Slack Audit Logs: What They Record, Who Sees Them, and the API

Slack audit logs are a record of actions in a Slack Enterprise organization: who signed in and from which IP address and device, who downloaded a file, joined or left a channel, installed an app, changed a setting or exported data. They do not contain message text, and they do not record reading messages or your active status. Org Owners and members with the Audit Logs Admin role view them in Organization settings > Security > Audit logs, export them as CSV or JSON, or pull them with the Audit Logs API at api.slack.com/audit/v1/logs. Audit logs are only on Enterprise plans.

Your green or away dot is not in the audit log. Slack sets it from input in the Slack window and shows you away after 10 minutes without it. Slack Green keeps your status green during the hours you set, from a server.

What Slack audit logs show

Every entry has four parts: an actor (the user), an action, an entity (the user, channel, file, app, workspace or organization acted on) and a context (the workspace or organization, plus IP address, user agent and session ID). A sign-in looks like this, from Slack's API documentation:

{
  "id": "0123a45b-6c7d-8900-e12f-3456789gh0i1",
  "date_create": 1521214343,
  "action": "user_login",
  "actor": { "type": "user", "user": { "id": "W123AB456", "name": "Charlie Parker", "email": "bird@slack.com" } },
  "entity": { "type": "user", "user": { "id": "W123AB456", "name": "Charlie Parker", "email": "bird@slack.com" } },
  "context": {
    "location": { "type": "enterprise", "id": "E1701NCCA", "name": "Birdland", "domain": "birdland" },
    "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) ...",
    "session_id": "847288190092",
    "ip_address": "1.23.45.678"
  }
}

We counted the action types from Slack's public list endpoint on 25 September 2026: 785 actions in 27 groups, from user and channel to file, huddle, canvas, workflow and anomaly. The ones people ask about most:

Can Slack admins see your activity?

Admins see actions, not reading or typing. An audit log shows that you signed in at 8:52 from a certain IP, joined #hiring, and downloaded a PDF. It does not show which messages you read, how long you had Slack open, or what you typed. Slack's API guide says the audit methods "do not enable monitoring of message content". Message text is a separate route: exports and eDiscovery tools, covered in can Slack be used to monitor employees.

Two related records sit next to the audit log. The search query log lets an Org Owner with a custom role export what members searched for, and Slack's help center says it covers only the last 90 days. Access logs, on non-Enterprise plans, list each sign-in with device and IP. What a login record on the computer itself holds is in can my employer see when I log into my computer.

How to view and export Slack audit logs

• On desktop, click your organization name in the sidebar.
• Choose Tools & settings, then Organization settings.
• Click Security in the left sidebar, then Audit logs.
• Use Filter to narrow by date range, acting user, what was affected (user, workspace or organization) or event.
• Click Export in the top-right corner and choose Export CSV or Export JSON.

The Security Detections tab on the same page lists anomaly events, and admins can sign a member out from an entry there.

Slack Audit Logs API

The API is read-only and has three endpoints on https://api.slack.com/audit/v1/: logs for the events, and schemas and actions for the lists of entity types and action names. The last two need no token, so you can check the current action list yourself:

# number of audit action types Slack lists right now
curl -s https://api.slack.com/audit/v1/actions | jq -r '.actions[][]' | sort -u | wc -l

The logs endpoint needs a user token with the auditlogs:read scope, from an app that the Owner of the Enterprise organization installs on the organization, not on one workspace. Filters are optional query parameters:

A call for last week's sign-ins and file downloads, printed one line per event:

# needs an Enterprise org token with auditlogs:read in SLACK_AUDIT_TOKEN
curl -s -G https://api.slack.com/audit/v1/logs \
  -H "Authorization: Bearer $SLACK_AUDIT_TOKEN" \
  --data-urlencode "action=user_login,file_downloaded" \
  --data-urlencode "oldest=$(date -v-7d +%s)" \
  --data-urlencode "limit=200" |
  jq -r '.entries[] | [(.date_create | todate), .action, .actor.user.email, .context.ip_address] | @tsv'

date -v-7d is the macOS form; on Linux use date -d '7 days ago' +%s. Without a valid token, Slack answers HTTP 401 with an empty body, which we saw when we ran the call with a dummy token; we checked the jq line against the sample entry above. All audit methods are rate-limited at Tier 3, about 50 calls a minute, counted across the whole organization rather than per app.

Sending Slack audit logs to Splunk or a SIEM

Most teams do not call the API by hand. Splunk, Microsoft Sentinel, Datadog, Sumo Logic and other SIEM tools have Slack audit log connectors that poll the same endpoint with the same auditlogs:read token. Set the connector to poll every few minutes and store id as the unique key, because a page can repeat events across polls.

Slack audit log retention

Slack's documentation gives no fixed expiry for audit events, and the API reference says data goes back to March 2018 at the earliest. Keep your own copy in a SIEM if you need a set retention period for compliance. Search query exports are the exception with a stated limit: 90 days. Message retention is separate and set per workspace or channel; changes to it show in the audit log as channel_retention_changed and similar actions.

FAQ

What do Slack audit logs show? Actions such as sign-ins with IP address, file downloads, channel joins, app installs and exports. Not message text.

Can my Slack admin see what messages I read? No. Audit logs record actions, not reading. Message text is only available through exports or eDiscovery.

Who can see Slack audit logs? Org Owners and members with the Audit Logs Admin role, on Enterprise plans.

How long does Slack keep audit logs? Slack states no fixed expiry, and the API returns data back to March 2018. Search query logs cover 90 days.

Is there a Slack audit logs API? Yes. GET api.slack.com/audit/v1/logs with a token that has the auditlogs:read scope, installed by the org Owner.