Guides
Audit log
On the hosted service's Enterprise plan, every workspace keeps an audit log: who did what, when and from where. Owners open it from the workspace menu (Audit log). Self-hosted OpenRows doesn't keep one; its activity stays in each record's history and the base's trash.
What is recorded
Each entry has the time, the person (their email when it happened, and whether they used the app, a personal access token, or were OpenRows support), their IP address and browser, what they changed, and a short before and after. Entries never hold passwords, tokens, secrets or the values in your records.
| Activity | Entries |
|---|---|
| Sign-ins | Every sign-in of a member, in each of their workspaces |
| Workspace | Renaming or deleting the workspace |
| Members and invitations | Joining, role changes, removals, invitations sent and revoked, base collaborators added, changed and removed |
| Share links | Links to views and bases created, changed (password, domains, copy and download, embeds, expiry) and revoked |
| Access tokens and webhooks | Personal access tokens created and revoked (their name, prefix and scopes), webhooks created, changed and deleted (the host only) |
| Exports | Table CSV downloads, base exports and audit log exports |
| Deletions | Bases, tables, fields and views deleted, bases restored or deleted permanently |
| Settings | The workspace's AI provider and key changed or removed (never the key) |
| Automations | Automations created, changed (on or off, trigger and steps) and deleted |
| Support access | OpenRows support starting and ending a read-only view of a member's account, with the reason |
Entries can't be changed or deleted by anyone, owners included. They're kept for the plan's retention (365 days on Enterprise) and then removed automatically. When a workspace leaves the Enterprise plan, recording stops and the existing entries are kept for 30 days.
Filter and export
Filter by activity, by a person's email or an item's name or id, and by date. Export CSV and Export JSON download what the filters show (up to 100,000 entries, newest first). The JSON export has one entry per line.
Stream to your SIEM
Under Stream to your SIEM, enter an HTTPS endpoint. Every minute OpenRows sends the new entries, oldest first and up to 100 at a time, as a POST with a JSON body:
{
"workspaceId": "…",
"events": [
{
"id": "…",
"at": "2026-10-29T10:00:00.000Z",
"action": "member.role_change",
"actor": { "kind": "user", "userId": "…", "email": "ada@example.com" },
"ip": "203.0.113.9",
"userAgent": "Mozilla/5.0 …",
"target": { "type": "user", "id": "…", "name": "bob@example.com" },
"summary": { "before": { "role": "editor" }, "after": { "role": "creator" } }
}
]
}
Requests are signed like webhooks: verify X-OpenRows-Signature with the signing secret shown once when you create the stream (or ask for a new one). Answer with a 2xx status. Anything else is retried the next minute with the same batch; after 50 failures in a row the stream turns itself off, and the page shows why. Entry ids sort by time, so a receiver can skip ids it has already stored.