Audit log

Audit Log is an interactive track record of all organization activity. This feature is only available to Buildkite customers on the Enterprise plan, and can be found in Organization Settings in the Audit section.

Audit Log in Organization Settings

Audit Log contains two tabs:

  • Events - where you see all the events that take place within your Buildkite organization.

    Organization activity in Audit Log

  • Query & Export - where you can query and export your Buildkite organization's Audit Log using GraphQL API.

    Query and export of Audit Log

The following GraphQL Audit Event types are available and you can find more details about them in the GraphQL explorer.

API_ACCESS_TOKEN_CREATED
API_ACCESS_TOKEN_DELETED
API_ACCESS_TOKEN_ORGANIZATION_ACCESS_REVOKED
API_ACCESS_TOKEN_UPDATED
AGENT_TOKEN_CREATED
AGENT_TOKEN_REVOKED
AUTHORIZATION_CREATED
AUTHORIZATION_DELETED
CLUSTER_CREATED
CLUSTER_DELETED
CLUSTER_PERMISSION_CREATED
CLUSTER_PERMISSION_DELETED
CLUSTER_PERMISSION_UPDATED
CLUSTER_QUEUE_CREATED
CLUSTER_QUEUE_DELETED
CLUSTER_QUEUE_UPDATED
CLUSTER_TOKEN_CREATED
CLUSTER_TOKEN_DELETED
CLUSTER_TOKEN_UPDATED
CLUSTER_UPDATED
NOTIFICATION_SERVICE_BROKEN
NOTIFICATION_SERVICE_CREATED
NOTIFICATION_SERVICE_DELETED
NOTIFICATION_SERVICE_DISABLED
NOTIFICATION_SERVICE_ENABLED
NOTIFICATION_SERVICE_UPDATED
ORGANIZATION_CREATED
ORGANIZATION_DELETED
ORGANIZATION_INVITATION_ACCEPTED
ORGANIZATION_INVITATION_CREATED
ORGANIZATION_INVITATION_RESENT
ORGANIZATION_INVITATION_REVOKED
ORGANIZATION_MEMBER_CREATED
ORGANIZATION_MEMBER_DELETED
ORGANIZATION_MEMBER_UPDATED
ORGANIZATION_TEAMS_DISABLED
ORGANIZATION_TEAMS_ENABLED
ORGANIZATION_UPDATED
PIPELINE_CREATED
PIPELINE_DELETED
PIPELINE_SCHEDULE_CREATED
PIPELINE_SCHEDULE_DELETED
PIPELINE_SCHEDULE_UPDATED
PIPELINE_UPDATED
PIPELINE_VISIBILITY_CHANGED
PIPELINE_WEBHOOK_URL_ROTATED
SCM_PIPELINE_SETTINGS_CREATED
SCM_PIPELINE_SETTINGS_DELETED
SCM_PIPELINE_SETTINGS_UPDATED
SCM_SERVICE_CREATED
SCM_SERVICE_DELETED
SCM_SERVICE_UPDATED
SSO_PROVIDER_CREATED
SSO_PROVIDER_DELETED
SSO_PROVIDER_DISABLED
SSO_PROVIDER_ENABLED
SSO_PROVIDER_UPDATED
TEAM_CREATED
TEAM_DELETED
TEAM_MEMBER_CREATED
TEAM_MEMBER_DELETED
TEAM_MEMBER_UPDATED
TEAM_PIPELINE_CREATED
TEAM_PIPELINE_DELETED
TEAM_PIPELINE_UPDATED
TEAM_UPDATED
USER_EMAIL_CREATED
USER_EMAIL_DELETED
USER_EMAIL_MARKED_PRIMARY
USER_EMAIL_VERIFIED
USER_PASSWORD_RESET
USER_PASSWORD_RESET_REQUESTED
USER_TOTP_ACTIVATED
USER_TOTP_CREATED
USER_TOTP_DELETED
USER_UPDATED

You can also set up Amazon EventBridge to stream Audit Log events.