Audit log

Audit logs give you information about events that happen across your organization’s workspaces, as well as who took specific actions and when. Where available, the IP address is also included.

By default, all events are shown in reverse chronological order. You can use the filters at the top of the audit log to narrow down events by date, person, event type, or related activity.

Audit log events may take some time to appear after an action takes place. If you need to see events in real-time, use the custom SIEM integration, which streams events as they occur.

Notion has an organization audit log, where you can view events for your entire organization. You can also filter down to only events for a single workspace.

To see your organization audit log:

1. Open the workspace switcher and select Manage organization. You may need to Set up organization first if you haven’t already. Learn more by reading Organization level controls.

2. Select the Data & Compliance tab.

3. Find and select Audit log.

Each workplace has it’s own workspace audit log, which can be accessed from the workspace settings.

To access a workspace audit log:

1. Select the workspace name, then select Settings.

2. Select Audit log.

The following filters are available at the top of the audit log:

1. Organization (organization audit log only): View events for only one workspace or for your entire organization. When you choose Organization, the Event filter shows organization events instead of workspace events.

2. Date: Filter events to a specific date or date range. Audit log history is retained for up to 365 days, so you can select any range within the past year.

3. Person or agent: Filter by the user, integration, or agent that performed the action. Users who have since been removed from the workspace are still searchable and shown with a Removed label.

4. Event: Filter by one or more event types. Events are organized by category (page, data source, teamspace, workspace, account, form, and workers). You can also use the workspace picker at the top of the audit log to view one workspace or your whole organization. When you choose Organization, the Event filter shows organization events instead of workspace events.

5. Related: Filter for events that were triggered by the same underlying action. Some workspace changes generate a group of related events: for example, moving a page may log both a page moved event and a permission update. To filter for related events, hover over any audit log row and select the magnifying glass icon.

To inspect individual audit log events to see if they are part of a group, hover over the audit log row and select the magnifying glass to filter for related events.

You can use Notion’s custom SIEM integration to send a continuous stream of audit log events to your SIEM platform in real-time via webhooks. This includes all of the same audit log event types, except for organization events.

To set up the custom SIEM integration:

1. Open the workspace switcher and select the Settings button.

2. Go to the Connections tab and select Custom SIEM integration. You may need to use the search bar or select See all for this option to appear.

3. Select the Connect button, then enter your webhook URL into the Webhook URL field. You can retrieve this from within your SIEM account settings.

4. Select the Connect button to finish the process. All events in the audit log are sent in real-time to your SIEM endpoint as JSON payloads.

What to know:

• Single webhook per workspace: Only one custom SIEM webhook can be configured per workspace at a time.

• Retry behavior: If your endpoint fails to receive an event, Notion will retry up to seven times over approximately 24 hours.

• No page content: Event payloads include metadata (who did what, when, from where), but do not include the content of pages.

• No syslog support: Webhooks only; syslog is not supported.

• No organization events: the stream only includes workspace events. Organization events, like changes to organization settings or admin roles, only appear in the audit log in Notion when organization is selected.

For partner-specific SIEM setup instructions (Datadog, Panther, Splunk, Sumo Logic), see Add security & compliance connections →

Events are split into the following categories:

1. Page events: This includes events about a single Notion page.

2. Workspace events: This includes events about an entire Notion workspace, including Workers paused and Workers resumed.

3. Workers events: This includes events about Notion Workers in your workspace.

4. Account events: This includes events about accounts of users in the workspace.

5. Teamspace events: This includes events users take on one or more teamspaces.

6. Form events: This includes events about forms connected to a database.

7. Data source events: This includes events about data sources in a database.

8. Organization events (organization event log only): This includes events about your whole organization, like organization settings, security, and admin roles. To see these, choose Organization in the workspace picker at the top of the audit log.

• Page edited: That a user, an integration, or an external AI tool edited the content of a page.

• Page property edited: That a user, an integration, or an external AI tool edited a page's property, like a page title or a database property.

• Page viewed: That a user viewed a page or an integration or external AI tool read page data.

• Page created: That a user, an integration, or an external AI tool created a new page or database.

• Page moved to trash: That a user or an integration moved a page to Trash.

• Page deleted from trash: That a user deleted a page from Trash.

• Page permanently deleted: That a page was permanently removed from Trash. This can be done by a user, but it can also be done automatically by Notion after 30 days, or within a custom time frame on Enterprise Plans.

• Page restored: That a user or an integration restored a formerly deleted page from Trash.

• Page exported: That a user exported a page.

• Page moved: That a user, an integration, or an external AI tool moved a page.

• Page permission update: That a member or guest’s page permissions were updated.

