Slack Audit Logs: What They Record, Who Sees Them, and the API

Slack audit logs are a record of actions in a Slack Enterprise organization: who signed in and from which IP address and device, who downloaded a file, joined or left a channel, installed an app, changed a setting or exported data. They do not contain message text, and they do not record reading messages or your active status. Org Owners and members with the Audit Logs Admin role view them in Organization settings > Security > Audit logs, export them as CSV or JSON, or pull them with the Audit Logs API at api.slack.com/audit/v1/logs. Audit logs are only on Enterprise plans.

Your green or away dot is not in the audit log. Slack sets it from keyboard and mouse input on the computer and shows you away after 10 minutes without it.

What Slack audit logs show

Every entry has four parts: an actor (the user), an action, an entity (the user, channel, file, app, workspace or organization acted on) and a context (the workspace or organization, plus IP address, user agent and session ID). A sign-in looks like this, from Slack's API documentation:

{
  "id": "0123a45b-6c7d-8900-e12f-3456789gh0i1",
  "date_create": 1521214343,
  "action": "user_login",
  "actor": { "type": "user", "user": { "id": "W123AB456", "name": "Charlie Parker", "email": "bird@slack.com" } },
  "entity": { "type": "user", "user": { "id": "W123AB456", "name": "Charlie Parker", "email": "bird@slack.com" } },
  "context": {
    "location": { "type": "enterprise", "id": "E1701NCCA", "name": "Birdland", "domain": "birdland" },
    "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) ...",
    "session_id": "847288190092",
    "ip_address": "1.23.45.678"
  }
}

We counted the action types from Slack's public list endpoint on 25 September 2026: 785 actions in 27 groups. On 4 October 2026 the same endpoint listed 795 unique actions in 27 groups, from user and channel to file, huddle, canvas, legal_hold and anomaly, so the list grows by a few actions a week. The ones people ask about most:

Huddle events in the audit log

People searching for a "Slack huddle API" usually want to know what Slack records about huddles. There is no public API that returns huddle audio or transcripts; the audit log records events around them. The 4 October list has 19 actions with "huddle" in the name, 14 in the huddle group and the rest under channel and organization settings:

So an Enterprise admin can see who joined a huddle, when, and whether someone shared a screen or turned on transcription. Nothing in the list carries what was said. What Slack keeps of a huddle itself is in are Slack huddles recorded.

For eDiscovery, the log records the admin side: legal_hold_policy_created and 7 other legal_hold actions, and manual_export_started, scheduled_export_completed and the other export events. The message content itself goes through Slack's Discovery API, which is a separate, approved-partner API rather than the audit log.

Can Slack admins see your activity?

Admins see actions, not reading or typing. An audit log shows that you signed in at 8:52 from a certain IP, joined #hiring, and downloaded a PDF. It does not show which messages you read, how long you had Slack open, or what you typed. Slack's API guide says the audit methods "do not enable monitoring of message content". Message text is a separate route: exports and eDiscovery tools, covered in can Slack be used to monitor employees.

Two related records sit next to the audit log. The search query log lets an Org Owner with a custom role export what members searched for, and Slack's help center says it covers only the last 90 days. Access logs, on non-Enterprise plans, list each sign-in with device and IP. What a login record on the computer itself holds is in can my employer see when I log into my computer.

How to view and export Slack audit logs

• On desktop, click your organization name in the sidebar.
• Choose Tools & settings, then Organization settings.
• Click Security in the left sidebar, then Audit logs.
• Use Filter to narrow by date range, acting user, what was affected (user, workspace or organization) or event.
• Click Export in the top-right corner and choose Export CSV or Export JSON.

The Security Detections tab on the same page lists anomaly events, and admins can sign a member out from an entry there.

Slack Audit Logs API

The API is read-only and has three endpoints on https://api.slack.com/audit/v1/: logs for the events, and schemas and actions for the lists of entity types and action names. The last two need no token, so you can check the current action list yourself:

# number of audit action types Slack lists right now
curl -s https://api.slack.com/audit/v1/actions | jq -r '.actions[][]' | sort -u | wc -l

The logs endpoint needs a user token with the auditlogs:read scope, from an app that the Owner of the Enterprise organization installs on the organization, not on one workspace. Filters are optional query parameters:

A call for last week's sign-ins and file downloads, printed one line per event:

# needs an Enterprise org token with auditlogs:read in SLACK_AUDIT_TOKEN
curl -s -G https://api.slack.com/audit/v1/logs \
  -H "Authorization: Bearer $SLACK_AUDIT_TOKEN" \
  --data-urlencode "action=user_login,file_downloaded" \
  --data-urlencode "oldest=$(date -v-7d +%s)" \
  --data-urlencode "limit=200" |
  jq -r '.entries[] | [(.date_create | todate), .action, .actor.user.email, .context.ip_address] | @tsv'

date -v-7d is the macOS form; on Linux use date -d '7 days ago' +%s. Without a valid token, Slack answers HTTP 401 with an empty body, which we saw when we ran the call with a dummy token on 25 September and again on 4 October; we checked the jq line against the sample entry above. All audit methods are rate-limited at Tier 3, about 50 calls a minute, counted across the whole organization rather than per app.

Sending Slack audit logs to Splunk or a SIEM

Most teams do not call the API by hand. Splunk, Microsoft Sentinel, Datadog, Sumo Logic and other SIEM tools have Slack audit log connectors that poll the same endpoint with the same auditlogs:read token. Set the connector to poll every few minutes and store id as the unique key, because a page can repeat events across polls.

Slack audit log retention

Slack's documentation gives no fixed expiry for audit events, and the API reference says data goes back to March 2018 at the earliest. Keep your own copy in a SIEM if you need a set retention period for compliance. Search query exports are the exception with a stated limit: 90 days. Message retention is separate and set per workspace or channel; changes to it show in the audit log as channel_retention_changed and similar actions.

FAQ

What do Slack audit logs show? Actions such as sign-ins with IP address, file downloads, channel joins, app installs and exports. Not message text.

Can my Slack admin see what messages I read? No. Audit logs record actions, not reading. Message text is only available through exports or eDiscovery.

Who can see Slack audit logs? Org Owners and members with the Audit Logs Admin role, on Enterprise plans.

How long does Slack keep audit logs? Slack states no fixed expiry, and the API returns data back to March 2018. Search query logs cover 90 days.

Is there a Slack audit logs API? Yes. GET api.slack.com/audit/v1/logs with a token that has the auditlogs:read scope, installed by the org Owner.