Audit Logs - Harvey

The Audit Log API allows customers to query audit logs for their workspace. These APIs cover ways to query audit logs at a given time or from an ID and how to paginate through audit logs over time.

The current API request rate limits for Audit Log API endpoints are 60 requests per minute.

GET /api/v1/logs/audit/search
GET /api/v1/logs/audit/earliest
GET /api/v1/logs/audit/latest
GET /api/v1/logs/audit

Overview

Use the Audit Log API to:

Track User Activity: Monitor all actions taken by users in your workspace
Maintain Compliance: Keep detailed records for audit and compliance purposes
Investigate Incidents: Retrieve historical logs to investigate specific events
Export Records: Fetch and store audit logs in your own systems

Endpoints

Search Audit Logs

GET /api/v1/logs/audit/search

Returns the audit log at or after a specified timestamp. Useful to begin pagination from a specific point in time. Parameters:

time (required): UTC epoch timestamp, up to 1 year old from now
log_type (optional): Filter to return only logs of a specific type (e.g., auth:login, admin:add_users)

Example:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/search?time=1712066546" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Example with filtering by log type:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/search?time=1712066546&log_type=auth:login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Get Earliest Audit Log

GET /api/v1/logs/audit/earliest

Returns the earliest audit log for the workspace. Useful to begin pagination from the very beginning. Parameters:

log_type (optional): Filter to return only logs of a specific type (e.g., auth:login, admin:add_users)

Example:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/earliest" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Example with filtering by log type:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/earliest?log_type=auth:login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Get Latest Audit Log

GET /api/v1/logs/audit/latest

Returns the latest audit log for the workspace. Useful to begin pagination from the most recent event. Parameters:

log_type (optional): Filter to return only logs of a specific type (e.g., auth:login, admin:add_users)

Example:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/latest" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Example with filtering by log type:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/latest?log_type=auth:login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Query Audit Logs

GET /api/v1/logs/audit

Paginates forward in time from a given audit log ID. Use this endpoint to fetch multiple log entries at once. Parameters:

from (required): Audit log ID to begin fetching from (UUID format)
take (required): Number of audit log entries to fetch (max 1000)
log_type (optional): Filter to return only logs of a specific type (e.g., auth:login, admin:add_users)

Example:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit?from=018e983f-d10f-72aa-9c94-d8263e53c6a4&take=100" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Example with filtering by log type:

curl -X GET "https://api.harvey.ai/api/v1/logs/audit?from=018e983f-d10f-72aa-9c94-d8263e53c6a4&take=100&log_type=auth:login" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Use Cases

Use Case 1: Compliance Monitoring and Audit Trail Capture

Challenge: Organizations must maintain detailed records of all user activity for compliance and regulatory requirements. Solution: Regularly fetch and store audit logs using the pagination workflow. Each log entry includes the user, timestamp, IP address, and action type.

Use Case 2: Incident Response and User Investigations

Challenge: When investigating a security incident, teams need to reconstruct what happened during a specific time period. Solution: Use /search?time=<timestamp> to start from a specific point in time, then paginate through subsequent logs to track all activity during the incident window.

Use Case 3: Continuous Monitoring

Challenge: Security teams need to monitor recent activity in near real-time. Solution: Periodically poll /latest to get the most recent log entry, then use /audit?from=<last_seen_id>&take=100 to fetch any new logs since the last check.

Regular Cadence Fetching

For continuous monitoring and compliance requirements, you’ll want to fetch audit logs on a regular schedule. Here’s the recommended approach:

Initial Backfill

If you’re setting up audit log collection for the first time:

import requests
import time

token = "YOUR_API_KEY"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {token}"
}

# Start from the earliest log
response = requests.get("https://api.harvey.ai/api/v1/logs/audit/earliest", headers=headers)
current_log = response.json()["log"]

# Save to your database
save_to_database([current_log])
last_processed_id = current_log["id"]

# Paginate through all historical logs
while True:
    time.sleep(1)  # Respect 60 req/min rate limit
    
    response = requests.get(
        f"https://api.harvey.ai/api/v1/logs/audit?from={last_processed_id}&take=1000",
        headers=headers
    )
    
    logs = response.json()
    if not logs:
        break
    
    save_to_database(logs)
    last_processed_id = logs[-1]["id"]
    print(f"Processed {len(logs)} logs, last ID: {last_processed_id}")

# Store checkpoint in database
save_checkpoint(last_processed_id)

Incremental Updates

After your initial backfill, run this on a regular schedule (e.g., every 5-15 minutes):

import requests
import time

token = "YOUR_API_KEY"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {token}"
}

# Load the last processed ID from your database
last_processed_id = load_checkpoint()

# Fetch new logs since last check
response = requests.get(
    f"https://api.harvey.ai/api/v1/logs/audit?from={last_processed_id}&take=1000",
    headers=headers
)

new_logs = response.json()
if new_logs:
    save_to_database(new_logs)
    
