Audit log

Route: /team?view=audit (Team → Audit log; the old /audit address redirects there)

Scenario 1: A pull request was merged last night and you want to know who merged it.

Scenario 2: Your security team wants to know who generated API keys in the last 30 days and whether any were revoked.

The Audit log in Mushi Mushi records actions taken by people, agents and scheduled jobs on the active project. Each entry has a time, an actor, a resource and, when the action stored one, a metadata payload you can expand. The view has three tabs: Overview, Log and Breakdown.

The Audit log needs the audit_log entitlement (Builder, Studio and Enterprise). The API also checks the Enterprise license and runs in evaluation mode without one.

What’s logged

Not every change writes an entry: the code logs a fixed list of actions. Most settings changes, including SSO and storage changes, are recorded as settings.updated or settings.deleted with the resource type telling you what changed. Examples from that list:

Action	Description
`report.created` / `report.triaged`	A report was filed or triaged
`api_key.created` / `api_key.revoked`	An API key was minted or revoked
`settings.updated` / `settings.deleted`	A setting, SSO provider, storage config and so on changed
`fix.reviewed` / `pull_request.merged`	A fix was reviewed; a pull request was merged
`fix_dispatch.cancelled`	A fix dispatch was cancelled
`project.created` / `project.deleted`	A project was created or deleted
`org.member_role_changed`, `org.invite_revoked`	Team membership changes
`billing.plan_changed`	The plan changed
`mcp.tool_called`	An MCP tool call

Columns

Column	Description
Time	When it happened
Action	The action name; failure actions (`fix.failed`, `integration.disconnected`) and warning actions (`api_key.revoked`, `plugin.uninstalled`) are highlighted
Actor	Who did it
Resource	The type and short ID of the object the action affected
▶	Expand to see the metadata payload and the full resource ID

Snapshot

The strip at the top shows Changes (24h), Failures (24h) and All time. The Overview tab breaks the last day down by Human actors, Agent actors and System actors, and names the most frequent action of the last 7 days.

Filtering

Filter	Options
Action	A fixed list of common action names
Resource	`report`, `fix`, `settings`, `integration`, `project`, `api_key`, `plugin`, `dsar`, `fine_tuning`, `prompt`
Actor type	Human / Agent (LLM) / System (cron / webhook)
When	Last hour / Last 24h / Last 7 days / Last 30 days / All time
Actor email	Filter to a specific person
Search action / resource	Free-text search on action and resource

The Failures (24h) card also filters the log to failure or warning outcomes.

Active filters appear as chips in a rail below the toolbar. Click the × on any chip to remove it, or Clear all to reset.

Expanding a row

Click a row that has metadata to expand it and see the JSON payload the action stored, plus the full resource ID. What the payload holds depends on the action; most do not store a before/after copy.

Export

Click Export CSV to download the entries currently loaded (one page, up to 50) with Time, Action, Actor, Resource, Resource ID and the metadata JSON. Page through the log to export more.

Common tasks

Finding who merged a pull request

Type pull_request.merged in Search action / resource.
Set When to Last 24h.
Expand the entry to see its metadata and the actor.

Security review: who created API keys this month

Type api_key.created in Search action / resource (the Action dropdown lists api_key.minted, which the server does not write).
Set When to Last 30 days.
Set Actor type to Human.
Review the Actor column.
Repeat with api_key.revoked, then Export CSV each page to share.

Finding out when a project was deleted

Set Action to project.deleted.
Expand the row to see the metadata the deletion stored and the actor.

API


GET /v1/admin/audit?action=&outcome=&resource_type=&actor=&actor_type=&since=&q=&limit=50&offset=
GET /v1/admin/audit/stats

Compliance: SOC 2 evidence that references audit data
Fixes: fix run history
Organization members: who has access