Audit Logs for Enterprise admins: Track team membership and join request activity

Audit Logs shows who added or removed members, changed roles, sent or revoked invitations, handled join requests, changed organization settings, or opened a note that isn't theirs. Filter by date and event type, then export the matching records.

Review activity

Audit Logs requires an enterprise administrator role — Admin, SuperAdmin, or IT Admin — and shows only your organization's records. Events appears only when it's enabled for your enterprise.

1. Open the admin dashboard.

2. Select Audit Logs, then Events if both audit views are available.

Events records member added, member removed, member role changed, member invited, invitation revoked, join request approved, join request rejected, domain added, domain removed, Notetaker consent confirmed, changed membership policy, note viewed, and note transcript viewed.

Rows show Timestamp, Actor, Action, Target, and Event ID; Actor and Target identify who acted and who or what was affected. Some activity is attributed to a non-human actor, such as a service or an anonymous viewer. Names stay as recorded when the event occurred; missing names fall back to IDs, then an em dash. Email addresses aren't included.

Member added and member removed cover every way membership changes — creating the enterprise, automatic joins from a verified domain, invite links, accepting join requests individually or in bulk, rejoining, directory setup and sync, bulk add or remove, disbanding the enterprise, and trial expiry. Changes made by the system rather than a person are attributed to a service actor, and approving join requests in bulk also records join request approved for each one.

Role-change rows name the old and new role, and add “(in team X)” when the change applies to a single team. Invitation events name the role the invitation grants.

A “changed membership policy” event is recorded when an admin changes auto-invite (whether people from your verified domains join the organization automatically at signup) or disable team trial (whether new team members skip the trial period), and names the setting with its old and new values. Re-saving a setting without changing its value records nothing.

Note access events

“Note viewed” and “Note transcript viewed” are recorded when someone other than the note's owner opens it through a share link — an invite, a folder, your verified domain, or anyone-with-link. People who open a link without signing in appear as Anonymous.

Each event names the note, its type, how the viewer was admitted, and which surface they used. Owners viewing their own notes in Flow are never recorded, and nothing is recorded for notes whose owner isn't part of an enterprise.

Filter and refresh

Member role changed, member invited, and invitation revoked sit under Membership; domain added and domain removed sit under Organization settings.

Select both dates, with the start on or before the end. Future dates and windows of 92 days or more aren't allowed; invalid dates stop loading and disable exports. “No event types selected” disables the table, Refresh, and exports — select at least one type to re-enable them.

If events can't be loaded

When the event list can't be loaded, the Events tab shows a single View audit events button. Select it to open your organization's events in a new browser tab. Filters, Refresh, and the CSV and JSON exports aren't shown in this state.

If the viewer doesn't open, you'll see “Couldn't open the events viewer. Please try again.” — allow pop-ups for the admin dashboard, then select the button again.

Export results

1. Set the date range and event types you need.

2. Select Export CSV or Export JSON.

Exports cover the whole filtered range, not just loaded rows, up to about 10,000 events regardless of page size. CSV contains the five table columns, including membership-policy changes; JSON contains full event records. Filenames use audit-events-<start>_to_<end>.csv or .json. An empty range still downloads an empty file. If you see “Failed to export audit events. Please try again.”, retry the export.

Messages you may see

• “Audit logs aren't available for your enterprise yet.”: Neither audit view is available, and no redirect occurs.

• “Audit events aren't set up for this enterprise yet.”: Events is enabled but not set up; it stays visible with exports disabled.

• “No events found for this range.”: The selected range has no matching events.

Tabs appear only when both audit views are available. Opening an unavailable view redirects to the first available view — Events when available.

Audit-log streaming

Streaming to a SIEM requires an Enterprise plan and streaming access enabled for your organization; you don't need an existing stream or SSO first. Configure streaming — or Manage streaming once set up — opens a hosted portal in a new tab, where retention is 30 days or 1 year.

Still need help?

• You don't see the Events tab — contact your account team.

• You need streaming enabled — contact Wispr support.

• Loading or export failures continue after retrying — include your enterprise, the error, and the steps you tried.