    # Update the checkpoint
    last_processed_id = new_logs[-1]["id"]
    save_checkpoint(last_processed_id)
    
    print(f"Fetched {len(new_logs)} new logs")
else:
    print("No new logs since last check")

Scheduling Recommendations

High-activity workspaces: Poll every 5-10 minutes with take=1000
Medium-activity workspaces: Poll every 15-30 minutes with take=500
Low-activity workspaces: Poll hourly with take=100

Key Considerations

Persistent storage: Always save the last processed log ID to disk/database so your process can resume after restarts.
Idempotency: Audit logs are immutable, so it’s safe to reprocess the same log multiple times if needed.
Error handling: If a fetch fails, retry from the same log ID and don’t skip ahead.
Rate limiting: With the 60 req / min, fetching 1000 logs takes approximately 1 second per batch. Plan your cadence accordingly.
Gap detection: Monitor timestamps to detect if you’re falling behind. If the latest fetched timestamp is more than your polling interval old, increase frequency or batch size.

Best Practices

Respect rate limits: The API is limited to 60 requests per minute. Implement appropriate delays in your polling logic
Store logs externally: Export audit logs to your own SIEM or audit repository for long-term retention and analysis
Handle timestamps correctly: The time parameter uses UTC epoch timestamps (seconds since January 1, 1970)
Track pagination state: Always save the last processed log ID to persistent storage to resume pagination if your process is interrupted
Monitor for new event types: The API may add new event types over time, so build your parsing logic to handle unknown types gracefully
Implement retries with backoff: If you hit rate limits or encounter errors, implement exponential backoff before retrying
Deduplicate on ingestion: Use the log id field as a unique identifier to prevent duplicate storage if you need to reprocess logs
Set up alerting: Monitor your sync process to ensure logs are being fetched regularly and alert if the process fails
Use log_type filtering when needed: When you only need specific types of logs, use the log_type parameter to filter server-side and reduce bandwidth, processing overhead, and API calls

Error Handling

Status Code	Description	Example Error Message
200	Success	N/A
400	Bad Request – Invalid query input	`{ "error": "Missing required filters" }`
401	Unauthorized – Invalid API key	`{ "error": "Unauthorized" }`
429	Too Many Requests – Rate limit exceeded	`{ "error": "Rate limit exceeded" }`
500	Internal Server Error	`{ "error": "Unexpected server error" }`

Audit Log Types

Each audit log entry carries a type field naming the action performed. The tables below list every type the API returns, grouped by product area. Every value except the ones under Retired log types is also accepted by the log_type query parameter. Harvey adds types as new functionality ships, so treat this list as a snapshot of the current set rather than a closed set, and parse an unrecognized type gracefully.

Types in the internal, internal_admin, and internal_mgmt categories record actions Harvey personnel take in Harvey’s own administrative tooling. They are excluded from the workspace admin audit log view and are not listed here, though some can still appear in API responses.

API Operations

Audit Log Type	Description
`api:action_control_bulk_set`	Bulk sets action controls via API
`api:action_control_bulk_set_for_resources`	Bulk sets action controls for a set of resources via API
`api:action_control_set`	Sets an action control via API
`api:agent_run_create`	Starts an agent run via API
`api:agent_run_get`	Fetches an agent run via API
`api:audit_log_fetch`	Fetches audit logs via API
`api:can_user_redirect`	Checks whether a user can be redirected to an SSO connection via API
`api:case_summarization`	Summarizes a case via API
`api:case_summarization_upload_zip_file`	Uploads a ZIP archive of case files for summarization via API
`api:client_matter_management`	Manages client matters via API
`api:create_query`	Creates a query via API
`api:files_download`	Downloads files via API
`api:generate_timekeeping_summary`	Generates a timekeeping summary via API
`api:history_fetch`	Fetches history records via API
`api:icertis_batch_field_extraction`	Extracts fields from a batch of Icertis documents via API
`api:icertis_delete_batch_field_extraction_files`	Deletes Icertis batch field extraction files via API
`api:icertis_fetch_batch_field_extraction`	Fetches Icertis batch field extraction via API
`api:icertis_field_extraction`	Extracts fields from an Icertis document via API
`api:icertis_review_document`	Reviews Icertis document via API
`api:improve_prompt`	Rewrites a prompt with Harvey via API
`api:ks_document_create`	Creates knowledge source document via API
`api:ks_document_delete`	Deletes knowledge source document via API
`api:ks_document_get`	Fetches knowledge source document via API
`api:ks_document_list`	Lists knowledge source documents via API
`api:ks_document_update_metadata`	Updates knowledge source document metadata via API
`api:legal_hub_request_create`	Creates Legal Hub request via API
`api:legal_hub_request_get`	Fetches Legal Hub request via API
`api:pwc_hr_workforce`	Submits a PwC HR workforce request via API
`api:syncly_doc_upload`	Uploads a document through the Syncly integration via API
`api:token_mgmt_create`	Creates an API token
`api:token_mgmt_delete`	Deletes an API token
`api:token_mgmt_list`	Lists API tokens
`api:token_mgmt_rotate`	Rotates API tokens
`api:translation`	Translates a document via API
`api:vault_add_review_row`	Adds vault review row via API
`api:vault_delete_file`	Deletes files from vault via API
`api:vault_delete_project`	Deletes vault projects via API
`api:vault_get_files`	Fetches vault files via API
`api:vault_get_metadata`	Gets vault metadata via API
`api:vault_get_review_row`	Fetches vault review row via API
`api:vault_get_review_table`	Fetches vault review table via API
`api:vault_list_project_files`	Lists vault project files via API
`api:vault_list_project_users`	Lists vault project users via API
`api:vault_list_projects`	Lists vault projects via API
`api:vault_remove_project_users`	Removes vault project users via API
`api:vault_update_project_users`	Updates vault project users via API
`api:vault_upload_files`	Uploads files to vault via API
`api:whoami`	Fetches the authenticated identity via API
`api:workflow_get_definition`	Fetches workflow definition via API
`api:workflow_list_definitions`	Lists workflow definitions via API
`api:workflow_run`	Runs workflow via API

