Audit logs ↗

Documentation Index#

Fetch the complete documentation index at: https://docs.langchain.com/llms.txt Use this file to discover all available pages before exploring further.

Track and review administrative actions across your LangSmith organization for security, compliance, and operational visibility.

Audit logs are available on Enterprise plans. If you’re interested in upgrading to Enterprise, contact our sales team.

LangSmith audit logs provide a tamper-resistant record of administrative and configuration actions taken within your organization. They help you answer questions like:

• Who deleted an API key, a dataset, or a deployment?
• When was a new member invited, a role modified, or examples updated?
• What billing, SSO, or data retention configuration was changed?
• Which datasets, tracing projects, or prompt webhooks were modified?

Audit logs are useful for security reviews, compliance requirements, and general operational visibility.

Prerequisites#

• Your organization must be on an Enterprise plan.
• You must have the Organization Admin or Organization Operator role (organization:manage permission) to view audit logs.

What gets logged#

Audit logs record changes to organization settings, membership, credentials, workspaces, and other resources. Each event includes the timestamp, the actor, the operation name, the affected resources, and whether it succeeded. For the complete list of operation names, see the tracked operations reference.

Retention#

Audit logs are retained for up to 400 days. Events older than 400 days may be removed automatically.

Enable audit logs for self-hosted deployments#

Audit logs are available for self-hosted LangSmith instances running Helm chart 0.12.33 or later (application version 0.12.33). Once you’ve upgraded, use one of the following options to enable audit logs:

• Enable for a specific organization: Run the following against your LangSmith PostgreSQL database, replacing <organization_id> with the ID copied from the organization settings page in the UI:

  UPDATE organizations SET config = config || '{"can_use_audit_logs": true}' WHERE id = '<organization_id>' AND NOT is_personal;

• Enable for all organizations: Add the following environment variable to commonEnv in your values.yaml:

  DEFAULT_ORG_FEATURE_CAN_USE_AUDIT_LOGS: "true"

  This environment variable has no effect on personal organizations.

For more details on self-hosted releases, see the self-hosted changelog.

Query audit logs via API#

Use the GET /api/v1/audit-logs endpoint (API reference) to retrieve audit log events. Results follow the OCSF API Activity schema.

Example request#

curl -G \
  'https://api.smith.langchain.com/api/v1/audit-logs' \
  -H 'accept: application/json' \
  -H 'X-API-Key: lsv2_sk_...' \
  -H 'X-Organization-Id: abc123...' \
  -d 'limit=2' \
  --data-urlencode 'start_time=2026-01-01T18:35:16.232Z' \
  --data-urlencode 'end_time=2026-01-13T18:35:16.232Z' \
  --data-urlencode 'operations=create_api_key' \
  --data-urlencode 'operations=delete_api_key'

Response format#

Audit log events are returned in OCSF v1.7.0 API Activity (Class UID 6003) format. Key fields:

Forwarding to external systems#

To forward audit log events to an external SIEM or logging platform, you can run a scheduled function that pulls the previous hour of events every hour. For example, with AWS Lambda + EventBridge Scheduler, failures land in a dead-letter queue so you know which windows to retry.

Tracked operations reference#

FAQ#

Edit this page on GitHub or file an issue.

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.