Audit log events | EmailGuard

EmailGuard

Use this page as a lookup when you see an action in Team → Security or Account → Security. Labels in the UI use spaces; the tables below list the underlying names for clarity.

For how to open the logs and read columns, see Audit log in Documentation.

Team audit log events

Recorded for the active team. Visible to Owner and Admin under Team → Security.

Team & membership

Action	Description
`TEAM_CREATED`	A new team workspace was created.
`TEAM_UPDATED`	Team profile fields (such as name) were changed.
`TEAM_SETTINGS_UPDATED`	Team settings were updated (for example directory sync options).
`TEAM_MEMBER_INVITED`	Someone was invited to join the team.
`TEAM_MEMBER_INVITE_CANCELED`	A pending invitation was canceled.
`TEAM_MEMBER_INVITE_ACCEPTED`	An invitee accepted and joined the team.
`TEAM_MEMBER_INVITE_DECLINED`	An invitee declined the invitation.
`TEAM_MEMBER_UPDATED`	A member’s role or membership details were changed.
`TEAM_MEMBER_REMOVED`	A member was removed by an admin.
`TEAM_MEMBER_LEFT`	A member left the team on their own.
`TEAM_MEMBER_SYNCED`	Members were synced from a linked directory (automated job).

API keys

Action	Description
`API_KEY_CREATED`	A new API key was created.
`API_KEY_UPDATED`	An API key’s name or scopes were changed.
`API_KEY_ROLLED`	An API key’s secret was rotated.
`API_KEY_REVOKED`	An API key was revoked and can no longer be used.

Notifications

Action	Description
`NOTIFICATION_CHANNEL_CREATED`	A notification channel (email, webhook, etc.) was added.
`NOTIFICATION_CHANNEL_UPDATED`	A channel’s configuration was changed.
`NOTIFICATION_CHANNEL_DELETED`	A channel was removed.
`NOTIFICATION_CHANNEL_VERIFIED`	A channel was marked verified (email link, webhook test, or system verification).
`NOTIFICATION_RULE_CREATED`	A notification rule was created.
`NOTIFICATION_RULE_UPDATED`	A notification rule was changed.
`NOTIFICATION_RULE_DELETED`	A notification rule was deleted.

Billing

Action	Description
`SUBSCRIPTION_CREATED`	A subscription or checkout flow created billing for the team.
`SUBSCRIPTION_STARTED`	A paid subscription became active.
`SUBSCRIPTION_UPDATED`	Subscription plan or billing details changed.
`SUBSCRIPTION_CANCELED`	A subscription was canceled.

Public API

Action	Description
`API_REQUEST`	A successful `/api/v1` request authenticated with a team API key. Metadata usually includes `method`, `path`, `status`, and `api_key_id`.

Personal audit log events

Recorded for your user account. Visible under Account → Security when you are signed in.

Action	Description
`REGISTERED`	Account created with email and password.
`REGISTERED_VIA_OAUTH`	Account created through an OAuth provider.
`REGISTERED_FAILED`	A registration attempt failed.
`LOGIN_SUCCESS`	Successful sign-in with email and password.
`LOGIN_VIA_OAUTH`	Successful sign-in through an OAuth provider.
`LOGIN_FAILED`	A sign-in attempt failed (wrong credentials or similar).

Profile & email

Action	Description
`USER_UPDATED`	Profile details were updated.
`RESEND_EMAIL_VERIFICATION`	A verification email was resent.
`EMAIL_VERIFIED`	The account email address was verified.
`CHANGE_EMAIL_REQUEST`	A request to change the account email was started.
`CHANGE_EMAIL_SUCCESS`	The account email was changed successfully.

Password

Action	Description
`PASSWORD_RESET_REQUEST`	A password reset was requested.
`PASSWORD_RESET_SUCCESS`	Password was reset via reset flow.
`PASSWORD_CHANGED`	Password was changed while signed in.

Multi-factor authentication (MFA)

Action	Description
`MFA_SETUP_STARTED`	MFA enrollment was started.
`MFA_ENABLED`	MFA was turned on for the account.
`MFA_DISABLED`	MFA was turned off.
`MFA_NOT_FOUND`	MFA operation referenced missing MFA setup.
`MFA_CODE_SUCCESS`	A valid MFA code was submitted.
`MFA_CODE_FAILED`	An invalid MFA code was submitted.
`MFA_RECOVERY_CODE_GENERATED`	New MFA recovery codes were generated.
`MFA_RECOVERY_CODE_SUCCESS`	Sign-in succeeded using a recovery code.
`MFA_RECOVERY_CODE_FAILED`	Recovery code verification failed.

Teams (personal view)

Action	Description
`ACCEPTED_TEAM_INVITE`	You accepted an invitation and joined a team.
`DECLINED_TEAM_INVITE`	You declined a team invitation.
`LEFT_TEAM`	You left a team you belonged to.

Admin-driven invite, role, or removal events for other users appear in the team audit log, not here.

Common metadata fields

Field	Appears on	Meaning
`actioned_by`	Most team events	Email of the user who performed the action
`user_id`	Team events	Internal ID of that user
`api_key_id`	API keys, some API requests	Key involved in the action
`channel_id` / `rule_id`	Notifications	Channel or rule affected
`method` / `path` / `status`	`API_REQUEST`	HTTP details for the API call

Audit log — where to find logs and how to read the table
Team roles and permissions