Authentication

Audit Log Type	Description
`auth:failed`	Failed authentication attempt
`auth:keycloak_failed`	Failed authentication attempt recorded by the Keycloak identity provider
`auth:keycloak_login`	User login recorded by the Keycloak identity provider
`auth:keycloak_logout`	User logout recorded by the Keycloak identity provider
`auth:login`	User login
`auth:logout`	User logout
`auth:pub_sub_negotiate`	Client negotiates a real-time pub/sub connection

SCIM Provisioning

SCIM events record directory-driven changes to users, groups, and territory membership. The scim: category covers changes your identity provider pushes to Harvey; the admin:scim_* types cover changes an admin makes to the SCIM configuration itself.

Directory sync events

Audit Log Type	Description
`scim:active_workspace_fallback`	A user’s active workspace is reassigned to a fallback after SCIM removes the previous one
`scim:group_create`	SCIM creates group
`scim:group_delete`	SCIM deletes group
`scim:group_patch`	SCIM patches a group
`scim:group_replace`	SCIM replaces group
`scim:territory_membership_add`	SCIM adds territory membership
`scim:territory_membership_remove`	SCIM removes territory membership
`scim:user_create`	SCIM creates user
`scim:user_delete`	SCIM deletes user
`scim:user_email_change`	SCIM changes a user’s email address
`scim:user_patch`	SCIM patches a user
`scim:user_replace`	SCIM replaces user
`scim:user_role_sync`	SCIM syncs user role
`scim:user_state_change`	SCIM activates or deactivates a user

SCIM configuration

Audit Log Type	Description
`admin:scim_config_update`	Admin updates SCIM configuration
`admin:scim_feature_status_read`	Admin reads SCIM feature status
`admin:scim_onboard`	Admin onboards SCIM
`admin:scim_profile_attribute_mapping_list`	Admin lists SCIM profile attribute mappings
`admin:scim_reset`	Admin resets SCIM
`admin:scim_role_mapping_create`	Admin creates SCIM role mapping
`admin:scim_role_mapping_delete`	Admin deletes SCIM role mapping
`admin:scim_role_mapping_reorder`	Admin reorders SCIM role mappings
`admin:scim_territory_workspaces_list`	Admin lists SCIM territory workspaces
`admin:scim_user_group_mapping_create`	Admin creates SCIM user group mapping
`admin:scim_user_group_mapping_delete`	Admin deletes SCIM user group mapping
`admin:scim_user_group_mapping_list`	Admin lists SCIM user group mappings

Admin Operations

Users, roles, and permissions

Audit Log Type	Description
`admin:active_workspace_fallback`	A user’s active workspace is reassigned to a fallback workspace
`admin:add_users`	Admin adds users
`admin:bulk_update_role_configs`	Admin bulk updates role configurations
`admin:create_role`	Admin creates role
`admin:delete_role`	Admin deletes role
`admin:edit_user_profile`	Admin edits user profile
`admin:fetch_all_perm_bundles`	Admin fetches all permission bundles
`admin:fetch_workspace_perm_bundles`	Admin fetches workspace permission bundles
`admin:fetch_workspace_role`	Admin fetches workspace role
`admin:fetch_workspace_role_configs`	Admin fetches workspace role configurations
`admin:fetch_workspace_roles`	Admin fetches workspace roles
`admin:fetch_workspace_users`	Admin fetches workspace users
`admin:get_role_users`	Admin gets users for a role
`admin:grant_perms`	Admin grants permissions
`admin:membership_add`	Admin adds a user’s workspace membership
`admin:membership_remove`	Admin removes a user’s workspace membership
`admin:remove_users`	Admin removes users
`admin:revoke_perms`	Admin revokes permissions
`admin:territory_join`	Admin joins a territory workspace
`admin:update_role`	Admin updates role
`admin:update_user_role`	Admin updates user role

Workspace configuration

Audit Log Type	Description
`admin:delete_workspace_logo`	Admin deletes workspace logo
`admin:fetch_org_domains`	Admin fetches organization domains
`admin:fetch_sharing_settings`	Admin fetches sharing settings
`admin:fetch_stats`	Admin fetches statistics
`admin:fetch_workspace_features`	Admin fetches workspace features
`admin:generate_workspace_personalization_blurb`	Admin generates workspace personalization blurb
`admin:get_approval_policy`	Admin fetches approval policy
`admin:search_intake_config_options`	Admin searches connector intake configuration options
`admin:set_approval_policy`	Admin sets approval policy
`admin:update_sharing_settings`	Admin updates sharing settings
`admin:update_workspace_brand_name`	Admin updates workspace brand name
`admin:upsert_workspace_guidance`	Admin creates or updates workspace guidance
`admin:upsert_workspace_logo`	Admin creates or updates workspace logo
`admin:upsert_workspace_notice`	Admin creates or updates workspace notice
`admin:upsert_workspace_personalization_blurb`	Admin creates or updates workspace personalization blurb

Client matters

Audit Log Type	Description
`admin:add_client_matters`	Admin adds client matters
`admin:clear_client_matter_notices`	Admin clears client matter notices
`admin:delete_client_matters`	Admin deletes client matters
`admin:fetch_client_matter_workspace_settings`	Admin fetches client matter workspace settings
`admin:fetch_client_matters`	Admin fetches client matters
`admin:manage_client_matters`	Admin manages client matters
`admin:set_client_matter_notices`	Admin sets client matter notices
`admin:update_client_matters`	Admin updates client matters

Clients

Audit Log Type	Description
`admin:create_client`	Admin creates client
`admin:delete_client`	Admin deletes client
`admin:get_client`	Admin fetches client
`admin:list_clients`	Admin lists clients
`admin:update_client`	Admin updates client

Billing and usage

Audit Log Type	Description
`admin:archive_billing_usage_alert`	Admin archives billing usage alert
`admin:archive_billing_usage_limit`	Admin archives billing usage limit
`admin:create_billing_usage_alert`	Admin creates billing usage alert
`admin:create_billing_usage_limit`	Admin creates billing usage limit
`admin:edit_billing_usage_alert`	Admin edits billing usage alert
`admin:edit_billing_usage_limit`	Admin edits billing usage limit
`admin:fetch_billing_usage_alerts`	Admin fetches billing usage alerts
`admin:fetch_billing_usage_by_client_matter`	Admin fetches billing usage by client matter
`admin:fetch_billing_usage_by_day_spend_split`	Admin fetches billing usage by day spend split
`admin:fetch_billing_usage_by_group`	Admin fetches billing usage by group
`admin:fetch_billing_usage_by_model`	Admin fetches billing usage by model
`admin:fetch_billing_usage_by_practice_area`	Admin fetches billing usage by practice area
`admin:fetch_billing_usage_by_shared_space`	Admin fetches billing usage by shared space
`admin:fetch_billing_usage_by_user`	Admin fetches billing usage by user
`admin:fetch_billing_usage_by_workflow_agent`	Admin fetches billing usage by workflow agent
`admin:fetch_billing_usage_by_workspace`	Admin fetches billing usage by workspace
`admin:fetch_billing_usage_limit_users`	Admin fetches billing usage limit users
`admin:fetch_billing_usage_limits`	Admin fetches billing usage limits
`admin:fetch_billing_usage_metadata`	Admin fetches billing usage metadata
`admin:fetch_billing_usage_rate_card`	Admin fetches billing usage rate card
`admin:fetch_billing_usage_summary`	Admin fetches billing usage summary

Single sign-on

Audit Log Type	Description
`admin:create_sso_connection`	Admin creates SSO connection
`admin:deactivate_sso`	Admin deactivates SSO
`admin:delete_sso_connection`	Admin deletes SSO connection
`admin:generate_sso_ticket`	Admin generates SSO ticket
`admin:get_sso_connection`	Admin fetches SSO connection
`admin:get_sso_setup_status`	Admin fetches SSO setup status
`admin:mark_sso_configured`	Admin marks SSO configured
`admin:test_sso_connection`	Admin tests SSO connection
`admin:update_sso_connection`	Admin updates SSO connection
`admin:verify_sso_connection`	Admin verifies SSO connection

Ethical walls

Audit Log Type	Description
`admin:create_ethical_wall_link_connector`	Admin creates ethical wall link connector
`admin:create_ethical_wall_sync_connector`	Admin creates ethical wall sync connector
`admin:delete_ethical_wall_connector`	Admin deletes ethical wall connector
`admin:disable_wall_provider`	Admin disables the ethical wall provider
`admin:enable_wall_provider`	Admin enables the ethical wall provider
`admin:get_ethical_wall_link_report`	Admin fetches ethical wall link report
`admin:get_ethical_wall_share_compliance_report`	Admin fetches ethical wall share compliance report
`admin:get_wall_provider`	Admin fetches the ethical wall provider
`admin:list_walls_connectors`	Admin lists ethical wall connectors
`admin:set_ethical_wall_provider`	Admin sets ethical wall provider

