
Members / Groups	Delete user group	DeleteGroup	User group was deleted
Members / Groups	Add group member	AddGroupMember	Member was added to a user group
Members / Groups	Remove group member	RemoveGroupMember	Member was removed from a user group
Members / Groups	Create group policy	CreateGroupPolicy	User group policy was created
Members / Groups	Update group policy	UpdateGroupPolicy	User group policy was modified
Members / Groups	Delete group policy	DeleteGroupPolicy	User group policy was deleted

Models

Records admin changes to official models and model-related management configurations on the “Models” page.

These events only record model management configuration changes — they do not record model call content, Prompts, or responses.

Official Models

Console Location	Page Operation	Operation Event	Description
Models / Official models	Update official model availability	UpdateBuiltinModelPolicy	Visibility or availability policy for an official model tier was modified
Models / Official models	Update new official model default availability policy	UpdateBuiltinModelAutoEnablePolicy	Policy for whether new official models are available to members by default was modified

When supplier credentials, API Keys, secrets, or other sensitive configurations are involved, the audit log only records that the configuration was created, updated, or deleted — secret plaintext is never displayed.

Security Policies

Records organization-level security policy configuration changes, such as codebase security policies.

Console Location	Page Operation	Operation Event	Description
Security Policies	Update codebase security policy	UpdateRepositorySecurityPolicy	Codebase security level policy, available model scope, or default policy was modified

IM Channels

Records enabling and disabling of organization IM channel configurations.

Console Location	Page Operation	Operation Event	Description
IM Channels	Enable IM channel config	EnableIMChannelConfig	Specified IM channel was enabled
IM Channels	Disable IM channel config	DisableIMChannelConfig	Specified IM channel was disabled

Organization Usage

Records member usage limits, billing group usage limits, Shared Add-on Credits default limits, and usage report exports.

Console Location	Page Operation	Operation Event	Description
Members / Set Shared Add-on Credits limit	Update member usage limit	UpdateMemberUsageLimit	Member personal usage limit was modified
Members / Billing Groups	Update billing group usage limit	UpdateBillingGroupUsageLimit	Billing group period usage limit was modified
Settings / Advanced Settings	Update Shared Add-on Credits default limit	UpdateSharedResourcePackageDefaultLimit	Default Shared Add-on Credits limit for new members joining the organization was modified
Organization Usage	Export usage report	ExportUsageReport	Organization usage data export task was created

Subscriptions & Billing

Records enterprise subscription, seat allocation, and billing group operations.

Subscriptions

Console Location	Page Operation	Operation Event	Description
Subscription & Billing	Create subscription	CreateSubscription	Enterprise subscription was created
Subscription & Billing	Activate subscription	ActivateSubscription	Enterprise subscription was activated
Subscription & Billing	Update subscription	UpdateSubscription	Enterprise subscription info was updated
Subscription & Billing	Cancel subscription	CancelSubscription	Enterprise subscription was cancelled
Subscription & Billing	Upgrade subscription	UpgradeSubscription	Enterprise subscription plan was upgraded
Subscription & Billing	Downgrade subscription	DowngradeSubscription	Enterprise subscription plan was downgraded
Subscription & Billing	Restore subscription	RestoreSubscription	Cancelled or paused subscription was restored

Seats

Console Location	Page Operation	Operation Event	Description
Subscription & Billing / Seats	Create seat allocation record	CreateSeatAllocation	Seat allocation record was created
Subscription & Billing / Seats	Assign seat	AssignSeatAllocation	Seat was assigned to a member
Subscription & Billing / Seats	Unassign seat	UnassignSeatAllocation	Seat was released or unassigned from a member
Subscription & Billing / Seats	Update seat allocation	UpdateSeatAllocation	Seat status or attributes were modified
Subscription & Billing / Seats	Seat expired	ExpireSeatAllocation	Seat expired

Billing Groups

Console Location	Page Operation	Operation Event	Description
Members / Billing Groups	Create billing group	CreateBillingGroup	Billing group was created
Members / Billing Groups	Update billing group	UpdateBillingGroup	Billing group name, description, or configuration was modified
Members / Billing Groups	Delete billing group	DeleteBillingGroup	Billing group was deleted
Members / Billing Groups	Assign billing group member	AssignBillingGroupMember	Member was assigned to a billing group
Members / Billing Groups	Update billing group usage limit	UpdateBillingGroupUsageLimit	Billing group period usage limit was modified

Service Accounts

Console Location	Page Operation	Operation Event	Description
Settings / Service Accounts	Create service account	CreateServiceAccount	Service account was created
Settings / Service Accounts	Update service account	UpdateServiceAccount	Service account name, description, or related configuration was modified
Settings / Service Accounts	Archive service account	ArchiveServiceAccount	Service account was archived and can no longer be used for new API calls
Settings / Service Accounts	Create service account key	CreateServiceAccountKey	A long-lived access key was created for the service account
Settings / Service Accounts	Rotate service account key	RotateServiceAccountKey	The service account key was rotated, generating a new key and replacing the existing key
Settings / Service Accounts	Revoke service account key	RevokeServiceAccountKey	The service account key was revoked and can no longer be used for authentication
API / Service Account Authentication	Get short-lived token	ExchangeServiceToken	A long-lived service account key was used to obtain a short-lived access token