Audit Log Actions

Last updated: September 1, 2026

The audit log records key actions taken in your Ivo workspace so admins can review who did what, and when. This reference explains each action type that may appear in the log, grouped by category. The audit log is available to workspace admins under Settings.

Authentication & Security

Sign-in activity and security-related events.

Action	What it means
`user.login`	Someone signed in (or was blocked from signing in)
`user.logout`	Someone signed out
`user.password.reset_request`	Someone requested a password reset email
`user.password.reset_complete`	Someone completed a password reset
`user.mfa.enable`	Someone turned on two-factor authentication
`user.mfa.verify`	Someone completed a two-factor challenge
`user.mfa.disable`	Someone turned off two-factor authentication
`security.access.denied`	Someone was blocked from accessing something
`security.access.lockout`	Account locked out (too many failed attempts)
`security.ip_whitelist_updated`	The list of allowed IP addresses was changed

User & Workspace Management

Changes to workspace membership, roles, settings, and SSO.

Action	What it means
`admin.user.invited`	New members were added to the workspace
`admin.user.removed`	A member was removed from the workspace
`admin.user.updated`	A member's role or permissions were changed
`admin.config.updated`	Workspace settings were changed (e.g. name, support access)
`admin.sso.provider.created`	SSO (single sign-on) was set up
`admin.sso.provider.updated`	SSO settings were changed
`admin.service_account.created`	A service account was created
`admin.service_account.deleted`	A service account was deleted
`admin.service_account.updated`	A service account was updated

Contracts / Repository

Changes to contracts stored in your Rooms.

Action	What it means
Delete contracts	Contracts were deleted from a Room
Move contracts	Contracts were moved between Rooms

Playbooks

Creation, edits, and access events for playbooks and their contents.

Action	What it means
`data.playbook.created`	A playbook was created
`data.playbook.updated`	A playbook was edited or saved
`data.playbook.deleted`	A playbook was deleted
`data.playbook.imported`	A playbook was imported (e.g. from Excel)
`data.playbook.exported`	A playbook was exported
`data.playbook.read`	A playbook was opened or viewed
`data.playbook_checklist_item.created`	A checklist item was added to a playbook
`data.playbook_checklist_item.updated`	A checklist item was edited
`data.playbook_checklist_item.deleted`	A checklist item was removed
`data.playbook_checklist_item.read`	A checklist item was viewed
`data.playbook_clause.created`	A clause was added to a playbook
`data.playbook_clause.updated`	A clause was edited
`data.playbook_clause.deleted`	A clause was removed from a playbook
`data.playbook_clause.read`	A clause was viewed

Teams

Changes to teams in the workspace.

Action	What it means
`data.team.deleted`	A team was deleted

API Keys

Creation and deletion of API keys.

Action	What it means
`api_key.ivo_connect.created`	An Ivo Connect API key was created
`api_key.ivo_connect.deleted`	An Ivo Connect API key was deleted
`api_key.personal.created`	A personal API key was created
`api_key.personal.deleted`	A personal API key was deleted

Integrations

Connection and sync events for Salesforce and Google Drive.

Action	What it means
`integration.sfdc.connected`	Salesforce was connected
`integration.sfdc.disconnected`	Salesforce was disconnected
`integration.sfdc.sync_connected`	A Salesforce sync was set up
`integration.sfdc.sync_disconnected`	A Salesforce sync was removed
`integration.sfdc.import_started`	A Salesforce import was started
`integration.gdrive.connected`	Google Drive was connected
`integration.gdrive.disconnected`	Google Drive was disconnected
`integration.gdrive.sync_connected`	A Google Drive sync was set up
`integration.gdrive.sync_disconnected`	A Google Drive sync was removed
`integration.gdrive.import_started`	A Google Drive import was started

Webhooks

Webhook test events.

Action	What it means
`webhook.test`	A test webhook was sent