Audit logs

Audit logs record actions taken across your organization and workspaces: who did what, when, and to what. Use them for security monitoring, compliance, and troubleshooting.

Access audit logs

Via the API

Query, search, and export audit log events programmatically. See the Audit Logs API reference.

From Organization settings

Go to Organization Settings > Audit logs to view events in the Synthesia app.

Filter the list by:

• Date range: Last 7 days, Last 30 days, Last 90 days, or Specific dates from a calendar picker.
• Acting user: search and select one or more users.
• Events: search and select one or more event types, or select All events.

The table shows each event's timestamp, acting user, and a plain-language description (for example, "Consumed 9 credits to nanobanana pro stock image generation," or "Logged out"). Select Load More to see older events.

Select a row to open its full JSON payload in a dialog, which you can copy to your clipboard.

Example payload:

{
  "id": "cea25bb2-2ebe-4c06-b622-9badfbb13974",
  "action": "billing.credits.consumed",
  "status": "success",
  "actor": {
    "type": "user",
    "id": "c421e4c4-e2f0-4797-893d-379ca9f3fe5e",
    "name": "Jamie Rivera",
    "email": "[email protected]"
  },
  "target": {
    "type": "workspace",
    "id": "30abbe50-7712-4fd8-9e01-a7df3e5528cb",
    "name": "Roleplay Sessions Space"
  },
  "context": {
    "workspaceId": "30abbe50-7712-4fd8-9e01-a7df3e5528cb",
    "organizationId": "495c6eb6-2dcc-49e9-8027-63e548068c9d",
    "ipAddress": "internal"
  },
  "details": {
    "feature": "VIDEO_DURATION",
    "amount": 219.749,
    "unit": "seconds",
    "operationType": "credit",
    "credits": null
  },
  "metadata": {
    "createdAt": "2026-08-20T16:36:48.879000Z",
    "processedAt": "2026-08-20T16:36:48.985000Z"
  }
}

Select Download CSV in the top-right corner to export the currently filtered list. Exporting is itself an audited action—see audit_logs.exported under Event types.

CSV structure

Exported files are named audit_logs_export_<YYYYMMDD>_<HHMMSS>.csv. A single export is capped at 10,000 events—if your filtered result has more, the file is truncated and _TRUNCATED is appended to the filename. Narrow your date range or filters to get the rest.

Each row has these columns:

Event structure

Each event records:

• id: a unique identifier for the event.
• action: what was done, in domain.resource.past_tense_verb format (for example, workspace.user.invited).
• status: whether the action succeeded.
• actor: who or what performed the action. Usually a user, but some actions are performed by Synthesia's systems (for example, the billing system) rather than a person.
• target: what the action was performed on (for example, a workspace, a user, or a video).
• context: the workspace, organization, and IP address the action occurred in.
• details: additional information specific to that action, such as what changed from and to.
• metadata: timestamps for when the event was created and processed.

Event types

Each event's Name is the label it appears under in the Events filter (see Access audit logs). A dash (—) means the event isn't available in the list of filter options.

Authentication

User

Workspace

Organization

Billing

Email send cap

Content

Integrations

Covers HRIS and messaging integrations for the Learner Portal, and other external tool connections.

Audit logs

Learner Portal

The Learner Portal has its own set of events, covering Learner Groups, content assignment, and role entitlements. These are distinct from the core Admin/Member/Guest model—the Learner Portal has its own roles (Enablement Admin, Organization Admin, Manager, and Learner).