Audit log

The Audit Log in the Admin Portal records every configuration action taken across a PubNub organization: who changed an app, keyset, user role, Service Integration, or account setting, and when. It covers actions from the Admin Portal UI, the Admin API, and OAuth integrations with the PubNub MCP server.

The PubNub Audit Log shows the full event history on the Starter and Pro plans. On the Free plan, the PubNub Audit Log shows a preview of the 5 most recent events. Only members with the Account Owner or Account Admin role can open the Audit Log. For what each role permits, see Admin Portal roles.

What each event records

The Audit Log lists events in a table, from most recent to oldest. Each event records these fields:

Field	Description
Date	Timestamp of the event.
Initiator	The user or Service Integration that performed the action. For portal users, this shows the email address and user ID. For Service Integrations, this shows the integration name and ID.
Event type	The specific action that occurred, for example KeysetConfigChanged or UserRoleAdded.
Labels	Identifiers for the affected resources, such as an application or keyset ID.
Payload	A JSON object with the full details of the change. Its fields differ for each event type. Expand a row to see it.

For example, the payload of an AppCreated event holds the new app's ID, name, status, owner, account, creation time, and properties:

{
  "id": 333,
  "name": "New App",
  "app_id": 333,
  "status": 1,
  "created": "2026-09-09 09:45:28",
  "owner_id": 123,
  "account_id": 123,
  "properties": {
    "stats_channel": "ABCDEFG"
  }
}

Event types

The Audit Log captures events across six categories.

User activity

Event type	Description	Portal UI	Admin API
UserRoleAdded	A role was assigned to a user.	Yes	N/A
UserRoleRevoked	A role was removed from a user.	Yes	N/A
UserAccountAccessGranted	A user was granted access to the account.	Yes	N/A
UserAccountAccessRevoked	A user's access to the account was revoked.	Yes	N/A
UserAcceptedInvitation	A user accepted an invitation to join the account.	Yes	N/A

App management

Event type	Description	Portal UI	Admin API
AppCreated	A new app was created.	No	Yes
AppRenamed	An app was renamed.	No	Yes
AppDisabled	An app was disabled.	No	Yes
AppChanged	An app attribute was changed. Catch-all for changes not covered by other app events.	No	Yes

Keyset management

Event type	Description	Portal UI	Admin API
KeysetCreated	A new keyset was created.	No	Yes
KeysetRenamed	A keyset was renamed.	No	Yes
KeysetDisabled	A keyset was disabled.	No	Yes
KeysetEnabled	A keyset was enabled.	No	Yes
KeysetTypeChanged	A keyset type was changed between testing and production.	Yes	Yes
KeysetConfigChanged	A keyset configuration was updated, for example enabling Access Manager or changing persistence settings.	Yes	Yes
SecretKeyRotated	A keyset's secret key was rotated. Secret key values are redacted in the payload.	No	Yes

Service Integrations

Event type	Description	Portal UI	Admin API
ServiceIntegrationCreated	A new Service Integration was created.	Yes	N/A
ServiceIntegrationUpdated	A Service Integration was updated.	Yes	N/A
ServiceIntegrationDeleted	A Service Integration was deleted.	Yes	N/A
ApiKeyCreated	An API key was created for a Service Integration.	Yes	N/A
ApiKeyRevoked	An API key for a Service Integration was revoked.	Yes	N/A

Partner (OEM)

Event type	Description	Portal UI	Admin API
OemCustomerCreated	A partner customer was created.	No	Yes
OemCustomerUpdated	A partner customer was updated.	No	Yes
OemCustomerKeysetsAssigned	Keysets were assigned to a partner customer.	No	Yes

Account settings

Event type	Description	Portal UI	Admin API
AccountAuthSettingsUpdated	Account authentication settings were changed, for example MCP access.	Yes	N/A
VersionPinned	A server version was pinned.	Yes	N/A

Related pages

• Find audit events. Filter Audit Log results by event type or time range.