Audit logs

Who can do it: Company Admins
Which plans: Enterprise Plan
Which platforms: Browser

Audit logs allow organization admins with relevant privileges to track user activity in their Miro organization. Logs are extremely useful when investigating a problem or getting a detailed report of important events (for example, changes to the global security settings, invitations of new users, or new boards created).

✏️ Currently, the events are logged from the moment of the Enterprise subscription creation and are stored for 180 days by default:
a) If you upgrade to Enterprise from a different plan, the events will be logged from the moment of the upgrade.
b) If you migrate some teams to the Enterprise subscription, their data will be logged only when they become a part of the subscription.

Accessing audit logs

To access audit logs, do the following:

1. Go to Company Settings.
2. On the left panel, click Security > Audit logs.
3. You can filter the audit logs by choosing a Date range, one or more Actors (including apps and AI agents acting on behalf of a user), one or more Event categories, one or more specific Events, and one or more Affected objects.

Click the View events button to preview the events matching your filtering criteria. Time is displayed in ISO 8601 format, in the local time zone. You can see details of a particular event by clicking on three dots in the Details column.

✏️ You can preview events as far back as your organization's audit log retention period reaches (up to 365 days).

Export audit logs

You can export logs in a CSV file format.

In the CSV Export file, the event date and time are provided in ISO 8601 format, UTC time zone. There is no limit on the number of records to be exported at a time; however, the more data you export, the longer it takes to prepare the file to download. Also, be mindful that popular applications for working with tables have their limits to the volume of data they can open. The exported file reflects any filters you've applied, including Affected object.

To export logs, click the Export to CSV button.

The bar with your export file details will appear below. When the file is ready to download, you can click the Download CSV button. The file will be available for download for 24 hours.

✏️ Currently, only one export file is available for download per organization at a time. Clicking the Export to CSV button will replace the current export file.

Access audit logs via API

Admins can use the Audit Log API or supported SIEM Integrations to programmatically access and collect audit log data.

The API supports the same filters as the UI: Actor, Event category, Event, and Affected object, each accepting multiple values. You can retrieve your organization's complete audit log history via the API.

Audit Logs API v1 retirement

Audit Logs API v1 has been retired. If you have a custom integration built on v1 (GET /v1/audit/logs), migrate it to v2 (GET /v2/audit/logs). Authentication and the time-window parameters are unchanged, but pagination, response format, and some field names differ, see the API reference for details. If you use a Miro-provided app or marketplace connector (for example, the Miro app for Splunk or Microsoft Sentinel), update it to the latest version, which already supports v2.

Notable changes in the v2 response:

• Pagination is cursor-based (an opaque cursor value) instead of offset-based; there's no total record count.
• createdBy.id is returned as a string (previously a number).
• Each event includes a top-level category field.
• Event IDs are UUID strings (previously a numeric suffix); treat them as opaque values.
• createdAt reflects when the event was stored rather than exactly when the action occurred (typically a lag of a few seconds).
• details fields use camelCase (e.g. organizationId), large numeric values are serialized as strings, timestamps use ISO 8601, and keys with null values are omitted.
• For actions performed by an app, integration, or AI agent on behalf of a user, the actor object includes an onBehalfOf field identifying that user.
• The actor name for signed-out visitors is now "Visitor" (previously "Guest").
• Board-related events reference the board's public boardKey instead of an internal numeric ID.
• Event types and categories that referenced "project" now use "space" (for example, project_created is now space_created); this applies retroactively to historical events retrieved via v2.

Deleting audit logs

Admins can set a retention policy for audit logs. You can choose between 30, 90, 180, or 365 days.

⚠️ Once audit logs are deleted, they can't be recovered.

✏️ Indefinite retention for audit logs has been deprecated.

To set a deletion period, do the following:

1. Go to Company Settings.
2. On the left panel, click Security > Audit logs.
3. Under Audit logs, click the Settings tab.
4. Choose an option from the drop-down list. You will be asked to confirm your choice.

Events in Audit logs

The audit logs include records about the following categories of events:

Frequently asked questions