Audit Logs
Track configuration changes by Admins and Internal Support, troubleshoot issues, and maintain accountability with Glean’s audit logging system
Overview
Glean’s Admin Audit Logs provide comprehensive visibility into administrative actions performed within your Glean instance. These logs serve as a critical tool for troubleshooting configuration issues, maintaining security compliance, and tracking changes made by both internal admins and Glean support staff.
Troubleshoot Configuration Issues
Admin audit logs are essential for diagnosing and resolving configuration problems in your Glean deployment:
Change History Tracking
Review chronological changes to identify when and what modifications were made to your configuration
Root Cause Analysis
Quickly identify the source of issues by correlating problems with recent configuration changes
Compliance Reporting
Generate reports for security audits, compliance reviews, and regulatory requirements
External Analysis
Import data into business intelligence tools or custom analytics platforms
Audit Log Features
Coverage
Data Source Configuration
Data Source Configuration
- Connector setup and modifications
- Failures during connector setup
- Connector creation and deletion
- Crawl schedule changes
System Configuration
System Configuration
- Feature enablement and disablement
- Global configuration changes
- Branding and customization changes
API Endpoints
API Endpoints
- All API calls made by users and applications
- Authentication and authorization events
- Data access and modification activities
- System configuration changes via API
Tracked API Endpoints
Glean’s audit logs capture all API endpoint calls to provide comprehensive visibility into user activities. Below is a complete list of the API endpoints that are tracked in audit logs:
| Endpoint | Description |
|---|---|
/api/v1/search | Performs a general-purpose search. |
/api/v1/llmrealtimeproxy | Proxies real-time LLM (Large Language Model) requests. |
/api/v1/chat | Starts a new chat session or sends a message. |
/api/v1/chat/refine | Refines an existing chat session or message. |
/api/v1/templatedchat | Initiates a chat session using a template. |
/api/v1/deletetemplatedchat | Deletes a templated chat session. |
/api/v1/ask | Handles question-answering or chat queries. |
/api/v1/createagentsubscription | Creates a new agent subscription. |
/api/v1/editagentsubscription | Edits an existing agent subscription. |
/api/v1/listcontenttriggertemplates | Lists templates for content-based triggers. |
/api/v1/listagentsubscriptions | Lists all agent subscriptions. |
/api/v1/deleteagentsubscription | Deletes an agent subscription. |
/api/v1/createworkflow | Creates a new workflow. |
/api/v1/getworkflow | Retrieves details of a specific workflow. |
/api/v1/listworkflows | Lists all workflows. |
/api/v1/editworkflow | Edits an existing workflow. |
/api/v1/deleteworkflows | Deletes one or more workflows. |
/api/v1/runworkflow | Runs a specific workflow. |
/api/v1/listworkflowexecutions | Lists executions of workflows. |
/api/v1/getworkflowexecution | Gets details of a workflow execution. |
/api/v1/getworkflowtrace | Retrieves trace information for a workflow. |
/api/v1/getsessionworkflowtrace | Gets workflow trace for a session. |
/api/v1/runagentsubscription | Runs an agent subscription. |
/api/v1/createprompttemplate | Creates a new prompt template. |
/api/v1/getprompttemplate | Retrieves a prompt template. |
/api/v1/editprompttemplate | Edits a prompt template. |
/api/v1/deleteprompttemplates | Deletes prompt templates. |
/api/v1/listprompttemplates | Lists all prompt templates. |
/api/v1/generateadvancedpromptschema | Generates a schema for advanced prompts. |
/api/v1/convertprompttemplatetoagent | Converts a prompt template to an agent. |
/api/v1/rewriteprompt | Rewrites a prompt for optimization. |
/api/v1/deleteallchats | Deletes all chat sessions for a user. |
/api/v1/deletechats | Deletes one or more chat sessions. |
/api/v1/getchat | Retrieves details of a specific chat session. |