Integrations and MCP servers

Audit Log Type	Description
`admin:delete_integration_tenant`	Admin deletes integration tenant
`admin:delete_mcp_server`	Admin deletes MCP server
`admin:deregister_integration_webhook`	Admin deregisters integration webhook
`admin:disable_integration`	Admin disables integration
`admin:enable_integration`	Admin enables integration
`admin:get_connector_intake_config`	Admin fetches connector intake configuration
`admin:get_mcp_capability_policies`	Admin fetches MCP capability policies
`admin:list_connector_intakes`	Admin lists connector intakes
`admin:list_connectors`	Admin lists connectors
`admin:refresh_mcp_capability_policies`	Admin refreshes MCP capability policies
`admin:register_integration_webhook`	Admin registers integration webhook
`admin:register_mcp_server`	Admin registers MCP server
`admin:update_integration`	Admin updates integration
`admin:update_integration_tenant`	Admin updates integration tenant
`admin:update_mcp_capability_policies`	Admin updates MCP capability policies
`admin:update_mcp_server`	Admin updates MCP server
`admin:upsert_integration_tenant`	Admin creates or updates integration tenant

Playbooks

Audit Log Type	Description
`admin:publish_playbook`	Admin publishes playbook
`admin:unpublish_playbook`	Admin unpublishes playbook
`admin:update_playbook_permissions`	Admin updates playbook permissions

History, exports, and retention

Audit Log Type	Description
`admin:client_export_workspace_users`	Admin exports workspace users from client
`admin:client_view_workspace_history`	Admin views workspace history in client
`admin:client_view_workspace_history_item`	Admin views specific workspace history item in client
`admin:create_export_template`	Admin creates export template
`admin:delete_export_template`	Admin deletes export template
`admin:delete_workspace_history_item`	Admin deletes workspace history item
`admin:delete_workspace_history_items`	Admin deletes multiple workspace history items
`admin:download_export_template`	Admin downloads export template
`admin:edit_export_template`	Admin edits export template
`admin:export_query_usage`	Admin exports query usage data
`admin:export_workspace_history`	Admin exports workspace history
`admin:fetch_export_template`	Admin fetches export template
`admin:fetch_export_templates`	Admin fetches export templates
`admin:fetch_workspace_audit_logs`	Admin fetches workspace audit logs
`admin:fetch_workspace_history`	Admin fetches workspace history
`admin:fetch_workspace_history_item`	Admin fetches specific workspace history item
`admin:fetch_workspace_history_metadata`	Admin fetches workspace history metadata
`admin:fetch_workspace_retention`	Admin fetches workspace retention
`admin:generate_query_usage_download_url`	Admin generates a download URL for a query usage export
`admin:toggle_recycle_bin`	Admin turns the vault recycle bin on or off
`admin:update_vault_retention`	Admin updates vault retention
`admin:update_workspace_retention`	Admin updates workspace retention

User Operations

Assistant, history, and threads

Audit Log Type	Description
`user:agent_history_event_load`	Agent loads a history event for context
`user:agent_history_search_surface`	Agent surfaces history search results
`user:assistant_cache_ping`	Client pings the Assistant prompt cache
`user:automation_create`	User creates automation
`user:automation_delete`	User deletes automation
`user:automation_update`	User updates automation
`user:cancel_history_item`	User cancels history item
`user:client_view_history`	User views history in client
`user:client_view_history_item`	User views specific history item in client
`user:create_assistant_chat`	Legacy type for Assistant query creation, superseded by `user:create_query`
`user:create_query`	User creates query
`user:delete_history_item`	User deletes history item
`user:dismiss_thread`	User dismisses thread
`user:export_thread`	User exports thread
`user:export_us_caselaw_cases`	User exports US caselaw cases
`user:fetch_active_events`	User fetches active events
`user:fetch_citation_source`	User fetches citation source
`user:fetch_history`	User fetches history
`user:fetch_history_item`	User fetches specific history item
`user:fetch_history_metadata`	User fetches history metadata
`user:fetch_query_questions`	User fetches query questions
`user:fetch_researched_uncited_sources`	User fetches researched uncited sources
`user:mark_thread_read`	User marks thread read
`user:move_thread`	User moves thread
`user:set_assistant_event_caption`	User sets Assistant event caption
`user:update_history_item`	User updates history item
`user:update_investigation_plan`	User updates investigation plan

Files and documents

Audit Log Type	Description
`user:attach_recent_event_file`	User attaches recent event file
`user:create_generated_document`	User creates generated document
`user:extract_file_text`	User extracts file text
`user:fetch_assistant_files`	User fetches Assistant files
`user:fetch_draft_revision`	User fetches draft revision
`user:fetch_generated_document_details`	User fetches generated document details
`user:generate_file_signed_urls`	User generates signed URLs for files
`user:parse_pst`	User parses a PST mail archive
`user:process_event_files`	User unlocks a presigned upload so its files are processed
`user:rename_draft`	User renames draft
`user:rename_generated_document`	User renames generated document
`user:resolve_assets`	User resolves asset references
`user:set_draft_revision_current`	User makes a draft revision the current one
`user:update_draft_revision`	User updates draft revision
`user:update_generated_document`	User updates generated document
`user:upload_file_init`	User initiates a two-phase file upload

