With a **Pro** workspace plan or higher, admins can export audit logs of material events performed by team members over a specified time frame. Audit logs help you meet the requirements of various regulatory standards.

Render retains at least the last 90 days of audit log events for your workspace and organization. Retention does not begin until you upgrade to an eligible plan.

## Exporting audit logs

You can export an audit log of [workspace events](/content/docs/audit-logs#workspace-events/index.html) for an individual workspace. With a **Scale** or **Enterprise** [plan](/content/pricing/index.html), you can also export a _separate_ audit log of [organization events](/content/docs/audit-logs#organization-events/index.html) for your org.

**Each audit log export can span a maximum of 90 days.**

To export a longer period, perform multiple exports with consecutive date ranges.

### API

The [Render API](/content/docs/api/index.html) provides the following endpoints for audit logs:

| Action | Endpoint |
| --- | --- |
| **Export workspace events** | [List workspace audit logs](https://api-docs.render.com/reference/list-owner-audit-logs) |
| **Export organization events** | [List organization audit logs](https://api-docs.render.com/reference/list-organization-audit-logs) |

### Dashboard

Select a tab to view instructions for each type of audit log:

1. In the [Render Dashboard](https://dashboard.render.com/), navigate to your workspace's **Workspace Settings** page.
2. Scroll down to the **Compliance** section.
3. Under **Audit Logs**, select a start and end date, then click **Export as CSV**:

This audit log includes the event types listed under [Workspace events](/content/docs/audit-logs#workspace-events/index.html).

Only org members with the [Org Owner role](/content/docs/organizations#the-org-owner-role/index.html) can export these audit logs.

1. In the [Render Dashboard](https://dashboard.render.com/), navigate to your org's **Settings** page.
2. Scroll down to the **Audit Logs** section.
3. Select a start and end date, then click **Export as CSV**.

This audit log includes the event types listed under [Organization events](/content/docs/audit-logs#organization-events/index.html).

## Availability of audit log data

- Render retains at least the last 90 days of audit log events for your workspace and organization.

- Retention does not begin until you upgrade to a **Pro** plan or higher. Earlier event data is not available.
- Whenever Render adds a new audit log event type, tracking for that event begins on the date of its introduction.

## Audit log format

Audit logs are exported as a chronologically ordered CSV file with a separate row for each distinct event. The file includes the following columns:

| Column | Description |
| --- | --- |
| **timestamp** | The UTC timestamp when the event occurred. |
| **actor** | The entity that performed the action. Depending on the type of actor, this value has one of two formats:<br>- The email address of the **existing Render user** that performed the action (e.g., `person@example.com`)<br>  <br>  - This is the most common actor type and format.<br>- The ID of the **deleted Render user** that performed the action (e.g., `Deleted User ID#123123123`) |
| **event** | The type of event that occurred.<br>See below for all supported [workspace events](/content/docs/audit-logs#workspace-events/index.html) and [organization events](/content/docs/audit-logs#organization-events/index.html). |
| **status** | Indicates whether the event's associated action succeeded. One of the following values:<br>- `success`<br>- `error` |
| **metadata** | A JSON object containing additional details about the event.<br>The fields of this object vary depending on the event type.<br>For shell access events, metadata can include `service`, `instance`, `source_ip`, and `user_agent` (when available). |

## Workspace events

The event types below appear in audit logs for individual Render workspaces.

### Member management

###### `InviteToTeamEvent`
A user was invited to the workspace.

###### `RemoveUserFromTeamEvent`
A user was removed from the workspace.

###### `AcceptTeamInviteEvent`
An invitation to join the workspace was accepted.

###### `ChangeTeamMemberRoleEvent`
A workspace member's [role](/content/docs/team-members#member-roles/index.html) was changed.

###### `ChangeTeamAllowedLoginMethodsEvent`
The workspace's set of allowed login methods was changed.

Currently, a workspace can either allow all Render-supported login methods or [require login via Google account](/content/docs/login-settings#google-account-login/index.html).

###### `ChangeTeam2FAEnforcementEvent`
[Two-factor authentication (2FA) enforcement](/content/docs/login-settings#two-factor-authentication/index.html) was enabled or disabled for the workspace.

