---
updatedAt: 2026-09-30T16:41:45.000Z
agentTools:
  projectIndex: https://docs.censys.com/llms.txt
---

# Audit Log

The <Anchor target="_blank" href="https://accounts.censys.io/settings/organization/audit-log">audit log</Anchor> in the Censys Platform web console provides a record of user and organization events for the Platform and user, organization, and workspace events for Attack Surface Management (ASM).

As of January 2026, the Censys team has started migrating ASM customers to the Platform for organization management. Contact your Censys team representative to learn more about migrating your team.

<Image src="https://files.readme.io/f8f09fa35645e4b6123dbd70ed76d889dc5148580ddc2987a2448b96c16b36e5-Screenshot_2026-01-09_at_4.16.42_PM.png" align="center" border={true} />

## Access and use the audit log

Organization users with the <Anchor target="_blank" href="https://docs.censys.com/docs/role-based-access-control">Platform Admin</Anchor> role can access the audit log. Users without the Platform Admin role cannot access the audit log.

To access the audit log in the Platform console:

1. In the left side navigation panel, hover your cursor over the organization icon. Click the **Settings** button.
2. Go to **Organization Settings** > **Audit Log**.

Use the time range, **Event Name**, and **Actor** filters to find events of interest. Event names include actions like user login, Personal Access Token (PAT) creation and deletion, user role changes, and user MFA and password changes. Actors are Censys users or, in some cases for automated events, Censys systems.

The **Subject** is the object modified or used by the action.

<Callout icon="📘" theme="info">
  ### Note

  Events occurring on or after January 1, 2026 are available in the audit log.
</Callout>

Hover your cursor over an icon next to an actor or subject to see its type.

<Image src="https://files.readme.io/2528180e3a0d53e14d54ee20b0774da52dd2a690cac74ac4e1104baf7b691b44-Screenshot_2026-01-09_at_4.43.16_PM.png" align="center" border={true} />

The **Source** column indicates whether the action was executed in the UI or via the API. Note that if an ASM user makes a change via API, the username will not be shown, as ASM APIs are executed at a workspace level.

Click **Download CSV** in the top right corner at any time to download your filtered audit log results.

### Audit log events

The table below lists all audit log events and which products they apply to.

<AdvancedTable
  data={[
    {
      'Event': 'ASM Exclude Created',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Exclude Deleted',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Instance Accepted',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Instance Unaccepted',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Instance Severity Changed',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Type Disabled',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Type Enabled',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Risk Type Severity Changed',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Seed Created',
      'Product': 'ASM only',
    },
    {
      'Event': 'ASM Seed Deleted',
      'Product': 'ASM only',
    },
    {
      'Event': 'Invitation Accepted',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Invitation Created',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Invitation Deleted',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Invitation Resent',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Membership Created',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Membership Removed',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Membership Updated',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Organization Updated',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Organization Created',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'Organization Deleted',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'PAT Created',
      'Product': 'Platform only',
    },
    {
      'Event': 'PAT Deleted',
      'Product': 'Platform only',
    },
    {
      'Event': 'SAML Config Created',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'SAML Config Deleted',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'SAML Config Domain Verified',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'SAML Config Updated',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Created',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Disabled',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Updated',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Login',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Login Failed',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User MFA Changed',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Password Changed',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Password Reset',
      'Product': 'Platform and ASM',
    },
    {
      'Event': 'User Settings Changed',
      'Product': 'Platform and ASM',
    },
  ]}
/>

### Event information

Click the **>** arrow next to any event entry to see additional details, such as the login method and whether MFA was enabled for login events.

<Image src="https://files.readme.io/a4222da7ab2b65666eca641d63ce5033838d4904e57e2ca48da88da7a3f833cc-Screenshot_2026-01-09_at_4.35.14_PM.png" align="center" border={true} />

### Actor and subject information

Click the name of an actor or subject to see additional information about them, including their name, user ID, and email.

## User actions and organization information

Any time that a user performs an event that affects themselves like logging in, changing their settings, or creating a PAT, Censys records which organizations they were members of at the time of the event. Admins of any of those organizations can see those events in their audit log.

## Audit log API

Platform Admins can also retrieve audit log events via the <Anchor target="_blank" href="https://docs.censys.com/reference/v3-accountmanagement-org-audit-log-events">list audit log events API endpoint</Anchor>.

<br />