Vault

Audit Log Type	Description
`user:agent_save_files_to_vault`	Agent saves files to a vault project
`user:clear_vault_query_errors`	User clears vault query errors
`user:convert_vault_to_knowledge_base`	User converts a vault project to a knowledge base
`user:create_vault_download`	User creates vault download
`user:create_vault_folder`	User creates vault folder
`user:create_vault_folder_sharing_permissions`	User creates vault folder sharing permissions
`user:delete_vault_files`	User deletes vault files
`user:delete_vault_folder`	User deletes vault folder
`user:delete_vault_folder_sharing_permissions`	User deletes vault folder sharing permissions
`user:duplicate_vault_files`	User duplicates vault files
`user:fetch_project_metadata`	User fetches project metadata
`user:fetch_vault_cloneable_projects`	User fetches vault cloneable projects
`user:fetch_vault_example_project`	User fetches vault example project
`user:fetch_vault_file`	User fetches vault file
`user:fetch_vault_files`	User fetches vault files
`user:fetch_vault_folder`	User fetches vault folder
`user:fetch_vault_folder_history_stats`	User fetches vault folder history stats
`user:fetch_vault_folder_path`	User fetches vault folder path
`user:fetch_vault_folders_by_path`	User fetches vault folders by path
`user:fetch_vault_history_item`	User fetches vault history item
`user:fetch_vault_knowledge_bases`	User fetches vault knowledge bases
`user:fetch_vault_projects_history_stats`	User fetches vault projects history stats
`user:fetch_vault_review_workflow`	User fetches vault review workflow
`user:fetch_vault_top_level_folders`	User fetches vault top-level folders
`user:generate_vault_download_url`	User generates vault download URL
`user:get_vault_project_user_access_level`	User fetches vault project user access level
`user:move_vault_files`	User moves vault files
`user:move_vault_folder`	User moves vault folder
`user:purge_vault_from_recycle_bin`	User purges a vault project from the recycle bin
`user:rerun_vault_review_queries`	User reruns vault review queries
`user:restore_vault_from_recycle_bin`	User restores a vault project from the recycle bin
`user:retry_vault_files`	User retries vault files
`user:save_workflow_output_to_vault`	User saves workflow output to vault
`user:search_vault_files`	User searches vault files
`user:semantic_search_with_vault_folder`	User performs semantic search with vault folder
`user:set_vault_example_project`	User sets vault example project
`user:transfer_vault_project_ownership`	User transfers vault project ownership
`user:trigger_vault_summary`	User triggers vault summary
`user:unset_vault_example_project`	User unsets vault example project
`user:update_vault_file_metadata`	User updates vault file metadata
`user:update_vault_folder_metadata`	User updates vault folder metadata
`user:update_vault_folder_sharing_permissions`	User updates vault folder sharing permissions
`user:upload_vault_files`	User uploads vault files

Review tables

Audit Log Type	Description
`user:create_review_cell_comment`	User creates review cell comment
`user:create_vault_review_query`	User creates vault review query
`user:delete_review_cell_comment`	User deletes review cell comment
`user:edit_review_cell`	User edits review cell
`user:edit_review_cell_comment`	User edits review cell comment
`user:export_vault_review_query`	User exports vault review query
`user:fetch_review_table_column_values`	User fetches review table column values
`user:fetch_review_table_rows`	User fetches review table rows
`user:fetch_review_table_skeleton`	User fetches review table skeleton
`user:fetch_vault_file_review_rows`	User fetches vault file review rows
`user:fetch_vault_review_query_usage`	User fetches vault review query usage
`user:flag_review_cell`	User flags review cell
`user:generate_review_table_export_url`	User generates review table export URL
`user:list_review_tables_home`	User lists review tables on the review tables home page
`user:lock_review_cell`	User locks review cell
`user:mark_review_event_completed`	User marks review event as completed
`user:open_review_files_in_assistant`	User opens review files in Assistant
`user:unflag_review_cell`	User clears a flag on a review cell
`user:unlock_review_cell`	User unlocks review cell

