Skip to content

Audit Logs

Available since

  • v5.5.0 and later

Audit logs record who changed what and when across your Orkes Conductor cluster's configuration and management resources. Use them to investigate unexpected changes, support compliance reviews, and troubleshoot issues caused by a recent update to a workflow, task, secret, or access control setting.

Audit logs capture changes, such as updating a workflow definition or rotating a secret. They do not capture workflow execution data, such as individual workflow or task runs.

Viewing audit logs requires administrator access. Users and applications without administrator permissions cannot view audit log data, even if they have access to the underlying resources.

When to use audit logs

Use audit logs when you need to answer "who changed this, and what did it look like before." Common cases include investigating an unexpected workflow behavior after a definition change, reviewing access control changes for a security audit, and confirming when a secret or environment variable was last rotated.

What gets audited

Audit logs track create, update, and delete actions on the following resource types:

  • EVENT_HANDLER
  • SCHEDULER
  • WORKFLOW_DEF
  • TASK_DEF
  • SECRET
  • APPLICATION
  • USER
  • GROUP
  • TAG
  • ACCESS_KEY
  • ACCESS_ENTRY
  • WEBHOOK
  • HUMAN_TASK_TEMPLATE
  • SCHEMA
  • PROMPT_TEMPLATE
  • ENVIRONMENT_VARIABLE
  • REMOTE_SERVICE
  • INTEGRATION
  • GATEWAY
  • HUMAN_TASK

What's captured for each entry

Each entry captures the following:

{
  "requestTimestamp": 1784723525000,
  "user": "jane.doe@example.com",
  "action": "WRITE",
  "entityType": "WORKFLOW_DEF",
  "entityId": "order_status_lookup",
  "entityState": { "...": "the resource's state at the time of the change" }
}
Field Description
requestTimestamp When the change occurred (epoch milliseconds).
user The user or application that made the change.
action Whether the resource was created/updated (WRITE), or deleted (DELETE).
entityType The type of resource affected, e.g. WORKFLOW_DEF or SECRET. See What gets audited for the full list.
entityId The name or ID of the affected resource.
entityState A snapshot of the resource at the time of the change. If a previous entry exists for the same resource, you can view a side-by-side difference between the two.

Viewing audit logs

To view audit logs from Conductor UI:

  1. Go to Executions > Audit Logs from the left navigation menu on your Conductor cluster.
  2. Use the filters to narrow your search:
    • Resource Type: Filter by a specific resource type, such as WORKFLOW_DEF or SECRET.
    • Resource ID: Filter by the name or ID of a specific resource.
    • User: Filter by the user or application that made the change.
    • Action: Filter by WRITE or DELETE.
    • Date range or Lookback: Limit results to a specific time window. The default lookback window is 30 days.
  3. Use Quick search for a free text search.
  4. Select an entry to view details. If the entry has a resource state and a prior version exists, select View Difference to compare the before and after state side by side.

Viewing change history for a resource

To see every recorded change for a single resource, select its Resource Type and Resource ID from a search result to open its change history. This view lists every audited change to that resource in chronological order, so you can trace how its configuration evolved over time.

Best practices

  • Pair audit logs with RBAC so only administrators can view sensitive change history.
  • Review audit logs regularly after onboarding new team members or applications with write access.
  • Check audit history before rolling back a workflow or task definition, to confirm exactly what changed and when.