/api/v1/getchatapplication | Gets information about a chat application. |
/api/v1/listchatapplications | Lists available chat applications (e.g., bots). |
/api/v1/listchats | Lists all chat sessions for a user. |
/api/v1/createpaperinchat | Creates a paper (document) in a chat. |
/api/v1/getallpapersinchat | Lists all papers in a chat. |
/api/v1/getpaper | Retrieves a specific paper from a chat. |
/api/v1/editpaper | Edits a paper in a chat. |
/api/v1/deletepaper | Deletes a paper from a chat. |
/api/v1/uploadchatfiles | Uploads files to a chat session. |
/api/v1/downloadchatfile/{fileId} | Downloads a file from a chat session. |
/api/v1/getchatfiles | Lists files uploaded to a chat. |
/api/v1/deletechatfiles | Deletes files from a chat. |
/api/v1/uploadfilesforagent | Uploads files for use by an agent. |
/api/v1/getfilesforagent | Lists files available to an agent. |
/api/v1/listgleanbotchannels | Lists available Gleanbot channels. |
/api/v1/executeactiontool | Executes a specific action or tool. |
/api/v1/adminsearch | Performs an admin-level search. |
/api/v1/autocomplete | Provides autocomplete suggestions. |
/api/v1/deletequeryhistory | Deletes a user’s query history. |
/api/v1/images | Retrieves images or image metadata. |
/api/v1/uploadimage | Uploads an image. |
/api/v1/pin | Pins an item for quick access. |
/api/v1/unpin | Unpins a previously pinned item. |
/api/v1/editpin | Edits a pinned item. |
/api/v1/listpins | Lists all pinned items. |
/api/v1/getpin | Retrieves details of a pinned item. |
/api/v1/people | Lists or searches for people. |
/api/v1/downloadpeople | Downloads people data. |
/api/v1/downloadentities | Downloads entity data. |
/api/v1/teams | Lists or manages teams. |
/api/v1/createteams | Creates new teams. |
/api/v1/deleteteams | Deletes teams. |
/api/v1/knowledgegraph/entities | Lists entities in the knowledge graph. |
/api/v1/digestrecommendations | Provides digest recommendations. |
/api/v1/agentrecommendations | Provides agent recommendations. |
/api/v1/invite | Sends an invitation to join Scio. |
/api/v1/slackdigests | Sends or retrieves Slack digests. |
/api/v1/support | Sends a support request. |
/api/v1/supportwidgetsettings | Gets settings for the support widget. |
/api/v1/customentities | Lists or manages custom entities. |
/api/v1/createcustomentity | Creates a custom entity. |
/api/v1/editcustomentity | Edits a custom entity. |
/api/v1/deletecustomentity | Deletes a custom entity. |
/api/v1/savestructuredresult | Saves a structured result. |
/api/v1/verify | Verifies an item or user. |
/api/v1/addverificationreminder | Adds a verification reminder. |
/api/v1/listverifications | Lists verification items or statuses. |
/api/v1/listusersettings | Lists user settings. |
/api/v1/saveusersettings | Saves user settings. |
/api/v1/feed | Retrieves a personalized feed. |
/api/v1/getevents | Lists or retrieves events. |
/api/v1/createanswer | Creates an answer (knowledge base). |
/api/v1/deleteanswer | Deletes an answer. |
/api/v1/editanswer | Edits an answer. |
/api/v1/previewanswer | Previews an answer before saving. |
/api/v1/getanswer | Retrieves a specific answer. |
/api/v1/summarize | Summarizes text or content. |
/api/v1/listanswers | Lists all answers. |
/api/v1/updateanswerlikes | Updates likes for an answer. |
/api/v1/editfavorites | Edits a user’s favorites. |
/api/v1/createanswerboard | Creates an answer board (collection). |
/api/v1/deleteanswerboards | Deletes answer boards. |
/api/v1/editanswerboard | Edits an answer board. |
/api/v1/listanswerboards | Lists answer boards. |
/api/v1/getanswerboard | Retrieves a specific answer board. |
/api/v1/transcribe | Transcribes audio to text. |
/api/v1/get_sample_queries | Retrieves sample queries. |
/api/v1/set_query_labels | Sets labels for queries. |
/api/v1/get_sessions | Lists user sessions. |
/api/v1/get_ranking_evalset | Gets a ranking evaluation set. |
/api/v1/get_spellcheck_eval_result | Gets spellcheck evaluation results. |
/api/v1/run_spellcheck_eval | Runs a spellcheck evaluation. |