###### `LoginEvent`
A workspace member logged in.

###### `LogoutEvent`
A workspace member logged out.

### Apps & services

Render does not log events for services belonging to a [service preview](/content/docs/service-previews/index.html) or [preview environment](/content/docs/preview-environments/index.html).

###### `CreateServerEvent`
A web service, private service, background worker, or static site was created.

###### `SuspendServiceEvent`
A web service, private service, background worker, or static site was suspended.

###### `ResumeServiceEvent`
A previously suspended web service, private service, background worker, or static site was resumed.

###### `MaintenanceModeEnabledEvent`
[Maintenance mode](/content/docs/maintenance-mode/index.html) was toggled for a web service.

In the event's metadata, the `to` field is `true` if maintenance mode was enabled and `false` if it was disabled.

###### `MaintenanceModeURIUpdatedEvent`
The URL of a web service's [maintenance mode page](/content/docs/maintenance-mode#response-format/index.html) was changed.

###### `UpdateServiceNameEvent`
The name of a web service, private service, background worker, static site, or cron job was changed.

###### `DeleteServerEvent`
A web service, private service, background worker, or static site was deleted.

###### `StartShellEvent`
A service was accessed via SSH, either from the command line or from the service's **Shell** page in the Render Dashboard.

###### `EndShellEvent`
An SSH shell session for a service ended, either from the command line or from the service's **Shell** page in the Render Dashboard.

###### `ApplyBlueprintEvent`
A new [Blueprint](/content/docs/infrastructure-as-code/index.html) was created and applied to the workspace.

###### `CreateCronJobEvent`
A cron job was created.

###### `DeleteCronJobEvent`
A cron job was deleted.

###### `UpdateAutoDeployEvent`
[Auto-deploy](/content/docs/deploys#configuring-auto-deploys/index.html) was enabled or disabled for a service.

###### `UpdateAutoDeployTriggerEvent`
The [auto-deploy trigger](/content/docs/deploys#configuring-auto-deploys/index.html) settings (such as branch or path filters) were changed for a service.

###### `CreateCustomDomainEvent`
A [custom domain](/content/docs/custom-domains/index.html) was added to a service.

###### `DeleteCustomDomainEvent`
A [custom domain](/content/docs/custom-domains/index.html) was removed from a service.

### Datastores

#### General

###### `UpdateIPAllowListEvent`
The IP allow list was updated for a Render Postgres or Key Value instance.

#### Render Postgres

These events are logged only for _primary_ Render Postgres instances, not for [high availability standby instances](/content/docs/postgresql-high-availability/index.html) or [read replicas](/content/docs/postgresql-read-replicas/index.html).

###### `CreatePostgresEvent`
A [Render Postgres](/content/docs/postgresql/index.html) database was created.

###### `DeletePostgresEvent`
A [Render Postgres](/content/docs/postgresql/index.html) database was deleted.

###### `SuspendPostgresEvent`
A [Render Postgres](/content/docs/postgresql/index.html) database was suspended.

###### `ResumePostgresEvent`
A previously suspended [Render Postgres](/content/docs/postgresql/index.html) database was resumed.

###### `DownloadDatabaseBackupEvent`
A [logical backup](/content/docs/postgresql-backups#logical-backups/index.html) of a [Render Postgres](/content/docs/postgresql/index.html) database was downloaded.

###### `ViewConnectionInfoEvent`
The connection URL or password for a [Render Postgres](/content/docs/postgresql/index.html) database was viewed.

#### Render Key Value

###### `CreateRedisEvent`
A [Render Key Value](/content/docs/key-value/index.html) instance was created.

###### `DeleteRedisEvent`
A [Render Key Value](/content/docs/key-value/index.html) instance was deleted.

###### `ViewConnectionInfoEvent`
The connection URL or password for a [Render Key Value](/content/docs/key-value/index.html) instance was viewed.

#### Persistent disks

###### `CreateServerDiskEvent`
The [persistent disk](/content/docs/disks/index.html) for a web service, private service, or background worker was created.

###### `DeleteServerDiskEvent`
The [persistent disk](/content/docs/disks/index.html) for a web service, private service, or background worker was deleted.

###### `RestoreDiskSnapshotEvent`
The [persistent disk](/content/docs/disks/index.html) for a web service, private service, or background worker was restored to a [snapshot](/content/docs/disks#disk-snapshots/index.html).

### Environment variables

###### `UpdateEnvVarsEvent`
One or more existing [environment variables](/content/docs/configure-environment-variables/index.html) were modified for a service.

###### `CreateEnvVarsEvent`
One or more [environment variables](/content/docs/configure-environment-variables/index.html) were created for a service.

###### `DeleteEnvVarsEvent`
One or more [environment variables](/content/docs/configure-environment-variables/index.html) were deleted for a service.

###### `ViewEnvVarValuesEvent`
One or more [environment variable](/content/docs/configure-environment-variables/index.html) values were viewed for a service.

###### `DeleteEnvGroupEvent`
An [environment group](/content/docs/configure-environment-variables#environment-groups/index.html) was deleted.

### Webhooks

###### `CreateWebhookEvent`
A [webhook](/content/docs/webhooks/index.html) was created.

###### `UpdateWebhookEvent`
A [webhook](/content/docs/webhooks/index.html) was changed.

###### `DeleteWebhookEvent`
A [webhook](/content/docs/webhooks/index.html) was deleted.

### Metrics

###### `CreateOtelIntegrationEvent`
A [metrics stream](/content/docs/metrics-streams/index.html) was created.

###### `DeleteOtelIntegrationEvent`
A [metrics stream](/content/docs/metrics-streams/index.html) was deleted.

###### `UpdateOtelIntegrationEvent`
A [metrics stream](/content/docs/metrics-streams/index.html) was changed.

### Projects & environments

###### `CreateProjectEvent`
A project was created.

This event is always accompanied by one [`CreateEnvironmentEvent`](/content/docs/audit-logs#createenvironmentevent/index.html) event, because every project is created with a default environment.

###### `DeleteProjectEvent`
A project was deleted.

This event is always accompanied by at least one [`DeleteEnvironmentEvent`](/content/docs/audit-logs#deleteenvironmentevent/index.html) event, because deleting a project also deletes all of its associated environments.

###### `CreateEnvironmentEvent`
A project environment was created.

###### `DeleteEnvironmentEvent`
A project environment was deleted.

###### `MoveEnvironmentResourceEvent`
A resource (such as a service or environment group) was moved into or out of a project environment.

###### `ChangeEnvironmentProtectionEvent`
[Protected access](/content/docs/projects#protected-environments/index.html) was enabled or disabled for a project environment.

###### `UpdateEnvironmentIsolatedEvent`
The [isolation setting](/content/docs/projects#blocking-cross-environment-traffic/index.html) was changed for a project environment.

### Compliance & documents

###### `DocumentDownloadEvent`
A workspace member downloaded a document from the [Render Document Center](/content/docs/certifications-compliance#view-compliance-documentation/index.html).

###### `SignNDAEvent`
A workspace member signed an NDA to view compliance documentation.

## Organization events

**Org-level audit logs are available on the Scale plan or higher.**

For details, see the [pricing page](/content/pricing/index.html).

**The event types below are specific to organizations on Scale and Enterprise plans.** They pertain to SSO and other org-level configuration.

These events appear _only_ in audit logs exported from your org's **Settings** page (not in audit logs exported for an individual workspace).

### Member management

###### `InviteToOrgEvent`
A user was invited to the org.

###### `AcceptOrgInviteEvent`
An invitation to join the org was accepted.

###### `AddOrgMemberEvent`
A user was added to the org.

###### `RemoveOrgMemberEvent`
A user was removed from the org.

###### `JoinTeamEvent`
An org member added themselves to a workspace in the org.

Org Owners can add themselves to any workspace as an admin. Other org members can add themselves to [public workspaces](/content/docs/organizations#per-workspace-access/index.html) only (they receive the Developer role).

###### `ChangeOrgRoleEvent`
An org member's role was changed.

This refers to a member's org-level role (such as [Org Owner](/content/docs/organizations#the-org-owner-role/index.html)), not their role within a particular workspace.

###### `ChangeOrgAllowedLoginMethodsEvent`
The org's set of allowed login methods was changed.

###### `ChangeOrg2FAEnforcementEvent`
Two-factor authentication enforcement was enabled or disabled for the org.

### Workspace management

###### `CreateWorkspaceEvent`
A workspace was created in the org.

###### `DeleteWorkspaceEvent`
A workspace in the org was deleted.

###### `ChangeWorkspacePrivacyEvent`
The [access setting](/content/docs/organizations#per-workspace-access/index.html) for a workspace in the org was changed.