• Page shared to web: That a user enabled sharing (or disabled sharing) a page to the web.

• File uploaded: That a user or an integration uploaded a file.

• File downloaded: That a user opened or downloaded file name from a certain page.

• Private content transferred: That the private pages of a user who left the workspace were transferred to a current user. Learn more by reading Transfer content from a deprovisioned user.

• Automation created: That a user created a new automation.

• Automation edited: That a user edited an automation.

• Comment added: That a user added a new comment on a page.

• Comment updated: That a user or an integration edited a comment.

• Comment deleted: That a user or an integration deleted a comment.

• Comments read: That an external AI tool read comments from a page.

• Page suggestion created: That a user suggested an edit in a page.

• Page suggestion accepted: That a user accepted a suggested edit in a page.

• Page suggestion rejected: That a user rejected a suggested edit in a page.

• Page suggestion comment created: That a user added a comment on a suggested edit in a page.

• Page suggestion comment updated: That a user updated a comment on a suggested edit in a page.

• Page suggestion comment deleted: That a user deleted a comment on a suggested edit in a page.

• Page locked: That a user or an integration locked a page.

• Page unlocked: That a user or an integration unlocked a page.

• Downloaded audio recording from AI Meeting Notes block in {page name}: That a user downloaded audio recording from an AI Meeting Notes block.

• Started initial transcription for AI Meeting Notes block: That a user has started an AI Meeting Notes transcription.

• Deleted transcription from transcription block in {page name}: That a transcript for AI Meeting Notes has been permanently deleted based on workspace settings.

For page events, workspace owners can also view the audience or visibility level of each target page.

To see the audience, hover over the page-related audit log event. The audience captured in the audit log will be one of the following:

• Private: page is not shared with other users.

• Shared internally: page is shared with other members of the workspace only.

• Shared externally: page is shared with one or more guests outside of the workspace and/or with an integration bot.

• Shared to web: Page is published to the web.

Page event audience will also export as a column in CSV exports.

• Member invited: That a workspace owner or Membership admin invited a user to the workspace.

  • The new user's role will be specified as Workspace owner if they are invited as an workspace owner, or as Membership admin if they are invited as a membership admin.

• Member joined: That a user has joined the workspace.

• Member role updated: That a workspace owner has updated a user’s role.

• Member removed: That a workspace owner or membership admin has removed a user from the workspace.

• Guest removed: That a guest has been removed from a workspace.

• Guest invite request created: That a guest invite to a page has been requested for approval by workspace owner.

• Invite link toggled: That a user either enabled or disabled the invite link.

• Invite link reset: That a user has reset an invite link.

• Workspace name changed: That a user updated the workspace’s name.

• Workspace icon changed: That the workspace icon has been changed.

• Workspace domain changed: That the domain of a workspace is changed.

• Page access requests toggled: That a user has enabled or disabled page access requests from non-workspace-members.

• Public page sharing toggled: That a workspace owner has switched public page sharing on/off.

• Workspace sidebar editing toggled: That a workspace owner has enabled or disabled the ability for users to change the Workspace sidebar.

• Disable guests toggled: That a workspace owner has enabled or disabled the ability to add guests to a workspace.

• Pages to other workspaces toggled: That a workspace owner has either disabled or enabled moving pages to other workspaces.

• Export toggled: That a workspace owner has disabled or enabled exporting.

• Workspace content exported: That a user has exported content from a page or the entire workspace.

• Integration installation toggled: That a workspace owner has disabled or enabled integrations restrictions.

• Integration created: That a new integration has been added to a workspace.

• Integration deleted: That an integration has been deleted.

• Integration secret reset: That an integration's secret token has been refreshed.

• Integration settings updated: That an integration's basic settings, like its name or icon, have been changed.

• Integration permission updated: That an integration's capabilities (reading content, inserting a comment, etc.) have been changed.

• Added allowed email domain: That the user added an allowed email domain to the workspace.

• Removed allowed email domain: That the user removed an allowed email domain from a workspace.

• Public home page set: That a workspace owner has changed public home page.

• Public home page link cleared: That a workspace owner has cleared public home page.

• SCIM token generated: That a workspace owner generated a SCIM API token.

• SCIM token revoked: That a workspace owner revoked a SCIM API token.

• IdP metadata URL updated: That a workspace owner has set or updated the IdP metadata URL.

• IdP metadata XML updated: That a workspace owner has updated the IdP metadata XML.

• IdP metadata XMP removed: That a workspace owner has removed IdP metadata XML.

• Toggled enable SAML for all spaces in the organization: That an organization owner has disabled or enabled SAML.

