Audit log

Why it matters

On Spaceboy, changes come from three kinds of actors: your teammates, autonomous agents working on their behalf, and the platform itself (the deploy pipeline, billing events). The audit log ties all of that activity together in one permanent, append-only record, so you can answer "who did what, when — and was it a person or an agent?" for any project in your organization. That's what you need when reviewing an unexpected production change, offboarding a teammate, or satisfying a security or compliance review.

Everything is captured automatically — no setup required. Entries are never edited or deleted, and each one keeps a snapshot of the actor's name at the time of the action, so history stays readable even after a member leaves or a project is removed. The audit log is included with the Enterprise plan, along with one-click export of the full log as CSV or JSON.

What is recorded

Every security- and governance-relevant action lands in the log, grouped into categories you can filter by:

• Deploys — deploys requested, succeeded, failed, or canceled; environment teardowns; production releases from pull request to merge, including rollbacks and rejections.
• Agent activity — agent sessions launched and stopped, commits pushed, code reviews completed, and fix cycles.
• Members — invites sent, resent, or revoked, and teammates joining.
• Projects and organization — projects created or updated, organization settings changes, deletion requests, DPA acceptances, and log exports.
• Access and integrations — API keys created or revoked; GitHub, Google Cloud, Cursor, and Slack connections added, verified, or removed.
• Domains and billing — custom domains added or removed, plan changes, and usage suspensions.
• Identity — SSO domains added, verified, or removed; identity provider configured or disconnected; SSO enforcement turned on or off (Enterprise).
• Policy — governance changes and refusals: spend budgets or the model allowlist updated, and every run refused by a budget or model policy (Enterprise).

What's in an entry

Each entry records when the action happened, who performed it — a signed-in user, an agent acting for a user, or the platform itself (marked "automated") — a human-readable summary like "Deployed Production for myapp", and a stable action identifier such as deploy.succeeded or member.invited. Entries also link back to the project and environment they touched, and carry action-specific detail (a commit SHA, the old and new plan) where it helps.

Viewing the audit log

Open Audit Logs from your organization's dashboard. Search across event summaries, or filter by category, teammate, and time range (last 24 hours up to 90 days). Entries stream in newest first, and the full history is retained.

Exporting the audit log

On the Enterprise plan, the Audit Logs page carries Export CSV and Export JSON buttons that download the organization's full audit trail through a signed link — take it into your own compliance tooling, evidence archive, or SIEM.