# Control Plane Audit Logs

SingleStore identifies and logs the user actions in the Control Plane that can be used to track user activity. Logged [Cloud Portal](https://portal.singlestore.com) activities include, but are not limited to, the following:

| Category       | Event                                                                                                                                                                                                                                                                              |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Workspace      | <ul> <li>Create, resize, suspend, or delete a workspace</li> <li>Detach a database from a workspace</li> <li>Modify auto-suspend configuration of a workspace</li> <li>Create or delete private connections to a workspace</li> </ul>                                              |
| Workspacegroup | <ul> <li>Create or delete a workspace group</li> <li>Add or update firewall rules for a workspace group</li> <li>Update the password</li> <li>Add RBAC rules at the workspace group level</li> <li>Change the update window for a deployment</li> <li>Create a database</li> </ul> |
| Observability  | <ul> <li>Add, update, or remove an alert for the database operations</li> <li>Add, update, or remove subscribers to the alert</li> </ul>                                                                                                                                           |
| Cloud Portal   | <ul> <li>Generate API keys</li> <li>Add a user</li> <li>Add a RBAC property at the organization level</li> <li>Add a payment method</li> <li>Change the database admin password</li> </ul>                                                                                         |
| Team           | <ul> <li>Create, update, or delete a team</li> <li>Add or delete members in a team</li> </ul>                                                                                                                                                                                      |
| Authentication | <ul> <li>User login events</li> </ul><ul> <li>Add, update, or delete a SCIM connection</li> </ul>                                                                                                                                                                                  |
| Notebook       | <ul> <li>Create or delete a <a href="https://docs.singlestore.com/cloud/container-services/notebooks.md">notebook</a> on the Cloud Portal</li> </ul>                                                                                                                               |

## Access Control Plane Audit Logs

Use the `AuditLogs` path (`/v1/auditLogs` endpoint) in the [Management API](https://docs.singlestore.com/cloud/reference/management-api.md) to access the Control Plane audit logs. For example:

```shell
curl -X 'GET' \
  'https://api.singlestore.com/v1/auditLogs' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <API_key>'
```

The following parameters can be used to filter the audit logs fetched from the `Management` API:

| Parameter                                          | Description                                                                                                                                                                                                                      |
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `type``source``firstName``lastName``email``userID` | Returns audit log entries that match the specified value for the respective field in the audit log. Refer to[Control Plane Audit Log Format](https://docs.singlestore.com/#section-id235122503466303.md)for related information. |
| `startDate`                                        | Returns audit log entries where the`createdAt`timestamp is greater than the specified`startDate`.                                                                                                                                |
| `endDate`                                          | Retrieves audit log entries where the`createdAt`timestamp is earlier than the specified`endDate`.                                                                                                                                |
| `limit`                                            | Limits the number of returned audit log entries to the specified value.                                                                                                                                                          |
| `nextToken`                                        | Returns the audit log entries generated after the specified`nextToken`value.                                                                                                                                                     |
| `sortByDescending`                                 | If enabled, audit log entries are returned in descending order by the`createdAt`timestamp (newest first).                                                                                                                        |

Refer to [Management API Reference](https://docs.singlestore.com/cloud/reference/management-api/reference.md) for more information.

## Control Plane Audit Log Format

The `Management` API returns the Control Plane audit logs formatted as JSON records. For example:

```json
{ 
  "nextToken": "2025-08-23T20:10:24.566869Z",
  "auditLogs": [
   {
      "orgID": "d4226b30-0000-1000-9000-e56cc36be262",
      "auditID": "9a189082-0000-1000-9000-d574adbbe889",
      "type": "WorkspaceGroupCreate",
      "source": "Portal",
      "createdAt": "2025-07-22T03:15:06.693055Z",
      "reason": "Workspace group (1baae325-0000-1000-9000-17b67a0af1ce) created in project (3c8d7c87-0000-1000-9000-feebd4f92dcf)",
      "userType": "Employee",
      "version": 0
    }
  ]}
```

