Audit trail

The audit trail records control-plane activity in your Nango account — the operations that configure it and manage who can reach it: connection changes, integration settings, teammate roles, sign-ins. Each entry captures the actor, the action, the affected resource, and the outcome, so you can answer “who did this, and when” during an incident or a compliance review. Entries are immutable: Nango never edits or deletes one before its retention period ends.

Availability

The audit trail is available on the Enterprise plan, with a default 1 year data retention. Contact us if you would like a demo.

View & export

When enabled for your account, the audit trail lives in the Nango dashboard under Audit trail, in the menu behind your profile. It covers all activity in your account, across all environments.

Exporting to CSV

You can export audit trail entries as a CSV, filtered by time window, resource, and action. A single export returns at most 50,000 entries, most recent first. If your selection holds more, the download still succeeds and the dashboard tells you it was truncated. Narrow the window, or contact support for help with a larger export.

What is recorded

Each entry records: The audit trail covers the main control-plane operations related to connections, integrations, functions, syncs, API keys, environments, team membership, authentication, and billing. The recorded resources and actions are: environment.updated includes changes to environment settings and webhook configuration, including URLs and event subscriptions. Webhook fields appear in metadata.changedFields with the webhooks.* prefix, such as webhooks.primary_url. The former environment.webhook_urls_changed event is no longer emitted; existing entries remain available until their retention period ends. To review webhook changes across historical and current records, include both actions in your filters. connection.metadata_updated and sync.triggered are recorded for actions taken in the dashboard. The equivalent API endpoints — POST / PATCH /connection/metadata and POST /sync/trigger — are data plane operations and are not recorded; see Limitations. function.variant_updated records the requested enabled and frequency settings in its metadata. A frequency of null means the frequency override was reset. Omitted settings are not included. Secrets, such as API keys and passwords, are stripped from audit log entries. Two kinds of reads are recorded: queries to the audit trail itself, and reads that return credentials. A credentials read is recorded as credentials_read, so you can see who accessed a secret. Only control plane credential reads are recorded: those made from the dashboard or through the API endpoints that manage integrations, API keys, and environments. Data plane reads, such as fetching a connection’s credentials with GET /connections/{connectionId}, are not. Control plane credential reads cover:

Actors

Nango support access

Nango staff may access your account to investigate a support request. Actions taken during such a session carry the via field, naming the Nango account that was acting, next to the actor the action was performed as. An entry without via was not reached through a Nango session. via also carries the id of the individual operator, so two Nango people are distinguishable in your trail. It is an id and never a name or email: it identifies them to Nango, not to you. Ask us and we can tell you who it was.

Limitations

The audit trail currently covers the control plane, but not the data plane: API requests used to work with integrations and exchange data with external APIs. For example, the following activities are not covered: