Audit logs require administrator permissions.
Retool automatically logs user actions, such as query runs and password resets. The logs include the user's name, the action taken, and when the action took place.
You can access audit logs from either:
- The User menu on the top-right when browsing your organization.
- The Retool menu on the top-left of the App editor.
By default, Retool captures the following events in the audit log:
|Action||Identifier in logs|
|User logs in|
|User logs out|
|User signs up|
|User redeems an invite|
|User invites another user|
|User re-sends invite|
|User runs a query in the Query Library|
|User disables two-factor authentication|
|User requests a password reset link|
|User requests passwordless login|
|User confirms a password reset request|
|User creates a group|
|User updates a group|
|User deletes a group|
|User adds other users to a group|
|User removes other users from a group|
|User disables another user|
|User enables another user|
|User updates an organization|
|User creates a resource|
|User updates a resource|
|User deletes a resource|
|User exports a page|
|User creates a workflow|
|User deletes a workflow|
|User releases a workflow|
|User enables a workflow|
|User disables a workflow|
To access the audit log, visit
/audit. You can see a list of all the events, the user who performed them, and the time. You can also explore more detailed information, including the exact query, the parameters passed, the user's IP address, or response time.
Audit logs for Retool Cloud organizations are retained for one year. Self-hosted deployments manage their own audit log retention.
Hide query data from logs
You can hide parameters from logs on a per-query basis. See documentation on queries for more details.
To prevent all headers in queries from getting added to audit logs, enable the
HIDE_ALL_HEADERS_IN_AUDIT_LOG_EVENTS environment variable. This is only available on self-hosted deployments.
Access audit logs in SQL or stdout
Access to the audit logs SQL table and
stdout are only available on self-hosted deployments. If you're interested in a self-hosted deployment, reach out for a demo.
Self-hosted Retool deployments can use SQL to query the audit logs database table or output audit log events to
Query audit logs in SQL
Retool logs events to the
audit_trail_events table in the Retool Postgres database. This table's schema contains the following columns.
|The type of action taken. See Logged events for possible values.|
|The ID of the user taking the action.|
|The IP address of the user taking the action.|
|The response time of the action, in milliseconds.|
|The name of the app, module, workflow, or page on which the action was taken.|
|For query actions, the name of the query.|
|For actions on resources, the name of the resource.|
|Additional data about the action.|
You can join the
audit_trail_events table with the
users table to learn more details about the users who performed actions. For example, the following query returns records of groups created and the user who created each group.
u.email, u."userName", a."actionType", a.metadata
join users u on a."userId" = u.id
where a."actionType" = 'CREATE_GROUP';