Each Control Plane audit log entry may contain a subset of the fields listed in the following table:

| **Field**     | **Description**                                                                                                                                                                                                             |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `orgID`       | ID of the organization associated with this event.                                                                                                                                                                          |
| `auditID`     | ID of the audit log entry.                                                                                                                                                                                                  |
| `type`        | Type of the audit log event. Refer to[Audit Log Event Types](https://docs.singlestore.com/#section-id235122508390412.md)for more information.                                                                               |
| `userEmail`   | Email ID of the user that triggered this event.                                                                                                                                                                             |
| `userID`      | ID of the user that triggered this event.                                                                                                                                                                                   |
| `userType`    | Type of the user that triggered this event. It can have one of the following values:`Unspecified`,`System`,`Employee`,`Customer`,`Automation`,`Studio`,`CIAutomation`,`SharedTier`,`SNIProxy`,`NimbusGateway`, or`Cluster`. |
| `workspaceID` | ID of theworkspaceassociated with this event.                                                                                                                                                                               |
| `projectID`   | ID of the project associated with this event.                                                                                                                                                                               |
| `sessionID`   | ID of the authorization session associated with this event.                                                                                                                                                                 |
| `teamID`      | ID of the team associated with this event.                                                                                                                                                                                  |
| `source`      | Source of the audit log entry. It can have one of the following values:`Portal`,`Admin`, or`SystemJob`.                                                                                                                     |
| `createdAt`   | The timestamp (in the RFC3339Nano format) of when the audit log entry was created.                                                                                                                                          |
| `attributes`  | Additional keys and values specific to the audit log.                                                                                                                                                                       |
| `error`       | Error message, if any, related to this audit log entry.                                                                                                                                                                     |
| `reason`      | A detailed description of the event.                                                                                                                                                                                        |
| `firstName`   | First name of a redacted user.                                                                                                                                                                                              |
| `lastName`    | Last name of a redacted user.                                                                                                                                                                                               |
| `labels`      | List of audit-related keywords.                                                                                                                                                                                             |
| `nextToken`   | Timestamp of the latest audit log entry.If specified in the API call, the API only returns the audit log entries generated after the specified timestamp.                                                                   |

## Control Plane Audit Log Event Types

The following is a list of logged event types for each category:

