Audit trail logged events

By default, Retool captures the following events in the audit log. Refer to the View user audit logs page for more information.

Identifier in logs	Action
`ACCESS_TOKEN_CREATED`	An access token was created.
`ACCESS_TOKEN_REVOKED`	An access token was revoked.
`ADD_PAGE_TO_GROUP`	A page was added to a group.
`ADD_USERS_TO_GROUP`	A user added other users to a group.
`ANALYTICS_CONFIG_CREATED`	An analytics configuration was created.
`ANALYTICS_CONFIG_DELETED`	An analytics configuration was deleted.
`ANALYTICS_CONFIG_UPDATED`	An analytics configuration was updated.
`APP_THEME_CREATED`	An organization-level app theme was created.
`APP_THEME_DELETED`	An organization-level app theme was deleted.
`APP_THEME_SET_DEFAULT`	An organization-level app theme was set as the default.
`APP_THEME_UPDATED`	An organization-level app theme was updated.
`ARCHIVE_ORGANIZATION`	An organization was archived.
`ARCHIVE_USER`	A user account was archived.
`BRANDING_UPDATED`	The organization branding settings were updated.
`CANCEL_USER_TASK`	A user task was cancelled.
`CONFIG_VAR_CREATE`	A configuration variable was created.
`CONFIG_VAR_DELETE`	A configuration variable was deleted.
`CONFIG_VAR_UPDATE`	A configuration variable was updated.
`CONFIRM_PASSWORD_RESET_LINK`	A user confirms a password reset request.
`CREATE_EVENT_WORKFLOW`	An event-based workflow was created.
`CREATE_GROUP`	A user created a group.
`CREATE_RESOURCE`	A user created a resource.
`CREATE_ROLE`	A new role was created.
`CREATE_TRIGGER`	A workflow trigger was created.
`CREATE_USER`	A new user account was created.
`CREATE_USER_TASK`	A user task was created.
`CREATE_WORKFLOW`	A user created a workflow.
`CREATE_WORKFLOW_CUSTOM_URL_PATH`	A custom URL path was created for a workflow.
`DATASOURCE_CREATE`	A new data source was created.
`DELETE_EVENT_WORKFLOW`	An event-based workflow was deleted.
`DELETE_GROUP`	A user deleted a group.
`DELETE_RESOURCE`	A user deleted a resource.
`DELETE_ROLE`	A role was deleted.
`DELETE_TRIGGER`	A workflow trigger was deleted.
`DELETE_USER`	A user account was deleted.
`DELETE_WORKFLOW`	A user deleted a workflow.
`DELETE_WORKFLOW_CUSTOM_URL_PATH`	A custom URL path for a workflow was deleted.
`DELETE_WORKFLOW_RELEASE`	A workflow release was deleted.
`DIRECTLY_SHARE_PAGE_WITH_USER`	A page was directly shared with a user.
`DISABLE_RETOOL_DEFAULT_EMAIL`	The default Retool email notifications were disabled.
`DISABLE_TRIGGER`	A user disabled a workflow trigger.
`DISABLE_TWO_FACTOR_AUTH`	A user disabled two-factor authentication.
`DISABLE_USER`	A user disabled another user.
`DISABLE_WORKFLOW`	A workflow was disabled.
`DOWNLOAD_AUDIT_LOGS`	Audit logs were downloaded.
`ENABLE_TRIGGER`	A user enabled a workflow trigger.
`ENABLE_USER`	A user enabled another user.
`ENABLE_WORKFLOW`	A workflow was enabled.
`FORCE_LOGOUT`	A user’s Retool sessions were terminated via the Retool API (optional IdP logout).
`INVITE_USER`	A user invited another user.
`LOGIN`	A user logged in.
`LOGIN_FAILED`	A user login attempt failed.
`LOGOUT`	A user logged out.
`MODIFY_PERMISSIONS`	Permissions were modified.
`PAGE_EXPORT`	A user exported a page.
`PAGE_VIEW`	Page views.
`PLAYGROUND_QUERY_RUN`	A user ran a query in the Query Library.
`PROTECT_WORKFLOW`	A workflow was protected.
`QUERY_PREVIEW`	Query tests (preview runs).
`QUERY_RUN`	Query runs (executed in production or live context).
`RE_INVITE_USER`	A user re-sent an invite.
`REASSIGN_USER_TASK`	A user task was reassigned.
`REDEEM_INVITE`	A user redeemed an invite.