• Toggled enforce SAML for all spaces in the organization: That an organization owner has disabled or enabled Enforce SAML.

• Auto-create accounts on sign-in toggled: That a workspace owner has enabled automatically creating accounts on sign-in.

• Workspace creation setting updated: That a workspace owner has restricted creation of new workspaces by users with the claimed enterprise email domain.

• Group created: That a new group is created.

• Group deleted: That a group is deleted.

• Group name changed: That a group name has been changed.

• Member added to group: That a workspace owner or membership admin has added a user to a group.

• Member removed from group: That a workspace owner or membership admin has removed a user from a group.

• Claimable workspace transfer status change: That the status of ownership transfer on a claimable workspace has changed.

• Claimable workspace upgrade status change: That the status of a claim and upgrade to Enterprise of a claimable workspace has changed.

• Claimable workspace deletion status change: That the status of workspace deletion of a claimable workspace has changed.

• Membership request toggled: That a user has enabled or disabled new workspace membership requests.

• Membership request resolved: That a user has resolved a workspace membership request.

• Audit Log exported: That the user exported the audit log.

• User Analytics exported: The the user exported the User Analytics table of Workspace Analytics.

• Content Analytics exported: That the user exported the Content Analytics table of Workspace Analytics.

• Workspace analytics tracking toggled: That the user enabled or disabled workspace analytics within the workspace.

• Workers paused: That a workspace admin or Notion admin paused workers for the workspace.

• Workers resumed: That a workspace admin or Notion admin resumed workers for the workspace.

• Content search queried: That a workspace owner, an integration, or an external AI tool used the content search functionality to find workspace content.

• Content search results exported: That a workspace owner has exported the results from a content search query.

• Notion AI toggled for workspace: That the user has enabled or disabled Notion AI in a workspace.

• Workspace consolidation started: A Notion employee has initiated workspace consolidation from this source or to this target workspace.

• Workspace consolidation completed: The source or target workspace has finished consolidation.

• Workspace consolidation failed: That workspace consolidation has failed for the source or target workspace.

• User suspended: That an admin has suspended a managed user account.

• User unsuspended: That an admin has unsuspended a managed user account.

• Log out all managed users: That an admin has logged out every managed user account.

• Log out one managed user: That an admin has logged out a single managed user account.

• Clear password for all managed users: That an admin has cleared all managed user accounts' passwords.

• Clear password for one managed user: That an admin has cleared a single managed user account's password.

• Integration added to approved connections: That an integration was added to the workspace’s list of approved connections.

• Integration removed from approved connections: That an integration was removed from the workspace’s list of approved connections.

• HIPAA compliance enabled: That a workspace owner has enabled HIPAA compliance by accepting Notion’s Business Associate Agreement.

• HIPAA compliance disabled: That a workspace owner has disabled HIPAA compliance.

• Custom emoji created: That a custom emoji was created.

• Custom emoji updated: That a custom emoji was updated.

• Custom emoji deleted: That a custom emoji was deleted.

• User information read: That an integration or external AI tool read user information from the workspace.

• MCP server connected: That an external AI tool was connected to the workspace.

• MCP allowlist disabled: That a workspace owner disabled the MCP allowlist.

• External AI tool name changed: That a user changed the name of an external MCP AI tool.

• MCP allowlist enabled: That a workspace owner enabled the MCP allowlist.

• MCP client added to allowlist: That a workspace owner added an external AI tool to the allowlist.

• Team information read: That an external AI tool read team information from the workspace.

• MCP client removed from allowlist: That a workspace owner removed an integration or external AI tool from the allowlist.

• Worker created: That a user created a new worker.

• Worker renamed: That a user renamed a worker.

• Worker deleted: That a user deleted a worker.

• Worker enabled: That a user enabled a worker.

• Worker disabled: That an admin or workspace owner disabled a worker.

• Worker deployment succeeded: That a user successfully deployed a worker.

• Worker deployment failed: That a user’s deployment of a worker failed.

• Worker run completed: That a run of a worker completed after being triggered manually, by an automation, by a sync, by a webhook, or by a custom agent.

• Worker run failed: That a run of a worker failed after being triggered manually, by an automation, by a sync, by a webhook, or by a custom agent.

• Worker secret upserted: That a user created or updated a worker secret.

• Worker secret deleted: That a user deleted a worker secret.

• Worker environment pulled: That configured environment variables were pulled for a worker.

• Worker access granted: That a user granted someone access to a worker.

• Worker access role updated: That a user updated someone’s access role for a worker.

• Worker access revoked: That a user revoked someone’s access to a worker.

• Login: When and from where a user has logged in.

