---
source_url: https://www.pubnub.com/docs/security/audit-log
title: Audit log
updated_at: 2026-09-30T07:20:08.000Z
---

# Audit log

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

The Audit Log in the [Admin Portal](https://admin.pubnub.com/) records every configuration action taken across a PubNub organization: who changed an app, keyset, user role, Service Integration, or account setting, and when. It covers actions from the Admin Portal UI, the [Admin API](https://www.pubnub.com/docs/admin-api.md), and OAuth integrations with the [PubNub MCP server](https://www.pubnub.com/docs/ai-development/mcp-server.md).

The PubNub Audit Log shows the full event history on the Starter and Pro plans. On the Free plan, the PubNub Audit Log shows a preview of the 5 most recent events. Only members with the Account Owner or Account Admin role can open the Audit Log. For what each role permits, see [Admin Portal roles](https://www.pubnub.com/docs/security/admin-portal-roles.md).

## What each event records

The Audit Log lists events in a table, from most recent to oldest. Each event records these fields:

| Field | Description |
| --- | --- |
| **Date** | Timestamp of the event. |
| **Initiator** | The user or Service Integration that performed the action. For portal users, this shows the email address and user ID. For Service Integrations, this shows the integration name and ID. |
| **Event type** | The specific action that occurred, for example `KeysetConfigChanged` or `UserRoleAdded`. |
| **Labels** | Identifiers for the affected resources, such as an application or keyset ID. |
| **Payload** | A JSON object with the full details of the change. Its fields differ for each event type. Expand a row to see it. |

For example, the payload of an `AppCreated` event holds the new app's ID, name, status, owner, account, creation time, and properties:

```json
{
  "id": 333,
  "name": "New App",
  "app_id": 333,
  "status": 1,
  "created": "2026-09-09 09:45:28",
  "owner_id": 123,
  "account_id": 123,
  "properties": {
    "stats_channel": "ABCDEFG"
  }
}
```

## Event types

The Audit Log captures events across six categories.

### User activity

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `UserRoleAdded` | A role was assigned to a user. | Yes | N/A |
| `UserRoleRevoked` | A role was removed from a user. | Yes | N/A |
| `UserAccountAccessGranted` | A user was granted access to the account. | Yes | N/A |
| `UserAccountAccessRevoked` | A user's access to the account was revoked. | Yes | N/A |
| `UserAcceptedInvitation` | A user accepted an invitation to join the account. | Yes | N/A |

### App management

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `AppCreated` | A new app was created. | No | Yes |
| `AppRenamed` | An app was renamed. | No | Yes |
| `AppDisabled` | An app was disabled. | No | Yes |
| `AppChanged` | An app attribute was changed. Catch-all for changes not covered by other app events. | No | Yes |

### Keyset management

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `KeysetCreated` | A new keyset was created. | No | Yes |
| `KeysetRenamed` | A keyset was renamed. | No | Yes |
| `KeysetDisabled` | A keyset was disabled. | No | Yes |
| `KeysetEnabled` | A keyset was enabled. | No | Yes |
| `KeysetTypeChanged` | A keyset type was changed between testing and production. | Yes | Yes |
| `KeysetConfigChanged` | A keyset configuration was updated, for example enabling [Access Manager](https://www.pubnub.com/docs/security/access-control/overview.md) or changing persistence settings. | Yes | Yes |
| `SecretKeyRotated` | A keyset's [secret key](https://www.pubnub.com/docs/security/access-control/initialize-server-sdk.md#secret-key-rotation) was rotated. Secret key values are redacted in the payload. | No | Yes |

### Service Integrations

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `ServiceIntegrationCreated` | A new [Service Integration](https://www.pubnub.com/docs/admin-api.md) was created. | Yes | N/A |
| `ServiceIntegrationUpdated` | A Service Integration was updated. | Yes | N/A |
| `ServiceIntegrationDeleted` | A Service Integration was deleted. | Yes | N/A |
| `ApiKeyCreated` | An API key was created for a Service Integration. | Yes | N/A |
| `ApiKeyRevoked` | An API key for a Service Integration was revoked. | Yes | N/A |

### Partner (OEM)

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `OemCustomerCreated` | A [partner customer](https://www.pubnub.com/docs/analytics/decisions/create-entities-as-partner.md) was created. | No | Yes |
| `OemCustomerUpdated` | A partner customer was updated. | No | Yes |
| `OemCustomerKeysetsAssigned` | Keysets were assigned to a partner customer. | No | Yes |

### Account settings

| Event type | Description | Portal UI | Admin API |
| --- | --- | --- | --- |
| `AccountAuthSettingsUpdated` | Account authentication settings were changed, for example MCP access. | Yes | N/A |
| `VersionPinned` | A server version was pinned. | Yes | N/A |

## Related pages

* [Find audit events](https://www.pubnub.com/docs/security/find-audit-events.md). Filter Audit Log results by event type or time range.

Last updated at: 2026-09-30T07:20:08.000Z