> ## Documentation Index
> Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit and API access

> Review administrative activity and create scoped machine access.

## Audit activity

Organization administrators can review activity under
**Settings → Security & permissions → Audit trail**.

Filter by category or outcome. Search by an automation's public key, slug, or name, or by the
name of the person or service account that acted. Public keys and slugs match exactly, without
case sensitivity. Names match part of the text, including punctuation. Enter at least three
characters; search text can contain up to 128 characters.

Select **Load more** to continue through retained events you can access. Select **Refresh audit
log** to start with the latest events. If loading another page fails, your loaded rows remain
available. Select **Retry audit log** to continue.

The Actor and Subject columns identify who acted and what the action affected. Open a row's
**Show audit details** control for full labels, original identifiers, delegation, and request
context. A **recorded** label preserves available evidence from the event. A **current** label
uses the present name. **Unavailable** means Flow cannot establish the historical label.
Renaming or removing a subject does not change a recorded label.

Use **Copy JSON** when an authorized reviewer needs the full event details. The audit trail
covers retained events within your access. It does not restore events removed under the
organization's retention policy.

Successful automation creation, revision saves, and details renames appear in the audit trail.
Connecting a new account also creates an event. Unchanged edits, reconnects, and completed setup
retries don't add creation or save events. Preparing a connection without completing it doesn't
create a success event.

These events identify the acting account, scope, affected record, and revision when applicable.
They exclude automation source, names, descriptions, credentials, and provider account details.
Use the **Automations** or **Integrations** categories, or clear the category filter, to find them.

Keep the event time and request or correlation ID when contacting support.

### Forward security events

Audit log forwarding is optional.

<Steps>
  <Step title="Open forwarding details.">
    Under **Settings → Security & permissions**, open **Audit log forwarding** and select
    **Show forwarding details**.
  </Step>

  <Step title="Configure or manage the destination.">
    Select **Configure forwarding** to set up a destination, or **Manage forwarding** to change an
    existing setup. Complete any identity setup requested on the page first.
  </Step>

  <Step title="Refresh and review status.">
    Select **Refresh status** and review the destination and delivery status.
  </Step>
</Steps>

Forwarding sends selected security events to your configured destination; the audit trail remains
available in Flow.

## Create machine access

<Steps>
  <Step title="Open API and MCP access.">
    Open **Settings → API & MCP Access**.
  </Step>

  <Step title="Create a service account.">
    Select **Create service account**.
  </Step>

  <Step title="Name it and set team access.">
    Name the account and choose its team access.
  </Step>

  <Step title="Create an API key.">
    Select **Create API key**.
  </Step>

  <Step title="Scope the key.">
    Choose only the scope families the integration needs. Set an expiration if the key should stop
    working on a specific date.
  </Step>

  <Step title="Store the secret.">
    Copy the secret and store it in your secret manager. Flow will not show it again.
  </Step>
</Steps>

Use one service account per integration. Name it for the job it performs, not a person.

Expiration is optional. Leaving it blank creates a key with no scheduled expiry. You can revoke or
rotate it when needed.

| Scope family | Allows |
| - | - |
| `runtime.read` / `runtime.write` | Read or change runtime data |
| `builder.read` / `builder.write` | Read or publish automation artifacts |
| `integration.read` / `integration.write` | Read or manage integration bindings |

Scopes do not bypass the service account's organization and team access.

## Removing access

| Action | Effect |
| - | - |
| **Rotate** | Replaces a key |
| **Revoke** | Stops one key |
| **Disable** | Stops the service account and revokes all of its active keys |

Hosted MCP uses OAuth, not an API key. Organization administrators can restrict every MCP connection to read-only with the **MCP access mode** control under **Settings → API & MCP Access**; mode changes appear in the audit trail. See [Hosted MCP](/setup/mcp#mcp-access-mode).

## Related topics

* [Product security](/setup/security)
* [Hosted MCP](/setup/mcp)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.