/api/v1/run_server_ranking_eval | Runs a server-side ranking evaluation. |
/api/v1/run_judge | Runs a judge evaluation. |
/api/v1/delete_server_eval | Deletes a server evaluation. |
/api/v1/get_eval_set_types | Gets types of evaluation sets. |
/api/v1/get_server_run_evals | Gets server run evaluations. |
/api/v1/get_default_judge_config | Gets default judge configuration. |
/api/v1/update_eval_entry_annotations | Updates evaluation entry annotations. |
/api/v1/config | Retrieves application configuration. |
/api/v1/listtools | Lists available tools. |
/api/v1/deleteactionpack | Deletes an action pack. |
/api/v1/listsupportedactionpacks | Lists supported action packs. |
/api/v1/validateactionpackauth | Validates action pack authentication. |
/api/v1/listcontentrenderedactions | Lists content-rendered actions. |
/api/v1/configureaction | Configures an action. |
/api/v1/getaction | Retrieves a specific action. |
/api/v1/deleteaction | Deletes an action. |
/api/v1/configureactioninstance | Configures an action instance. |
/api/v1/deleteactioninstance | Deletes an action instance. |
/api/v1/listactioninstances | Lists action instances. |
/api/v1/generateaction | Generates a new action. |
/api/v1/validateactionapispec | Validates an action API specification. |
/api/v1/publicclientconfig | Gets public client configuration. |
/api/v1/recommendations | Provides recommendations. |
/api/v1/checkauth | Checks user authentication status. |
/api/v1/checkactasauth | Checks “act as” authentication. |
/api/v1/documentmetadata | Retrieves document metadata. |
/api/v1/messages | Sends or retrieves messages. |
/api/v1/insights | Retrieves insights or analytics. |
/api/v1/downloadinsights | Downloads insights data. |
/api/v1/peoplesuggest | Suggests people based on input. |
/api/v1/peoplesuggestadmin | Admin endpoint for people suggestions. |
/api/v1/createannouncement | Creates an announcement. |
/api/v1/updateannouncement | Updates an announcement. |
/api/v1/listannouncements | Lists announcements. |
/api/v1/previewannouncement | Previews an announcement. |
/api/v1/previewannouncementdraft | Previews a draft announcement. |
/api/v1/previewanswerdraft | Previews a draft answer. |
/api/v1/getannouncement | Retrieves a specific announcement. |
/api/v1/deleteannouncement | Deletes an announcement. |
/api/v1/unpublishannouncement | Unpublishes an announcement. |
/api/v1/getdraftannouncement | Retrieves a draft announcement. |
/api/v1/deletedraftannouncement | Deletes a draft announcement. |
/api/v1/createdraftannouncement | Creates a draft announcement. |
/api/v1/updatedraftannouncement | Updates a draft announcement. |
/api/v1/publishdraftannouncement | Publishes a draft announcement. |
/api/v1/addcredential | Adds a user credential. |
/api/v1/removecredential | Removes a user credential. |
/api/v1/createcollection | Creates a collection. |
/api/v1/editcollection | Edits a collection. |
/api/v1/editcollectionitem | Edits an item in a collection. |
/api/v1/deletecollection | Deletes a collection. |
/api/v1/listcollections | Lists all collections. |
/api/v1/movecollectionitem | Moves an item within a collection. |
/api/v1/getcollection | Retrieves a specific collection. |
/api/v1/pincollection | Pins a collection. |
/api/v1/editdocumentcollections | Edits document collections. |
/api/v1/addcollectionitems | Adds items to a collection. |
/api/v1/deletecollectionitem | Deletes an item from a collection. |
/api/v1/listentities | Lists entities. |
/api/v1/createdisplayablelists | Creates displayable lists. |
/api/v1/deletedisplayablelists | Deletes displayable lists. |
/api/v1/updatedisplayablelists | Updates displayable lists. |
/api/v1/getdisplayablelists | Retrieves displayable lists. |
/api/v1/editpermissions | Edits permission settings. |
/api/v1/editgrouppermissions | Edits group permission settings. |
/api/v1/getdocuments | Retrieves documents. |
/api/v1/getdocumentsbyfacets | Retrieves documents by facets. |
/api/v1/getdocumentanalytics | Retrieves document analytics. |
