Use the audit log to review your account activity

The audit log is a record of the events that happen in your Zapier account, such as a member creating a Zap, changing an app connection, or updating a group. Each entry shows who performed the event, what they did, and when. You can review these entries in the Admin Center and filter them to find what you need.

To send these events to your own endpoint as they happen, use log streams (Enterprise only). To learn how the two features differ, go to Understanding the audit log and log streams.

Available on plans:

Free

Professional

Team

Enterprise

Before you begin

• In Team accounts, you must be the owner of your account.
• In Enterprise accounts, you must be a super admin or owner.

View account activity

To open the Audit log page:

1. Click Admin Center in the main left sidebar. You will be redirected to a new page.
2. In the Insights section of the Admin Center sidebar, click Audit log. You will be redirected to that page.

The page contains a table of log entries. Each log entry includes the following information:

• Event type: a summary of the account activity that was performed.
• Object (optional): if the event involved a specific asset, like a Zap or MCP server, a record of which asset was used.
• Performed by: the actor who performed the event. When Zapier performs the event, the performer is “Zapier System”.
• Date: the timestamp when the event occurred.
• IP address (optional): the IP address the event came from. Not all events will include an IP address.

Review event details

Click an event to open a side panel with its details. The side panel includes one or more of the following data, depending on the event:

• Affected object: the asset the event applies to.
• What changed: the value that changed, for events that change a value.
• Performed by: the member's name, email, and role.
• Date: when the event occurred.
• IP address: the IP address the event came from. This field is blank for some events.
• Event data: the full event in JSON format. This is the same data that log streams send to your endpoint.

Audit log events use a shared schema that tracks who performed an event, where it occurred, what was affected, and when it happened.

    {
  "version": "1.1.0",
  "event_id": "3564c9da-b3a5-43d3-b671-ef19f5eccf03",
  "actor": {
    "id": "01009a9b-a5a4-85b4-b5a9-e94998489e2b",
    "type": "user",
    "email": "jane.doe@example.com",
    "first_name": "Jane",
    "last_name": "Doe"
  },
  "where": {
    "id": "03d62d5d-26e7-87b2-a4c6-967869a8be1a",
    "type": "account"
  },
  "when": {
    "timestamp": "2025-08-26T09:52:50.625Z",
    "timestamp_ms": 1756201970625
  },
  "what": {
    "action": "zap.created",
    "name": "Zap created"
  },
  "affected_object": {
    "id": "00000000-0000-c000-8000-000293850453",
    "type": "zap",
    "name": "(Copy) mindesign webinar - 5 min before"
  },
  "context": {
    "app_name": "Zoom",
    "app_version": "2.25.0"
  }
}

Change events

When an ownership change event occurs (such as zap.owner_changed, app_connection.owner_changed, or variable.owner_changed), the payload includes an additional what_changed object that describes the transition:

    {
  "version": "1.1.0",
  "actor": {
    "id": "014ed0bb-cd81-82bc-a951-a00906b04e70",
    "type": "user",
    "email": "jane.doe@example.com",
    "first_name": "Jane",
    "last_name": "Doe"
  },
  "where": {
    "id": "0331f89b-ac40-8bdf-8ed8-af90110062d1",
    "type": "account"
  },
  "what": {
    "action": "zap.owner_changed",
    "name": "Zap owner changed"
  },
  "affected_object": {
    "id": "00000000-0000-c000-8000-000366644697",
    "type": "zap",
    "name": "Marketing AI Agent #1 — Customer feedback triage"
  },
  "what_changed": {
    "change_type": "previous_value new_value",
    "object": {
      "previous_value": {
        "id": "014ed0bb-cd81-82bc-a951-a00906b04e70",
        "type": "user"
      },
      "new_value": {
        "id": "015a0266-b8e0-89f6-b1ca-f20efd684448",
        "type": "user"
      }
    },
    "scalar": null
  },
  "context": {
    "ip_address": "203.0.113.7"
  },
  "when": {
    "timestamp": "2026-06-01T16:03:58.069Z",
    "timestamp_ms": 1780329838069
  }
}

Payload fields

The following table describes each field in the audit log event payload.

Filter events

Filter the audit log to narrow the list to the events you need. For example, you can review everything that happened to one Zap, or everything one member did. By default, the audit log displays the last 30 days of events.

You can filter by event type, object, the member or system that performed the event, date, and details in the event data. To review the events that you can filter by, go to the event types section.

You can filter from the input box at the top of the page:

1. Click either the Filter audit log events input box or the Filters button. A dropdown menu will open below the input box.
2. Select a filter category. The dropdown menu will reload new options specific to the filter category you selected.
3. Select the checkbox next to each filter.

To change the date filter:

1. Click the Date button. A dropdown menu will open.
2. Use the calendars in the dropdown menu to select a new date range.
3. Click Done.

To change the time range, click the Date filter.

You can also filter from the sidebar of a specific log:

1. On the audit log page, select a log. The right sidebar will open.
2. In the Event data section, hover over an event in the JSON. A filter icon will appear next to the event.
3. Click the filter icon. The page will reload and the sidebar will close.

The input box at the top of the page will load the filter you selected in the sidebar and the logs will be filtered accordingly.

Event types

The audit log records the events in the following tables. Each event has an event name and an event key. The event name is the readable name shown in Zapier, such as Zap created. The event key is a short code for the same event, such as zap.created. Zapier includes the event key in the event data, so your endpoint can tell which event it received. Log streams send these same events to your own endpoint. Log streams also support Zap execution events, which are not in the audit log.

Select a category to review its events.

Limitations

• In Team accounts, you have access to the past 6 months of account activity.
• In Enterprise accounts, you have access to the past 12 months of account activity.
• The filter field looks up filter names, not events.
• Some lines in the side panel do not have a filter icon. For example, you can filter by a member's user ID, but not by their name.
• You cannot filter by timestamp. Use the date filter instead.

To learn how the audit log and log streams differ, go to Understanding the audit log and log streams.

Learn more about the Audit Log in the Zapier Community.