• Logout: When and from where a user has logged out.

• Password set: That a user created a password.

• Password cleared: That a user cleared their password.

• Password changed: That a user changed their password.

• MFA SMS toggled: That a user updated their MFA via SMS text messages settings. Learn more here

• MFA TOTP toggled: That a user updated their MFA via a TOTP (time-sensitive one time passcode) app. Learn more here

• MFA backup code toggled: That a user updated their MFA backup code settings.

• Email changed: That the email of a user was changed.

• Picture changed: The the profile photo of the user was changed.

• User deleted: That a specific user account has been deleted.

• Granted support access: That a user’s account was granted Notion support access.

• Revoked support access: That a user’s account was revoked Notion support access.

• Preferred name changed: That a user has updated their account's preferred name.

• Authorized via Workspace SAML: Verified workspace access via SAML SSO.

• Member added to teamspace: That a user added another user to the teamspace. Will specify “as Teamspace owner” if user is invited as a teamspace owner.

• Member removed from teamspace: That a teamspace owner has removed a teamspace member from the teamspace.

• Group added to teamspace: That a user added a permission group to the teamspace.

• Group removed from teamspace: That a teamspace owner has removed a permission group from the teamspace.

• Member joined the teamspace: That a user joined an open teamspace.

• Member left the teamspace: That a user left a teamspace.

• Teamspace created: That a user created the teamspace.

• Teamspace archived: That a teamspace owner archived a teamspace.

• Teamspace restored: That a teamspace owner restored a teamspace.

• Teamspace name changed: That a user updated the teamspace’s name.

• Teamspace description changed: That the teamspace description has been changed.

• Teamspace icon changed: That the teamspace icon has been changed.

• Teamspace privacy type changed: That a teamspace owner has changed the teamspace privacy type.

• Teamspace default toggled: That a user enabled or disabled a teamspace as a default teamspace.

• Teamspace creation setting toggled: That a user has enabled or disabled the ability for everyone in the workspace to create a teamspace.

• Teamspace Members default page permission updated: That the default page permissions of teamspace members have been changed.

• Everyone in workspace default page permission updated: That the default page permissions of everyone at workspace have been changed.

• Member teamspace role updated: That a has updated a teamspace member’s role in the teamspace.

• Custom permissions updated for a member in the teamspace: That a teamspace owner modified access to a teamspace member. Learn more here

• Custom permissions updated for a group in the teamspace: That a teamspace owner modified access to a group. Learn more here

• Teamspace invite access changed: That a user has updated settings for who can invite teamspace members.

• Teamspace disable guests toggled:  That a teamspace owner has enabled or disabled the ability to add guests to a teamspace.

• Export toggled for teamspace: That a teamspace owner has disabled or enabled exporting for a teamspace.

• Public page sharing toggled for teamspace: That a teamspace owner has switched public page sharing on/off for a teamspace.

• Teamspace sidebar editing toggled: That a teamspace owner has enabled or disabled the ability for users to change the teamspace sidebar section.

• Enabled teamspaces: That a user has enabled the teamspaces feature on a workspace.

• Form response created: That a form response was submitted.

• Form created: That a user created a form.

• Form content updated: That a user updated a form’s content.

• Form viewed: That a user viewed a form.

• Form permission updated: That a user updated a form’s permissions.

• Data source created: That a user, an integration, or an external AI tool created a new data source in a database.

• Data source moved to trash: That a user or an integration moved a data source to Trash.

• Data source deleted from trash: That a user deleted a data source from Trash.

• Data source restored from trash: That a user or an integration restored a formerly deleted data source from Trash.

• Data source moved: That a user moved a data source from one database to another.

• Data source permission rule updated: That a user added, removed, or changed a page-level access rule for a data source.

• Data source permanently deleted: That a data source was permanently removed from Trash. This can be done by a user, but it can also be done automatically by Notion after 30 days, or within a custom time frame on Enterprise Plans.

• Data source schema edited: That a user, integration, or external AI tool added, removed, or changed properties in a data source schema.

These events cover your whole organization instead of a single workspace. They only appear in the organization audit log. To view them, open the workspace picker at the top of the organization audit log and choose Organization.

Organization events aren't sent to your SIEM through the custom SIEM integration.

Organization and membership

• Organization created: That an organization was created.

• Organization name changed: That an organization owner changed the organization's name.

• Organization owner added: That a user was made an organization owner.

• Organization owner removed: That a user's organization owner role was removed.

• Workspace added: That a workspace was added to the organization.

• Workspace removed: That a workspace was removed from the organization.

• Email domain verified: That an email domain was verified for the organization.

