Audit Log
Review a single, filterable feed of the latest workspace events — queries run, nodes created, domains edited, invites, and more.
When to use it — When you need to see who did what and when: who ran a query, who edited a domain, who was invited, when a signal fired.
Where to find it — Lumen → Workspace → Audit Log.
Who can use it — Luminary (admin).
The Audit Log gives Luminaries a quick, read-only window into recent workspace activity. It merges two streams of events — general user activity and semantic-model (schema) changes — into one ranked feed so you don't have to cross-reference separate logs. Each row shows when something happened, who did it, what kind of action it was, and which resource it touched.
Overview
The page loads the most recent activity for your current workspace and lists it newest-first. At the top you see a live count of how many events are currently displayed, plus two filters: a free-text Filter by user box and an All actions dropdown. The table below renders one row per event.
The feed is intentionally bounded: it returns the latest 100 events for the workspace. This keeps the page fast and focused on what happened recently, rather than acting as a long-term archive.
Events come from two sources that are unioned together:
- User activity — things people do in the product, such as running a query.
- Schema activity — changes to the semantic model, such as creating a node or editing a domain.
Both sources are scoped to your workspace, so you only ever see activity that belongs to the workspace you are administering.
When to use it
Reach for the Audit Log when you need a fast answer to a "who / what / when" question, for example:
- Confirming that a teammate was invited, and when.
- Checking which user last edited a domain before a model change went live.
- Seeing whether a signal recently triggered.
- Spotting when a new warehouse connection was added.
- Reviewing recent query activity by a specific person.
It is a review-and-investigate tool, not a real-time alerting surface. For ongoing automated monitoring of metric conditions, use Signals instead.
Concepts
| Term | What it means |
|---|---|
| Event | A single logged action: one row in the feed, with a timestamp, user, action type, and resource. |
| User | The email address of the person associated with the event. |
| Action type | The category of the event (see the list below). The UI shows a colored label for each known type. |
| Resource | The thing the action touched — for example, the node name for a schema change, or the event detail for a user action. Shown in a monospace column. |
| Source | Internally, every event comes from either user activity or schema activity; the feed merges both into one list. |
Action types
The dropdown filter and the colored labels recognize these action types:
| Action type | Label shown |
|---|---|
query_run | Query run |
node_created | Node created |
domain_edited | Domain edited |
user_invited | User invited |
connection_added | Connection added |
canvas_pinned | Canvas pinned |
signal_triggered | Signal triggered |
If an event has an action that isn't in this list, the feed still shows it — it falls back to displaying the raw action value with a neutral gray label.
Getting started
To open the Audit Log you need to be signed in as a Luminary (admin). The page reads workspace-wide activity, so it lives under the workspace administration area.
Open Lumen
From the main navigation, open Lumen — the administration area of your workspace.
Go to Workspace
Within Lumen, select Workspace.
Open Audit Log
Choose Audit Log. The page loads the latest 100 events for your current workspace, newest first.
Step-by-step
Read the event count
The header shows how many events are currently displayed (for example, "100 events"). This number reflects what's on screen after any filters are applied.
Filter by user
Type into the Filter by user... box to narrow the list to events whose user contains your text. The match is a simple substring match on the user's email, so typing maria matches maria@example.com. The list updates as you type.
Filter by action type
Use the All actions dropdown to show only one action type — for example, Domain edited or User invited. Choose All actions to clear that filter.
Combine filters
You can apply the user filter and the action filter at the same time — for example, every Query run by a specific person.
Clear filters
When either filter is active, a Clear link appears next to the dropdown. Click it to reset both the user box and the action dropdown at once.
Read a row
Each row shows the Timestamp (in your local time), the User, a colored Action label, and the Resource the action touched.
Examples
Suppose a domain definition changed unexpectedly and you want to find out who edited it and when.
Filter to domain edits
Open the All actions dropdown and choose Domain edited. The feed now shows only domain_edited events.
Narrow to a person (optional)
If you suspect a particular teammate, type part of their email into Filter by user... to combine both filters.
Read the result
Scan the Timestamp and Resource columns to see exactly when the edit happened and which domain it touched.
A row in the feed corresponds to a record shaped roughly like this:
{
"source": "schema_activity",
"id": 482,
"timestamp": "2026-06-26T14:08:31.000Z",
"user": "maria@example.com",
"action": "domain_edited",
"resource": "sales"
}The page renders timestamp, user, the labeled action, and resource.
Best practices
- Filter before you scan. With up to 100 mixed events, the action dropdown is the fastest way to isolate the type of change you care about.
- Use the Audit Log alongside user management. When you spot an unexpected
user_invitedorconnection_addedevent, cross-check it against Users and your Roles to confirm intent. - Treat it as a recent-activity view. Because it returns only the latest 100 events, check it soon after the activity you're investigating — older events roll off as new ones arrive.
- Export for retention separately. If you need a permanent record, capture the information you need at the time of review (the in-page export control is not yet functional — see Common mistakes).
Tips
The user filter is a plain substring match, so you can type a domain fragment like @acme.com to see activity from everyone at a given company, or a partial name to catch every email that contains it.
Common mistakes
Don't rely on the IP or Duration columns. The table includes IP and Duration columns, but the audit feed does not currently provide IP data, and duration is empty for these events. Treat those two columns as not populated and use Timestamp, User, Action, and Resource for your investigation.
Don't expect a full history. The feed is capped at the latest 100 events for the workspace. It is not a complete or long-term archive.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| The list is empty | No matching activity, or your filters exclude everything | Click Clear to reset both filters, then re-check. |
| Your user filter returns nothing | The text doesn't match any user email as a substring | Try a shorter fragment of the email; matching is case-sensitive substring on the user field. |
| An action shows as plain text with a gray label | The event's action type isn't one of the recognized types | This is expected — the feed falls back to the raw action value for unknown types. |
| The IP column is blank | The audit feed does not return IP data | Use the other columns; IP is not populated. |
| The Duration column shows nothing meaningful | Duration is not provided for these events | Use the Timestamp column to reason about timing instead. |
| Export CSV does nothing | The button is a stub and isn't wired up | Copy needed rows manually from the table. |
| Recent activity is missing | More than 100 newer events have pushed it past the limit | Check sooner after the activity; the feed keeps only the latest 100. |