Audit logs
The Helios audit log: what is recorded, who can see it, the monthly fee, filters and CSV download, retention and where events are stored.
The audit log records every change made in your Helios organization: who made it, what changed, when, and from where. Organization admins can view it, filter it and download it as CSV from Audit Logs in the sidebar, at /helios/audit-logs.
What you need
You must be an organization admin, and your organization needs an active subscription. Audit logs add $400/month once you turn them on.
What is recorded
Every change made through the Helios app, the CLI or the API is recorded. Reads are not. Changes are recorded for:
- Access: grants and their revocation, groups and their members, service accounts, and resources linked to or unlinked from a project.
- Projects and workflows: projects, agent workflows and their trigger secrets, chat sharing and chat participants.
- Variables and secrets at the user, project and organization level. The name is recorded. The value never is.
- Connections: integrations, database connections, MCP servers, network configuration, and outbound webhook targets.
- Sandboxes: sandbox images and image versions, sandbox environments, sandbox launches and kills, and configuration overrides.
- Organization: the audit log switch itself, and a request to delete the organization.
Not recorded: chat turns, workflow runs and tool calls, Library file edits, sandbox session traffic, webhooks received from providers, and personal preferences.
A request that was refused because the caller was not allowed to make the change is recorded with the outcome Denied. Requests that fail for other reasons, such as invalid input or an error on our side, are not recorded.
Each event has the following fields.
| Field | What it holds |
|---|---|
| Actor | Who made the change: a user, a service account or WarpBuild staff. A change made with an API key is attributed to the user who owns the key and marked as made with an API key. Changes made by WarpBuild staff appear as WarpBuild support. |
| Action | What was done, as <resource>.<verb>, for example group.created or integration.deleted. |
| Target | The type, id and name of what was changed, for example a group or an integration. |
| Outcome | Success, or Denied when the caller was not allowed to make the change. Nothing changes on a denied request. |
| Time | When it happened, in UTC. |
| Changes | For some actions, the fields that changed with their values before and after, for example a grant's role or a group's members. Variable and secret values are never included. |
| Request | The IP address, user agent, HTTP method and path, status code and request id of the request that made the change. |
Who can see it
Only organization admins can open the page or call the API. Members and viewers cannot.
Turning it on and the fee
Events are recorded for every organization from the start, whether or not the log is turned on. Turning it on gives admins access to the log, including the events recorded before it was turned on, and adds $400/month to your subscription.
To turn it on, open Audit Logs in the sidebar and click Turn on audit logs. The fee is not prorated: the rest of the current billing month is free, and every invoice after that carries the full fee.
To turn it off, open the More actions menu (⋯) at the top of the page and choose Turn off audit logs. Admins lose access to the log until it is turned on again, and the fee comes off your subscription with no credit for the rest of the month. Events keep being recorded.
Filtering
The page shows the last 30 days by default, newest first, 20 events per page. Pick another date range at the top of the page, and filter by:
- Action: one action name, typed exactly, for example
group.created. - Actor: one person or one service account.
- Target id: the id of one resource, for example a project or an integration.
- Outcome: Success or Denied.
Click an event to open it. The panel shows what changed, the actor, the target and the request. The filters and the open event are in the page URL, so a link to a filtered view or to a single event can be shared with another admin.
Download
Click Download CSV at the top of the page. The file has the events that match the current date range and filters, newest first, up to 10,000 of them. For a larger range, narrow the dates and download more than once.
Retention and storage
The log holds the last 13 months of events. Each event is also written, as it happens, to write-once storage, where it is locked. Nobody, including WarpBuild, can change or delete it.
Helios stores audit events in the United States.
API
The log is available through the API for organization admins. Authenticate with an API key scoped to Helios. GET /audit-events lists events, newest first, and takes the same filters as the page: startDate, endDate, actorId, action, targetType, targetId, outcome, page and perPage. format=csv downloads them as CSV. GET /audit-events/{id} returns one event. The API answers 402 while the log is turned off.
curl "https://<helios-host>/audit-events?startDate=2026-10-01T00:00:00Z&action=group.created" \
-H "Authorization: Bearer <your-api-key>"Related
- Team management - organization roles, and who counts as an admin.
- Roles and permissions - what each role can do, and API keys.
Last updated on
Team management
Members are managed in the organization settings that Helios shares with WarpBuild. Invite by email, pick a role, and remove people when they leave.
Variables and secrets
Variables are plaintext configuration passed to your agents. Secrets are envelope-encrypted values that never enter an agent's context.