Audit Logs
An audit log feature provided by WorkOS for recording security events such as authentication and membership changes, supporting compliance audit trails and designed according to append-only, tamper-proof principles.
Core Facts
Timeline (last 90 days)
WorkOS's Audit Logs feature now automatically records user sign-in sessions and membership changes events.
Automatic capture covers only two types of events, sign-in sessions and membership changes; other custom business operations still require developers to actively report them via the Audit Logs API.
If an application has its own membership management entry point independent of the IdP, those membership changes will not automatically enter the WorkOS audit log.
This automatic capture is not retroactive; events that occurred before it was enabled will not be backfilled.
Audit logs are used to record operation history and are commonly used for security review, troubleshooting, and compliance certifications such as SOC 2 and ISO 27001.
Agent activity is listed separately as an audit subject, reflecting the platform's emphasis on Agent observability.
Enterprise account administrators can use the expanded event history for three core scenarios: compliance reviews, security investigations, and operational troubleshooting.
The audit log expansion spans multiple core domains including projects, workspaces, deployments, account security, SSO and SCIM, connectors, secrets, and Agent activity.
The enterprise-tier platform's audit logs have added coverage of more than 65 event types.
WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.
All Facts (10)
WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.
65%UnverifiedAutomatic capture covers only two types of events, sign-in sessions and membership changes; other custom business operations still require developers to actively report them via the Audit Logs API.
50%UnverifiedThis automatic capture is not retroactive; events that occurred before it was enabled will not be backfilled.
50%UnverifiedIf an application has its own membership management entry point independent of the IdP, those membership changes will not automatically enter the WorkOS audit log.
50%UnverifiedAudit logs are used to record operation history and are commonly used for security review, troubleshooting, and compliance certifications such as SOC 2 and ISO 27001.
50%UnverifiedAgent activity is listed separately as an audit subject, reflecting the platform's emphasis on Agent observability.
50%UnverifiedThe audit log expansion spans multiple core domains including projects, workspaces, deployments, account security, SSO and SCIM, connectors, secrets, and Agent activity.
50%UnverifiedEnterprise account administrators can use the expanded event history for three core scenarios: compliance reviews, security investigations, and operational troubleshooting.
50%UnverifiedWorkOS's Audit Logs feature now automatically records user sign-in sessions and membership changes events.
50%UnverifiedThe enterprise-tier platform's audit logs have added coverage of more than 65 event types.
50%