Playbooks and playbook review

Audit Log Type	Description
`user:check_playbook_review_access`	User checks playbook review access
`user:convert_playbook_document`	User converts playbook document
`user:count_vault_folder_playbook_reviewable_files`	User counts vault folder playbook reviewable files
`user:create_playbook`	User creates playbook
`user:create_vault_folder_playbook_config`	User creates vault folder playbook configuration
`user:delete_playbook`	User deletes playbook
`user:delete_vault_folder_playbook_config`	User deletes vault folder playbook configuration
`user:detect_paper_type`	User detects which party’s paper a contract is on
`user:duplicate_playbook`	User duplicates playbook
`user:export_playbook`	User exports playbook
`user:export_playbook_review`	User exports playbook review
`user:extract_playbook_parties`	User extracts playbook parties
`user:fetch_playbook_history`	User fetches playbook history
`user:fetch_playbook_permissions`	User fetches playbook permissions
`user:fetch_playbook_review`	User fetches playbook review
`user:fetch_playbook_review_daily_limit`	User fetches playbook review daily limit
`user:fetch_playbook_review_history`	User fetches playbook review history
`user:fetch_playbook_version`	User fetches playbook version
`user:get_playbook`	User fetches playbook
`user:improve_playbook_rule`	User improves playbook rule
`user:list_playbooks`	User lists playbooks
`user:list_vault_folder_playbook_configs`	User lists vault folder playbook configurations
`user:open_playbook_review_in_assistant`	User opens a playbook review in Assistant
`user:pause_vault_folder_playbook_config`	User pauses vault folder playbook configuration
`user:playbook_review_accept_suggestions`	User accepts playbook review suggestions
`user:playbook_review_assign`	User assigns a playbook review
`user:playbook_review_dismiss_suggestions`	User dismisses playbook review suggestions
`user:playbook_review_explanation_item_follow_up`	User asks a follow-up on a playbook review explanation item
`user:playbook_review_failed_rule_rerun`	User reruns a failed playbook review rule
`user:playbook_review_follow_up`	User asks a follow-up question on a playbook review
`user:playbook_review_patch`	User updates a playbook review
`user:playbook_review_position_change`	User moves a playbook review suggestion position
`user:playbook_review_restore_suggestions`	User restores playbook review suggestions
`user:playbook_review_revise_comment`	User revises a playbook review comment
`user:playbook_review_rule_rerun`	User reruns a playbook review rule
`user:playbook_review_set_status`	User sets the status of a playbook review
`user:prefill_run_metadata`	User prefills playbook review run metadata
`user:reset_playbook_review_daily_limit`	User resets playbook review daily limit
`user:review_playbook_document`	User reviews playbook document
`user:review_playbook_document_v2`	User reviews a playbook document (v2)
`user:trigger_vault_folder_playbook_reviews`	User triggers vault folder playbook reviews
`user:unpause_vault_folder_playbook_config`	User resumes vault folder playbook configuration
`user:update_playbook`	User updates playbook
`user:update_vault_folder_playbook_config`	User updates vault folder playbook configuration
`user:view_playbook_review_activities`	User views playbook review activities

Clause library

Audit Log Type	Description
`user:bulk_fetch_clause_versions`	User bulk fetches clause versions
`user:create_clause`	User creates clause
`user:delete_clause`	User deletes clause
`user:fetch_clause`	User fetches clause
`user:fetch_clause_access`	User fetches clause access
`user:fetch_clause_version`	User fetches clause version
`user:list_clause_versions`	User lists clause versions
`user:list_clauses`	User lists clauses
`user:revert_clause`	User reverts clause
`user:save_clause_from_highlight`	User saves clause from highlight
`user:update_clause`	User updates clause

Contract review

Audit Log Type	Description
`user:add_contract_file_to_contract_space`	User adds contract file to contract space
`user:assign_contract_review_requests`	User assigns contract review requests
`user:assign_contract_space_users`	User assigns contract space users
`user:bulk_redo_contract_review_requests`	User bulk redoes contract review requests
`user:compile_assignment_policy_condition`	User compiles an assignment policy condition
`user:compile_assignment_policy_rules`	User compiles assignment policy rules
`user:continue_contract_review_request`	User continues contract review request
`user:create_contract_intake_channel`	User creates contract intake channel
`user:create_contract_space`	User creates contract space
`user:create_contracting_action`	User creates contracting action
`user:decide_all_contract_review_suggestions`	User decides all contract review suggestions
`user:decide_contract_review_suggestion`	User decides contract review suggestion
`user:delete_assignment_policy`	User deletes assignment policy
`user:delete_contract_intake_channel`	User deletes contract intake channel
`user:delete_contract_space`	User deletes contract space
`user:fetch_contract_review_request`	User fetches contract review request
`user:get_assignment_decision`	User fetches assignment decision
`user:get_assignment_policy`	User fetches assignment policy
`user:get_contract_space_detail`	User fetches contract space details
`user:get_latest_contract_from_space`	User fetches latest contract from space
`user:list_contract_assignment_fields`	User lists contract assignment fields
`user:list_contract_files`	User lists contract files
`user:list_contract_intake_channels`	User lists contract intake channels
`user:list_contract_review_requests`	User lists contract review requests
`user:list_contract_review_suggestion_sources`	User lists contract review suggestion sources
`user:list_contract_review_suggestions`	User lists contract review suggestions
`user:list_contract_spaces`	User lists contract spaces
`user:list_contracting_agents`	User lists contracting agents
`user:save_assignment_policy`	User saves assignment policy
`user:set_contract_review_request_archive_status`	User sets contract review request archive status
`user:update_contract_intake_channel`	User updates contract intake channel
`user:update_contract_space_status`	User updates contract space status