### IdP management

###### `CreateOrgDomainEvent`
A domain was added to the org as part of [configuring SSO](/content/docs/saml-sso#sso-setup/index.html).

###### `VerifyOrgDomainEvent`
Ownership of a domain was verified as part of [configuring SSO](/content/docs/saml-sso#sso-setup/index.html).

###### `DeleteOrgDomainEvent`
A domain was removed from the org.

###### `CreateSSOConnectionEvent`
An [SSO connection](/content/docs/saml-sso/index.html) was created.

###### `UpdateSSOConnectionEvent`
An [SSO connection](/content/docs/saml-sso/index.html) was changed.

###### `DeleteSSOConnectionEvent`
An [SSO connection](/content/docs/saml-sso/index.html) was deleted.

###### `ProvisionOrganizationSCIMToken`
A [SCIM token](/content/docs/saml-sso#member-management-setup-scim/index.html) was provisioned for the org.

###### `RevokeOrganizationSCIMToken`
A [SCIM token](/content/docs/saml-sso#member-management-setup-scim/index.html) was revoked for the org.

## History of audit log event changes

| Date | Change |
| --- | --- |
| `2026-02-19` | Added the following workspace event type:<br>- [`EndShellEvent`](/content/docs/audit-logs#endshellevent/index.html)<br>Also added `source_ip` and `user_agent` metadata for audit events when available. |
| `2025-01-20` | Added the following workspace event types:<br>- [`UpdateAutoDeployEvent`](/content/docs/audit-logs#updateautodeployevent/index.html)<br>- [`UpdateAutoDeployTriggerEvent`](/content/docs/audit-logs#updateautodeploytriggerevent/index.html)<br>- [`CreateCustomDomainEvent`](/content/docs/audit-logs#createcustomdomainevent/index.html)<br>- [`DeleteCustomDomainEvent`](/content/docs/audit-logs#deletecustomdomainevent/index.html)<br>- [`UpdateEnvironmentIsolatedEvent`](/content/docs/audit-logs#updateenvironmentisolatedevent/index.html) |
| `2025-03-13` | Added initial set of [organization events](/content/docs/audit-logs#organization-events/index.html). |
| `2025-03-11` | Added the following workspace event types:<br>- [`CreateOtelIntegrationEvent`](/content/docs/audit-logs#createotelintegrationevent/index.html)<br>- [`DeleteOtelIntegrationEvent`](/content/docs/audit-logs#deleteotelintegrationevent/index.html)<br>- [`UpdateOtelIntegrationEvent`](/content/docs/audit-logs#updateotelintegrationevent/index.html)<br>- [`CreateWebhookEvent`](/content/docs/audit-logs#createwebhookevent/index.html)<br>- [`UpdateWebhookEvent`](/content/docs/audit-logs#updatewebhookevent/index.html)<br>- [`DeleteWebhookEvent`](/content/docs/audit-logs#deletewebhookevent/index.html) |
| `2024-12-18` | Added the following workspace event types:<br>- [`DocumentDownloadEvent`](/content/docs/audit-logs#documentdownloadevent/index.html)<br>- [`SignNDAEvent`](/content/docs/audit-logs#signndaevent/index.html) |
| `2024-09-24` | Added the following workspace event types:<br>- [`MaintenanceModeEnabledEvent`](/content/docs/audit-logs#maintenancemodeenabledevent/index.html)<br>- [`MaintenanceModeURIUpdatedEvent`](/content/docs/audit-logs#maintenancemodeuriupdatedevent/index.html) |
| `2024-08-14` | Added the following workspace event types:<br>- [`ViewEnvVarValuesEvent`](/content/docs/audit-logs#viewenvvarvaluesevent/index.html)<br>- [`ViewConnectionInfoEvent`](/content/docs/audit-logs#viewconnectioninfoevent-1/index.html) (Render Postgres)<br>- [`ViewConnectionInfoEvent`](/content/docs/audit-logs#viewconnectioninfoevent-1/index.html) (Render Key Value) |
| `2024-06-24` | Added initial set of [Workspace events](/content/docs/audit-logs#workspace-events/index.html).

Copy page