Audit Logs

Learn how to track and analyze your team members' activities.
Table of Contents

Audit Logs are available in Beta on Enterprise plans

Those with the owner role can access this feature

Audit logs help you track and analyze your team members' activity. They can be accessed by team members with the owner role, and are available to customers on enterprise plans.

To export and download audit logs:

  • Go to Team Settings > Security > Audit Log
  • Select a timeframe to export a Comma Separated Value (CSV) file containing all events occurred during that time period
  • Click the Export CSV button to download the file

The team owner requesting an export will then receive an email with a link containing the report. This link is used to access the report and is valid for 24 hours.

Note that reports can be generated for the last 90 days (three months) and will not impact your billing.

Select a timeframe to export audit logs for your team.
Select a timeframe to export audit logs for your team.

In addition to the standard audit log functionalities, Vercel supports custom log streaming to your Security Information and Event Management (SIEM) system of choice. This allows you to integrate Vercel audit logs with your existing observability and security infrastructure.

We support the following SIEM options out of the box:

  • AWS S3
  • Splunk
  • Datadog
  • Google Cloud Storage

We also support streaming logs to any HTTP endpoint, secured with a custom header.

If your SIEM requires IP allowlisting, please use the following IP addresses:

23.21.184.92
34.204.154.149
44.213.245.178
44.215.236.82
50.16.203.9
52.1.251.34
52.21.49.187
174.129.36.47

To set up custom log streaming to your SIEM, please contact your Customer Success Manager (CSM). They will guide you through the configuration process to ensure a smooth and secure integration.

The CSV file can be opened using any spreadsheet-compatible software, and includes the following fields:

PropertyDescription
timestampTime and date at which the event occurred
actionName for the specific event. E.g, project.created, team.member.left, project.transfer_out.completed, auditlog.export.downloaded, auditlog.export.requested, etc. Learn more about it here.
actor_vercel_idUser ID of the team member responsible for an event
actor_nameAccount responsible for the action. For example, username of the team member
actor_emailEmail address of the team member responsible for a specific event
locationIP address from where the action was performed
user_agentDetails about the application, operating system, vendor, and/or browser version used by the team member
previousCustom metadata (JSON object) showing the object's previous state
nextCustom metadata (JSON object) showing the object's updated state

Vercel logs the following list of actions performed by team members.

Maps a custom domain or subdomain to a specific deployment or URL of a project. To learn more, see the vercel alias docs.

Action NameDescription
alias.createdIndicates that a new alias was created
alias.deletedIndicates that an alias was deleted

Refers to the audit logs of your Vercel team account.

Action NameDescription
auditlog.export.downloadedIndicates that an export of the audit logs was downloaded
auditlog.export.requestedIndicates that an export of the audit logs was requested

A digital certificate to manage SSL/TLS certificates for your custom domains through the vercel certs command. It is used to authenticate the identity of a server and establish a secure connection.

Action NameDescription
cert.createdIndicates that a new certificate was created
cert.deletedIndicates that a new certificate was deleted
cert.renewedIndicates that a new certificate was renewed

Create URLs that accept HTTP POST requests to trigger deployments and rerun the build step. To learn more, see the Deploy Hooks docs.

Action NameDescription
deploy_hook.dedupedA deploy hook is de-duplicated which means that multiple instances of the same hook have been combined into one

Refers to a successful build of your application. To learn more, see the deployment docs.

Action NameDescription
deployment.deletedIndicates that a deployment was deleted
deployment.job.erroredIndicates that a job in a deployment has failed with an error

A unique name that identifies your website. To learn more, see the domains docs.

Action NameDescription
domain.auto_renew.changedIndicates that the auto-renew setting for a domain was changed
domain.buyIndicates that a domain was purchased
domain.createdIndicates that a new domain was created
domain.delegatedIndicates that a domain was delegated to another account
domain.deletedIndicates that a domain was deleted
domain.move_out.requestedIndicates that a request was made to move a domain out of the current account
domain.moved_inIndicates that a domain was moved into the current account
domain.moved_outIndicates that a domain was moved out of the current account
domain.record.createdIndicates that a new domain record was created
domain.record.deletedIndicates that a new domain record was deleted
domain.record.updatedIndicates that a new domain record was updated
domain.transfer_inIndicates that a request was made to transfer a domain into the current account
domain.transfer_in.canceledIndicates that a request to transfer a domain into the current account was canceled
domain.transfer_in.completedIndicates that a domain was transferred into the current account

A key-value data store associated with your Vercel account that enables you to read data at the edge without querying an external database. To learn more, see the Edge Config docs.