• Email domain unverified: That an email domain was removed from the organization's verified domains.

• Domain claim status updated: That the status of a domain claim changed.

Security and sign-in

• SAML settings updated: That an organization owner turned SAML single sign-on on or off for the organization, required it, turned automatic account creation on or off, or updated or removed IdP metadata.

• IP allowlist created, updated, or deleted: That an organization owner changed which IP addresses can access the organization.

• IP restrictions toggled: That IP restrictions were turned on or off, or their enforcement mode was changed.

• Guest sign-in requirement updated: That the extra sign-in step required for guests was changed.

Managed users

• Managed users logged out: That an admin logged out one managed user, or all managed users at once.

• Managed user passwords cleared: That an admin cleared the password for one managed user, or all managed users at once.

• Profile edit setting updated: That an admin changed whether managed users can edit their own profiles.

• External workspace access updated: That an admin changed whether managed users can join workspaces outside the organization.

• Session duration updated: That an admin set or changed how long managed users stay signed in.

• Workspace creation setting updated: That an admin changed whether managed users can create new workspaces, or the region where new workspaces are created.

Organization-wide workspace settings

• Organization default setting updated: That an organization owner changed a setting that applies to every workspace in the organization.

AI provider API keys

• API key created, rotated, or deleted: That an organization owner added, rotated, or deleted an API key for an AI provider.

Legal holds

• Legal hold created: That a legal hold was created.

• Legal hold released: That a legal hold was released.

• Legal hold name updated: That a legal hold was renamed.

• Legal hold member added or removed: That a member was added to or removed from a legal hold.

• Legal hold content exported: That the content covered by a legal hold was exported.

• Legal hold summary exported: That a summary of a legal hold was exported.

Bots

• Organization token created or updated: That an organization token was created or changed.

Admin roles

• Admin role created, updated, or deleted: That an organization owner created, changed, or deleted an admin role.

• Admin role assigned: That an organization owner gave a member an admin role.

• Admin role revoked: That an organization owner removed a member's admin role.

Audit log

• Organization audit log exported: That a user exported the organization audit log.

The audit log records key Custom Agent configuration and access changes so Enterprise admins and security teams can track who created or modified an agent, what it has access to, and how its settings changed over time. These events are categorized under Workspace events.

Configuration events:

• Agent draft created: A Custom Agent draft was created in the workspace.

• Agent updated: An agent's name, description, or icon was changed.

• Agent instructions updated: An agent's instructions page was edited.

• Agent model settings updated: The model selection for an agent was changed.

• Agent integration added/removed/updated: A connection was added to, updated, or removed from an agent.

• Agent Notion access added/removed/updated: The pages or databases an agent can access were changed.

• Agent web access updated: Web access was enabled or disabled for an agent.

• Agent trigger added/removed/updated: A trigger was added, removed, or changed on an agent.

• Agent credit limits updated: the credit limit for an agent was set, removed, or changed.

• Agent published: A Custom Agent was published and made available to workspace members.

Access events:

• Agent permissions updated: Sharing permissions for a Custom Agent were changed.

• Agent enabled/disabled: An agent was enabled or disabled.

• Agent deleted: A Custom Agent was deleted.

• Agent restored: A deleted Custom Agent was restored.

Run events:

• Agent was triggered: A Custom Agent run was started (by a trigger, schedule, or manually).

• Run completed: A Custom Agent run finished successfully.

• Run failed: A Custom Agent run did not complete due to an error.

Page & content events:

• Agent created a page / edited a page / deleted a page: When a Custom Agent creates, edits, or deletes content during a run, these actions are recorded as standard page events in the audit log attributed to the agent. The human who triggered the run is also captured in the event metadata.

Workspace settings events

• Custom agent creation policy updated: The workspace policy controlling who can create Custom Agents was changed.

• Default agent credit limit set / removed: The workspace-wide default credit limit for Custom Agents was set or removed.

• Group agent creation policy updated: The Custom Agent creation permissions for a specific member group were changed.

Note: Recording what an agent did during a specific run is not included.

Want to analyze your audit log data in a spreadsheet or send it to external tools? You can export your audit log as a CSV. Your export will include only the events that match the filters you've set, so you get a smaller, more targeted file for investigations, audits, and compliance reviews.

To export your organization audit log:

1. Open the workspace switcher and select Manage organization.

2. Select Data & Compliance.

3. Find and select Audit log.

4. Optionally filter by organization, date, person, or event.

5. Select Export.

To export your workspace audit log:

1. Select the workspace name, then select Settings.

2. Select Audit log.

3. Optionally filter by organization, date, person, or event.

4. Select Export.