Track user activity with audit logs

Use W&B audit logs to track user activity within your organization and to conform to your enterprise governance requirements. Audit logs are available in JSON format. Refer to Audit log schema.

How to access audit logs depends on your W&B platform deployment type:

After fetching audit logs, you can analyze them using tools like Pandas, Amazon Redshift, Google BigQuery, or Microsoft Fabric. Some audit log analysis tools do not support JSON; refer to the documentation for your analysis tool for guidelines and requirements for transforming the JSON-formatted audit logs before analysis.

Audit log schema

This table shows all keys which may appear in an audit log entry, ordered alphabetically. Depending on the action and the circumstances, a specific log entry may include only a subset of the possible fields.

Personally identifiable information (PII)

Personally identifiable information (PII), such as email addresses and the names of projects, teams, and reports, is available only using the API endpoint option.

• For Self-managed and Dedicated Cloud, an organization admin can exclude PII when fetching audit logs.
• For SaaS Cloud, the API endpoint always returns relevant fields for audit logs, including PII. This is not configurable.

Fetch audit logs

An organization or instance admin can fetch the audit logs for a W&B instance using the Audit Logging API, at the endpoint audit_logs/.

1. Determine the correct API endpoint for your instance:

   • Self-managed: <wandb-platform-url>/admin/audit_logs
   • Dedicated Cloud: <wandb-platform-url>/admin/audit_logs
   • SaaS Cloud (Enterprise required): https://api.wandb.ai/audit_logs

   In proceeding steps, replace <API-endpoint> with your API endpoint.

2. Construct the full API endpoint from the base endpoint, and optionally include URL parameters:

   • anonymize: if set to true, remove any PII; defaults to false. Refer to Exclude PII when fetching audit logs. Not supported for SaaS Cloud.

   • numDays: logs will be fetched starting from today - numdays to most recent; defaults to 0, which returns logs only for today. For SaaS Cloud, you can fetch audit logs from a maximum of 7 days in the past.

   • startDate: an optional date with format YYYY-MM-DD. Supported only on SaaS Cloud.

     startDate and numDays interact:

     • If you set both startDate and numDays, logs are returned from startDate to startDate + numDays.
     • If you omit startDate but include numDays, logs are returned from today to numDays.
     • If you set neither startDate nor numDays, logs are returned for today only.

3. Execute an HTTP GET request on the constructed fully qualified API endpoint using a web browser or a tool like Postman, HTTPie, or cURL.

The API response contains new-line separated JSON objects. Objects will include the fields described in the schema, just like when audit logs are synced to an instance-level bucket. In those cases, the audit logs are located in the /wandb-audit-logs directory in your bucket.

Use basic authentication

To use basic authentication with your API key to access the audit logs API, set the HTTP request’s Authorization header to the string Basic followed by a space, then the base-64 encoded string in the format username:API-KEY. In other words, replace the username and API key with your values separated with a : character, then base-64-encode the result. For example, to authorize as demo:p@55w0rd, the header should be Authorization: Basic ZGVtbzpwQDU1dzByZA==.

Exclude PII when fetching audit logs

For Self-managed and Dedicated Cloud, a W&B organization or instance admin can exclude PII when fetching audit logs. For SaaS Cloud, the API endpoint always returns relevant fields for audit logs, including PII. This is not configurable.

To exclude PII, pass the anonymize=true URL parameter. For example, if your W&B instance URL is https://mycompany.wandb.io and you would like to get audit logs for user activity within the last week and exclude PII, use an API endpoint like:

https://mycompany.wandb.io/admin/audit_logs?numDays=7&anonymize=true.

Actions

This table describes possible actions that can be recorded by W&B, sorted alphabetically.

1: On SaaS Cloud, audit logs are not collected for:

• Open or Public projects.
• The report:read action.
• User actions which are not tied to a specific organization.