| **Category**           | **Event Type**                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                                                                                                                                  |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Notebook Management    | <ul> <li>NotebookCreate</li> <li>NotebookDelete</li> </ul>                                                                                                                                                                                                                                                                             |                                                                                                                                                                                                                                                                                                                                                  |
| Cluster Operations     | <ul> <li>ClusterCreate</li> <li>ClusterTerminate</li> </ul>                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                  |
| Workspace Management   | <ul> <li>WorkspaceGroupTerminate</li> <li>WorkspaceTerminate</li> <li>WorkspaceCreate</li> <li>WorkspaceGroupCreate</li> </ul>                                                                                                                                                                                                         | <ul> <li>WorkspaceScale</li> <li>WorkspacePause</li> <li>WorkspaceResume</li> <li>WorkspaceGroupDelete</li> </ul>                                                                                                                                                                                                                                |
| Alert Management       | <ul> <li>SubscribedAlert</li> <li>UnsubscribedAlert</li> </ul>                                                                                                                                                                                                                                                                         | <ul> <li>SubscriberAlertUpdated</li> </ul>                                                                                                                                                                                                                                                                                                       |
| User Management        | <ul> <li>InvitedNewUserToPortal</li> <li>AddedNewUserToPortal</li> </ul>                                                                                                                                                                                                                                                               | <ul> <li>UserRemovedFromPortal</li> </ul>                                                                                                                                                                                                                                                                                                        |
| Team Management        | <ul> <li>TeamCreate</li> <li>TeamUpdate</li> <li>TeamDelete</li> </ul>                                                                                                                                                                                                                                                                 | <ul> <li>TeamAddMember</li> <li>TeamRemoveMember</li> </ul>                                                                                                                                                                                                                                                                                      |
| Billing & Payment      | <ul> <li>NewPaymentMethod</li> <li>NovaPoolBillingUpdate</li> <li>ComputeOverageChange</li> <li>BalanceCorrection</li> </ul>                                                                                                                                                                                                           | <ul> <li>BalanceIncrease</li> <li>SubscriptionBundleCreated</li> <li>SubscriptionBundleDeleted</li> <li>SubscriptionBundleUpdated</li> </ul>                                                                                                                                                                                                     |
| Security & Access      | <ul> <li>GenerateAPIKey</li> <li>RevokeAPIKey</li> <li>WorkspaceGroupAccessGranted</li> <li>WorkspaceGroupAccessRevoked</li> <li>OrganizationAccessGranted</li> <li>OrganizationAccessRevoked</li> <li>NovaAppAccessGranted</li> <li>NovaAppAccessRevoked</li> <li>NovaServiceAPIKeyCreate</li> <li>NovaServiceAPIKeyRevoke</li> </ul> | <ul> <li>ChangeAdminDatabasePassword</li> <li>WorkspaceAccessGranted</li> <li>WorkspaceAccessRevoked</li> <li>AgentDomainAccessGranted</li> <li>AgentDomainAccessRevoked</li> <li>SecretAccessGranted</li> <li>SecretAccessRevoked</li> <li>NotifySAMLCertExpire</li> <li>UpdateOAuthIntegrationAvailability</li> <li>MFAMethodChange</li> </ul> |
| Maintenance & Config   | <ul> <li>MaintenanceWindowUpdate</li> <li>AutoSuspendDisableOnResume</li> </ul>                                                                                                                                                                                                                                                        | <ul> <li>UpdateAutoSuspendConfiguration</li> </ul>                                                                                                                                                                                                                                                                                               |
| Firewall Management    | <ul> <li>FirewallRuleAdded</li> <li>FirewallRuleUpdate</li> </ul>                                                                                                                                                                                                                                                                      | <ul> <li>FirewallRangesUpdate</li> </ul>                                                                                                                                                                                                                                                                                                         |
| Storage Management     | <ul> <li>BottomlessRetentionPeriodUpdate</li> </ul>                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                  |
| Job Scheduling         | <ul> <li>CreateScheduledJob</li> <li>ScheduledJobUpdate</li> </ul>                                                                                                                                                                                                                                                                     | <ul> <li>ScheduledJobRemove</li> </ul>                                                                                                                                                                                                                                                                                                           |
| Database Operations    | <ul> <li>DatabaseCreated</li> <li>DatabaseDetached</li> </ul>                                                                                                                                                                                                                                                                          | <ul> <li>DatabaseRemoved</li> </ul>                                                                                                                                                                                                                                                                                                              |
| Network & Connectivity | <ul> <li>PrivateConnectionCreated</li> <li>PrivateConnectionDeleted</li> </ul>                                                                                                                                                                                                                                                         |                                                                                                                                                                                                                                                                                                                                                  |
| SCIM Integration       | <ul> <li>SCIMCreateConnection</li> <li>SCIMUpdateConnection</li> </ul>                                                                                                                                                                                                                                                                 | <ul> <li>SCIMDeleteConnection</li> </ul>                                                                                                                                                                                                                                                                                                         |
| Operations API         | <ul> <li>OpsAPIRequest</li> </ul>                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                  |
| Encryption Management  | <ul> <li>CMEKScheduleDeletionAlert</li> </ul>                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                  |

***

Modified at: April 24, 2026

Source: [/cloud/security/audit-logging/control-plane-audit-logs/](https://docs.singlestore.com/cloud/security/audit-logging/control-plane-audit-logs/)

(An index of the documentation is available at /llms.txt)