Action NameDescription
edge_config.createdIndicates that a new edge configuration was created
edge_config.deletedIndicates that a new edge configuration was deleted
edge_config.updatedIndicates that a new edge configuration was updated

Helps you pair Vercel's functionality with a third-party service to streamline installation, reduce configuration, and increase productivity. To learn more, see the integrations docs.

Action NameDescription
integration.deletedIndicates that an integration was deleted
integration.installedIndicates that an integration was installed
integration.updatedIndicates that an integration was updated

Password Protection allows visitors to access preview deployments with a password to manage team-wide access.

Action NameDescription
password_protection.disabledIndicates that password protection was disabled
password_protection.enabledIndicates that password protection was enabled

Customize the appearance of your preview deployment URLs by adding a valid suffix. To learn more, see the preview deployment suffix docs.

Action NameDescription
preview_deployment_suffix.disabledIndicates that the preview deployment suffix was disabled
preview_deployment_suffix.enabledIndicates that the preview deployment suffix was enabled
preview_deployment_suffix.updatedIndicates that the preview deployment suffix was updated

Refers to actions performed on your Vercel projects.

Action NameDescription
project.analytics.disabledIndicates that analytics were disabled for the project
project.analytics.enabledIndicates that analytics were enabled for the project
project.deletedIndicates that a project was deleted
project.env_variableThis field refers to an environment variable within a project
project.env_variable.createdIndicates that a new environment variable was created for the project
project.env_variable.deletedIndicates that a new environment variable was deleted for the project
project.env_variable.updatedIndicates that a new environment variable was updated for the project

Refers to the password protection settings for a project.

Action NameDescription
project.password_protection.disabledIndicates that password protection was disabled for the project
project.password_protection.enabledIndicates that password protection was enabled for the project
project.password_protection.updatedIndicates that password protection was updated for the project

Refers to the Single Sign-On (SSO) protection settings for a project.

Action NameDescription
project.sso_protection.disabledIndicates that SSO protection was disabled for the project
project.sso_protection.enabledIndicates that SSO protection was enabled for the project
project.sso_protection.updatedIndicates that SSO protection was updated for the project

Refers to the transfer of a project between Vercel accounts.

Action NameDescription
project.transfer_in.completedIndicates that a project transfer into the current account was completed successfully
project.transfer_in.failedIndicates that a project transfer into the current account was failed
project.transfer_out.completedIndicates that a project transfer out of the current account was completed successfully
project.transfer_out.failedIndicates that a project transfer out of the current account was
project.transfer.startedIndicates that a project transfer was initiated

Refers to the generation of web analytics for a Vercel project.

Action NameDescription
project.web-analytics.disabledIndicates that web analytics were disabled for the project
project.web-analytics.enabledIndicates that web analytics were enabled for the project

Refers to environment variables defined at the team level. To learn more, see the shared environment variables docs.

Action NameDescription
shared_env_variable.createdIndicates that a new shared environment variable was created
shared_env_variable.decryptedIndicates that a new shared environment variable was decrypted
shared_env_variable.deletedIndicates that a new shared environment variable was deleted
shared_env_variable.updatedIndicates that a new shared environment variable was updated

Refers to actions performed by members of a Vercel team.

Action NameDescription
team.avatar.updatedIndicates that the avatar (profile picture) associated with the team was updated
team.createdIndicates that a new team was created
team.deletedIndicates that a new team was deleted
team.name.updatedIndicates that the name of the team was updated
team.slug.updatedIndicates that the team's unique identifier, or "slug," was updated

Refers to actions performed by any team member.

Action NameDescription
team.member.access_request.confirmedIndicates that an access request by a team member was confirmed
team.member.access_request.declinedIndicates that an access request by a team member was declined
team.member.access_request.requestedIndicates that a team member has requested access to the team
team.member.addedIndicates that a new member was added to the team
team.member.deletedIndicates that a member was removed from the team
team.member.joinedIndicates that a member has joined the team
team.member.leftIndicates that a new member has left the team
team.member.role.updatedIndicates that the role of a team member was updated
Last updated on October 16, 2024