:Harvey:Support

Using Audit Logs

Learn how to view, filter, search, and export your workspace’s audit logs in Command Center.

Last updated: Oct 16, 2026

Overview

Audit logs are security records of activity across your Harvey workspace. They capture admin actions, authentication events, API calls, and user activity, and cannot be edited or deleted. Each event records who performed the action, what type of action it was, when it occurred, and the request metadata associated with it.

The Audit logs page (Command Center → Reporting → Audit logs) gives workspace admins a self-serve view of this record. You can review up to 7 days of activity at a time, filter by log type or actor, search by keyword or email address, expand any event to see its full details, and export the current view as a CSV.

For continuous collection, long-range analysis, or alerting, use the Audit Log API alongside the in-product view.

Note: Access to the Audit logs page is controlled by a dedicated Audit logs permission, which is granted to admins by default. Admins can grant or remove it by role in Command Center → Users & permissions → Roles. Users without the permission do not see the Audit logs page.

View Audit Logs

View of the Audit Log page
  1. In Harvey’s sidebar, select Settings Slider Command Center.
  2. Navigate to Reporting → Audit logs.
  3. Choose a date and time range. You can view up to 7 days of activity at a time.
  4. The audit log table displays the following information for each event:
    1. Email (the email address of the user or service account that performed the action)
    2. Log type
    3. Timestamp
    4. Details (includes the request metadata recorded for that event)

Filter and Search Audit Logs

Filter and search the Audit Log page
  1. At the top of the Audit log page, use the search bar to find events by keyword or email address.
  2. Select Filter Filters to narrow results by Log type or by email. Once filters are selected, the Filters button displays the number of filters that are currently applied.
    1. To clear log filters, select Filter Filters, then select Clear selection.
    2. To clear email filters, select Filter Filters, then select the x by each email address.

Export Audit Logs

Export an Audit Log
  1. At the top of the Audit log page, apply the date range and any filters you want included in your export.
  2. Select Arrow Wall Down Export. Harvey generates a CSV of the events in your current view.

Note that exports include the most recent 20,000 events in the selected range. If your range contains more than that, Harvey exports the newest 20,000. Narrow the date or time range and export again to collect the rest in batches.

Example Use Cases

FAQs

Was this article helpful?

Manage Vault Data Retention Settings

Learn how to manage vault data retention settings in Vault, including triggers and deletion timelines.

Enable the Harvey for Outlook Add-In for Your Workspace

Learn how to enable Harvey for Outlook for your organization, from centralized deployment to on-premise sideloading and managing user permissions.

SCIM (System for Cross-domain Identity Management) Integration

Set up SCIM in Harvey to automate user provisioning, deprovisioning, and group-based access management through your organization’s identity provider.

SCIM Guest Provisioning

Use SCIM to create Guest accounts in Harvey from groups in your identity provider.

Managing Agents

Learn how workspace admins can assign agent permissions, manage all workspace agents, and review requests to share agents.