Audit log

Your organization has one audit log. It records changes, not reads:

Each event has an action (<resource>.<verb>, e.g. api_key.created, domain.deleted, member.role_changed), the target it changed, and the project and environment it happened in (null for organization-wide changes such as domains and members). Changes made through the API carry the request's request_id in their metadata, so you can find the request in the environment's logs.

Owners and admins can open Settings → Audit log in the dashboard to filter events and export them as CSV. Or read them through the API:

const { data, error } = await coss.auditEvents.list({
  action: ["domain.", "api_key.created"],
  from: new Date(Date.now() - 7 * 24 * 60 * 60 * 1000),
});
for (const event of data?.data ?? []) {
  console.log(event.created_at, event.actor_label, event.action, event.target_label);
}

An action ending in . matches every action of that resource (domain.). Pages are newest first: pass the last event's id as after while has_more is true.

The audit log is organization-wide: an API key of any environment, live or sandbox, reads every event of the organization. Only owners and admins can create API keys, and both can read the audit log. Reading it is not itself logged, and its events never appear in an environment's logs.