`REDEPLOY_WORKFLOW_RELEASE`	A workflow release was redeployed.
`RELEASE_WORKFLOW`	A user released a workflow.
`REMOVE_PAGE_FROM_GROUP`	A page was removed from a group.
`REMOVE_TWO_FACTOR_AUTHENTICATOR`	Two-factor authentication device was removed.
`REMOVE_USER_FROM_GROUP`	A user was removed from a group.
`REMOVE_USERS_FROM_GROUP`	A user removed other users from a group.
`REQUEST_PASSWORD_RESET_LINK`	A user requested a password reset link.
`REQUEST_PASSWORDLESS_LOGIN`	A user requested passwordless login.
`REQUEST_PASSWORDLESS_TOKEN`	A passwordless login token was requested.
`RESET_GOOGLE_ID`	A user's Google ID was reset.
`RESET_RETOOLDB_PASSWORD`	The RetoolDB password was reset.
`RETOOL_AI_FEATURE_CHANGED`	A Retool AI feature setting was changed.
`RETOOL_STORAGE_FILE_ACCESSED`	A file in Retool Storage was accessed.
`RETOOL_STORAGE_FILE_DELETED`	A file in Retool Storage was deleted.
`RETOOL_STORAGE_FILE_METADATA_RETRIEVED`	Metadata for a Retool Storage file was retrieved.
`RETOOL_STORAGE_FILE_MOVED`	A file in Retool Storage was moved.
`RETOOL_STORAGE_FILE_UPDATED`	A file in Retool Storage was updated.
`RETOOL_STORAGE_FILE_UPLOADED`	A file was uploaded to Retool Storage.
`RETOOL_STORAGE_FILES_LISTED`	Files in Retool Storage were listed.
`RETOOL_STORAGE_FOLDER_CREATED`	A folder was created in Retool Storage.
`RETOOL_STORAGE_FOLDER_DELETED`	A folder was deleted in Retool Storage.
`RETOOL_STORAGE_FOLDER_RENAMED`	A folder in Retool Storage was renamed.
`RETOOL_STORAGE_FOLDERS_LISTED`	Folders in Retool Storage were listed.
`REVEAL_RETOOLDB_CONNECTION_STRING`	The RetoolDB connection string was revealed.
`REVERT_WORKFLOW`	A workflow was reverted to a previous version.
`ROTATE_WORKFLOW_API_KEY`	A workflow API key was rotated.
`RUN_WORKFLOW`	A workflow was run (manually, via schedule, webhook, or query trigger).
`RUN_WORKFLOW_BLOCK`	A user ran a workflow block manually.
`SEND_MAGIC_LOGIN`	A magic login link was sent.
`SIGN_UP`	A user signed up.
`SOURCE_CONTROL_CONFIG_UPDATE`	Source control configuration was updated.
`SOURCE_CONTROL_DEPLOYMENT_FINISHED`	A source control deployment finished.
`SOURCE_CONTROL_SETTINGS_UPDATE`	Source control settings were updated.
`SUBMIT_USER_TASK`	A user task was submitted.
`SUGGEST_USER`	A user was suggested (e.g., for assignment or sharing).
`UNPROTECT_WORKFLOW`	A workflow was unprotected.
`UPDATE_BILLING_PLAN`	The billing plan was updated.
`UPDATE_GROUP`	A group was updated.
`UPDATE_ORGANIZATION`	A user updated an organization.
`UPDATE_RESOURCE`	A user updated a resource.
`UPDATE_ROLE`	A role was updated.
`UPDATE_TRIGGER`	A workflow trigger was updated.
`UPDATE_WORKFLOW`	A workflow was updated (renamed, or content, description, or metadata changed).
`UPDATE_WORKFLOW_CUSTOM_URL_PATH`	A custom URL path for a workflow was updated.
`USER_CHANGED_EMAIL_AND_VERIFY`	A user changed their email and verified it.
`USER_EMAIL_CHANGE`	A user changed their email address.
`USER_EMAIL_CHANGE_NOTIFICATION_SENT`	Notification sent about a user's email change.
`USER_EMAIL_VERIFICATION_SENT`	Email verification was sent to a user.
`USER_EMAIL_VERIFY`	A user verified their email address.
`USER_NAME_CHANGE`	A user changed their name.
`VERIFY_2FA_FAILURE`	Two-factor authentication verification failed.
`VERIFY_2FA_SUCCESS`	Two-factor authentication verification succeeded.
`VIEW_WORKFLOW`	A user viewed a workflow.