/api/v1/previewshortcut | Previews a shortcut. |
/api/v1/createauthtoken | Creates an authentication token. |
/api/v1/createanonymoustoken | Creates an anonymous token. |
/api/v1/createshortcut | Creates a shortcut. |
/api/v1/updateshortcut | Updates a shortcut. |
/api/v1/deleteshortcut | Deletes a shortcut. |
/api/v1/getshortcut | Retrieves a shortcut. |
/api/v1/getsimilarshortcuts | Gets similar shortcuts. |
/api/v1/listshortcuts | Lists all shortcuts. |
/api/v1/classifyintent | Classifies user intent. |
/api/v1/validatellmc | Validates LLM configuration. |
/api/v1/listllmcforagents | Lists LLM configurations for agents. |
This comprehensive list helps you understand what user activities are being tracked in your audit logs. You can use this information to set up monitoring, investigate specific user actions, or ensure compliance with your organization’s security policies.
Advanced Search and Filtering
Efficiently locate specific audit entries using powerful search capabilities:
- Time Range Filtering: Narrow down logs to specific dates or time periods
- User-Based Filtering: View actions by specific admins
- Action Type Filtering: Focus on particular types of changes (e.g., data source changes, global configuration changes)
- Keyword Search: Find logs containing specific configuration names or values
Use a combination of filters to quickly identify patterns or investigate specific incidents. For example, filter by “Past week” + “Admin” + “Failures” to review recent failures to setup triggered by an admin.
Export and Reporting
Export audit log data for external analysis, compliance reporting, and long-term record keeping:
Access Export Feature
Navigate to Admin Console > Settings > Audit Logs
Apply Filters
Use the filtering options to select the specific logs you want to export
Export to CSV
Click the “Export to CSV” button to download your filtered audit log data
CSV exports include all available log fields including timestamps, user identities, action descriptions, affected resources, and change details.
Audit Log Retention
Default Retention Period
Glean maintains audit logs for a standard retention period to balance storage efficiency with administrative needs. The default retention period of 30 days ensures you have sufficient historical data for typical troubleshooting and compliance requirements.
Custom Retention Periods
If your organization requires a longer audit log retention period for compliance, security, or operational reasons, contact your Glean representative to discuss custom retention options.
When to Consider Extended Retention
- Compliance Requirements: Regulatory or industry standards requiring longer data retention
- Security Investigations: Need for extended historical analysis capabilities
- Organizational Policies: Internal governance requiring longer audit trails
- Change Management: Extended rollback and analysis capabilities
How to Request Retention Changes
Assess Requirements
Determine your specific retention needs based on compliance, security, and operational requirements
Contact Glean
Reach out to your Glean Customer Success Manager or Account Representative
Provide Details
Share your retention requirements, justification, and any compliance standards that apply
Implementation
Glean will work with you to implement the appropriate retention period for your needs
Security Considerations
- Restrict audit log access to appropriate admins only
- Regularly export logs for backup and compliance purposes
- Monitor for suspicious administrative activity patterns
- Maintain separate secure storage for exported audit data
Accessing Audit Logs
Navigate to Admin Console > Settings > Audit Logs to view, search, and export your audit log data.
Access to audit logs requires appropriate administrative privileges. Contact your Glean admin if you need access to review audit log data.
For questions about audit log retention, custom compliance requirements, or advanced audit capabilities, contact your Glean Customer Success Manager or support team.