Overview
The Audit Trail provides a complete, time-stamped record of all key actions taken across your Layer workspace. It helps your team maintain transparency, meet compliance requirements, and easily investigate activity across projects and users.
Layer automatically logs all important events from asset creation, editing, style trainings, workflow runs to user management and workspace changes - in one centralized, immutable record.
Why It Matters
Accountability: See exactly who did what and when.
Compliance: Supports SOC 2 and enterprise governance needs.
Security: Identify unauthorized or unusual activity quickly.
Transparency: Give admins and auditors a clear view of workspace history.
What’s Tracked
Layer logs actions in the following categories:
Category | Example Events |
Authentication | Logins, SSO sessions, failed sign-ins |
User Management | User invited, removed, reactivated or role changed |
Workspace Settings | Policy updates, integrations enabled/disabled |
Asset Activity | Image or video created, updated, deleted |
Workflow Runs | Model trainings started, completed, failed |
API & Integrations | API token created, rotated, or revoked |
Billing | Plan upgraded, quota adjusted, overage alert triggered |
Event Details
Each audit log entry includes the following data:
Field | Description |
event_id | Unique event identifier |
timestamp | UTC time of the event |
actor | User or system that performed the action |
action | The event type (e.g. |
target | The object affected (asset, user, workspace, etc.) |
workspace_id | Associated workspace or organization |
details | Context (parameters, before/after states) |
source | Origin (UI, API, integration) |
Sensitive information like passwords or API secrets are never recorded in event details.
Viewing the Audit Trail
You can view and filter audit logs directly within Layer:
Workspace → Activity → Events
Displays a chronological list of all workspace activity.Filters: by date range, actor, event type, or resource.
Search: by user, asset, or workflow ID.
Per-object history: asset and workflow pages include scoped “Activity” tabs.
Admins can export the full audit history as CSV
Access & Permissions
Admins can view all workspace activity.
Members can view logs related to their own assets or workflows.
Audit Trail records are read-only and immutable - they cannot be edited or deleted.
Data Retention
Audit logs are retained forever by default.
Enterprise plans can request custom retention periods or external export for compliance.
API Access
Developers can programmatically retrieve audit logs via the Audit Trail API.
Example request:
GET /api/v1/audit?workspace_id=abc123&action=asset.created
Response:
{ "event_id": "evt_12fj39", "timestamp": "2025-10-25T14:35:22Z", "actor": "[email protected]", "action": "asset.created", "target": { "type": "asset", "id": "img_948e2f" }, "details": { "model": "Flux Dev", "resolution": "1024x1024" } }Integrations
Audit Trail data can be exported or forwarded to third-party tools such as:
SIEM systems (Splunk, Datadog, Elastic)
Monitoring dashboards
Security compliance platforms
Notes for Enterprise Users
Audit Trail forms part of Layer’s SOC 2 Type II compliance program.
All logs are timestamped, immutable, and stored in encrypted databases.
Admins can contact support for custom exports or compliance evidence packages.