dbt audit log EnterpriseEnterprise +
To review actions performed by people in your account, dbt provides logs of audited user and system events in real time. The audit log appears as events happen and includes details such as who performed the action, what the action was, and when it was performed. You can use these details to troubleshoot access issues, perform security audits, or analyze specific events. You can also query and export audit log events through the API.
You must be an Account admin, Account viewer, or Security admin to access the audit log, and this feature is only available on Enterprise plans.
The dbt audit log stores all the events that occurred in your account in real time, including:
- For events within 90 days, the dbt audit log has a selectable date range that lists events triggered.
- For events beyond 90 days, Account admins, Account viewers, and Security admins can export all events by using Export All.
Note that the retention period for events in the audit log is at least 12 months.
Accessing the audit log
To access the audit log, click on your account name in the left-side menu and select Account settings. Click Audit log in the left sidebar.
Understanding the audit log
On the audit log page, you will see a list of various events and their associated event data. Each of these events shows the following information in dbt:
- Event name: Action that was triggered
- Agent: User who triggered that action/event
- Timestamp: Local timestamp of when the event occurred
Event details
Click the event card to see the details about the activity that triggered the event. This view provides important details, including when it happened and what type of event was triggered. For example, if someone changes the settings for a job, you can use the event details to see which job was changed (type of event: job_definition.changed), by whom (person who triggered the event: actor), and when (time it was triggered: created_at). For types of events and their descriptions, refer to Events in audit log.
The event details provide the key factors of an event:
| Loading table... |
Audit log events
The audit log supports various events for different objects in dbt. You will find events for authentication, environment, jobs, service tokens, groups, user, project, permissions, license, connection, repository, and credentials.
Authentication
| Loading table... |
OAuth clients
These events cover the lifecycle of OAuth clients registered in Account settings → Integrations → App integrations (refer to Connect apps with OAuth). Actions a user performs through an OAuth-connected client (for example, creating a job) are logged under the relevant event (such as job_definition.added) with the user as the actor.
| Loading table... |
Environment
| Loading table... |
Jobs
| Loading table... |
Service Token
| Loading table... |
Group
| Loading table... |
User
| Loading table... |
Project
| Loading table... |
Permissions
| Loading table... |
License
| Loading table... |
Connection
| Loading table... |
Repository
| Loading table... |
Credentials
| Loading table... |
Git integration
| Loading table... |
Webhooks
| Loading table... |
Semantic Layer
| Loading table... |
Extended attributes
| Loading table... |
Account-scoped personal access token
| Loading table... |
IP restrictions
| Loading table... |
SCIM
| Loading table... |
Searching the audit log
You can search the audit log to find a specific event or actor, which is limited to the ones listed in Events in audit log. The audit log lists historical events from the last 90 days. You can search for an actor or event using the search bar, and then narrow your results using the time window.
Use search bar to find content in the audit logExporting logs
You can use the audit log to export all historical audit results for security, compliance, and analysis purposes. Events in the audit log are retained for at least 12 months.
-
For events within 90 days: dbt will automatically display the 90-day selectable date range. Select Export Selection to download a CSV file of all the events that occurred in your account within 90 days.
-
For events beyond 90 days: Select Export All. An Account admin, Account viewer, or Security admin receives an email link to download a CSV file of all the events that occurred in your account.
View audit log export optionsUsing the API
You can also query and export audit log events with the Administrative API v3. Use the API when you want to pull audit data into a script, a scheduled job, or security monitoring or log aggregation tooling. The same access requirements at the top of this page apply to the API. For common automation approaches, refer to Common automation patterns.
| Loading table... |
Authenticate with a service token or personal access token, passed as Authorization: Bearer YOUR_TOKEN or Token YOUR_TOKEN.
Bulk exports require a personal access token as service tokens aren't supported for that step.
Without date parameters, list and CSV download requests default to the last 90 days.
In the following examples, replace YOUR_ACCESS_URL with your dbt access URL, ACCOUNT_ID with your account ID, and YOUR_TOKEN with your token. You can find your account ID in Account settings, or refer to Finding your user and account IDs for more information.
Query events
To fetch audit log events as JSON, send a GET request to /api/v3/accounts/ACCOUNT_ID/audit-logs/:
curl --request GET \
--url 'https://YOUR_ACCESS_URL/api/v3/accounts/ACCOUNT_ID/audit-logs/?logged_at_start=2024-01-01&logged_at_end=2024-01-31&limit=10&offset=0' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_TOKEN'
The response includes a data array of events with details such as event_type, event_label, actor, created_at, and event_context. Use logged_at_start and logged_at_end to filter by date range, and limit and offset to paginate through results. For more options, refer to List Recent Audit Log Events in the API reference.
Download a CSV
To download audit log events as a CSV file, send a GET request to /api/v3/accounts/ACCOUNT_ID/audit-logs/download/. This is the API equivalent of Export Selection in the UI:
curl --request GET \
--url 'https://YOUR_ACCESS_URL/api/v3/accounts/ACCOUNT_ID/audit-logs/download/?logged_at_start=2024-01-01&logged_at_end=2024-01-31' \
--header 'Authorization: Bearer YOUR_TOKEN' \
--output audit-log.csv
You can use the same logged_at_start and logged_at_end query parameters as the list endpoint.
Bulk export
To export your full audit log history through the API, use the same workflow as Export All in the UI:
- Submit an export request with
POSTto/api/v3/accounts/ACCOUNT_ID/audit-logs/export/. The response returns ajob_idin thedataobject (data.job_id). Use a personal access token for this step.
curl --request POST \
--url 'https://YOUR_ACCESS_URL/api/v3/accounts/ACCOUNT_ID/audit-logs/export/' \
--header 'Authorization: Bearer YOUR_TOKEN'
- Check the export status with
GETon/api/v3/accounts/ACCOUNT_ID/audit-logs/export/. Repeat this request untilis_runningin thedataobject isfalse.
curl --request GET \
--url 'https://YOUR_ACCESS_URL/api/v3/accounts/ACCOUNT_ID/audit-logs/export/' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_TOKEN'
- Get a download URL with
GETon/api/v3/accounts/ACCOUNT_ID/audit-logs/export/JOB_ID/download/. The response includes adownload_urlin thedataobject (data.download_url). Use thejob_idfrom step 1 asJOB_IDin the URL.
curl --request GET \
--url 'https://YOUR_ACCESS_URL/api/v3/accounts/ACCOUNT_ID/audit-logs/export/JOB_ID/download/' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_TOKEN'
- Download the CSV file from the
download_urlreturned in step 3 (data.download_url):
curl --request GET \
--url 'DOWNLOAD_URL' \
--output audit-log-full.csv
Common automation patterns
Teams often automate audit log access in a few ways:
- Scheduled incremental pulls: Call the list endpoint on a schedule with
logged_at_startandlogged_at_endto fetch new events since the last run, then load the JSON into your security monitoring or log aggregation tooling. - Periodic CSV exports: Use the download endpoint to export a date range as CSV for compliance archival or analysis.
- Full history exports: Use the bulk export workflow when you need your complete audit log history programmatically, similar to Export All in the UI.
For endpoint details, refer to the Administrative API v3 reference.
Was this page helpful?
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