Legal Hub

Audit Log Type	Description
`user:assign_legal_hub_request_reviewer`	User assigns Legal Hub request reviewer
`user:cancel_legal_hub_request`	User cancels Legal Hub request
`user:complete_legal_hub_output_review`	User completes a Legal Hub output review
`user:create_legal_hub_agent_roster_entry`	User creates Legal Hub agent roster entry
`user:create_legal_hub_intake_vault`	User creates Legal Hub intake vault
`user:delete_legal_hub_agent_roster_entry`	User deletes Legal Hub agent roster entry
`user:delete_legal_hub_intake_vault`	User deletes Legal Hub intake vault
`user:disable_legal_hub_agent_roster_entry`	User disables Legal Hub agent roster entry
`user:disable_legal_hub_intake_vault`	User disables Legal Hub intake vault
`user:enable_legal_hub_agent_roster_entry`	User enables Legal Hub agent roster entry
`user:enable_legal_hub_intake_vault`	User enables Legal Hub intake vault
`user:fetch_legal_hub_request`	User fetches Legal Hub request
`user:get_legal_hub_agent_roster_entry`	User fetches Legal Hub agent roster entry
`user:get_legal_hub_assignment_rules`	User fetches Legal Hub assignment rules
`user:get_legal_hub_intake_vault`	User fetches Legal Hub intake vault
`user:list_legal_hub_agent_reviewers`	User lists Legal Hub agent reviewers
`user:list_legal_hub_agent_roster_candidates`	User lists Legal Hub agent roster candidates
`user:list_legal_hub_agent_roster_entries`	User lists Legal Hub agent roster entries
`user:list_legal_hub_intake_vaults`	User lists Legal Hub intake vaults
`user:list_legal_hub_output_reviews`	User lists Legal Hub output reviews
`user:list_legal_hub_requests`	User lists Legal Hub requests
`user:list_legal_hub_reviewer_candidates`	User lists Legal Hub reviewer candidates
`user:override_legal_hub_request`	User overrides a Legal Hub request
`user:replace_legal_hub_agent_reviewers`	User replaces Legal Hub agent reviewers
`user:replace_legal_hub_assignment_rules`	User replaces Legal Hub assignment rules
`user:update_legal_hub_agent_roster_entry`	User updates Legal Hub agent roster entry
`user:update_legal_hub_intake_vault`	User updates Legal Hub intake vault

Deals, diligence, and portfolios

Audit Log Type	Description
`user:create_competitors_excel`	User exports a competitors table to Excel
`user:create_deal_attribute_definition`	User creates deal attribute definition
`user:create_deal_attribute_value`	User creates deal attribute value
`user:create_diligence_report_job`	User creates diligence report job
`user:create_workspace_investment_type`	User creates workspace investment type
`user:create_workspace_sector`	User creates workspace sector
`user:delete_deal_attribute_definition`	User deletes deal attribute definition
`user:delete_workspace_investment_type`	User deletes workspace investment type
`user:delete_workspace_sector`	User deletes workspace sector
`user:fetch_diligence_sections`	User fetches diligence sections
`user:get_deal`	User fetches deal
`user:list_company_profile_taxonomy`	User lists the company profile taxonomy
`user:list_deals`	User lists deals
`user:portfolios_create_portfolio`	User creates a portfolio
`user:portfolios_get_portfolio`	User fetches a portfolio
`user:portfolios_link_deals`	User links deals to a portfolio
`user:portfolios_list_portfolios`	User lists portfolios
`user:portfolios_unlink_deal`	User unlinks a deal from a portfolio
`user:portfolios_update_portfolio`	User updates a portfolio
`user:reject_deal_attribute_value`	User rejects deal attribute value
`user:start_deal_attribute_runs`	User starts deal attribute runs
`user:unverify_deal_attribute_value`	User unverifies deal attribute value
`user:update_deal_attribute_definition`	User updates deal attribute definition
`user:update_workspace_investment_type`	User updates workspace investment type
`user:update_workspace_sector`	User updates workspace sector
`user:verify_deal_attribute_value`	User verifies deal attribute value

Facts and chronology

Audit Log Type	Description
`user:get_chronology`	User fetches chronology
`user:get_chronology_event`	User fetches chronology event
`user:get_fact`	User fetches fact
`user:get_fact_database`	User fetches fact database
`user:get_fact_entity`	User fetches fact entity
`user:get_fact_issue`	User fetches fact issue
`user:get_master_chronology`	User fetches master chronology
`user:list_fact_databases`	User lists fact databases
`user:query_chronology_event_facts`	User queries chronology event facts
`user:query_chronology_event_navigation`	User queries chronology event navigation
`user:query_chronology_event_window`	User queries chronology event window
`user:query_chronology_events`	User queries chronology events
`user:query_fact_entities`	User queries fact entities
`user:query_fact_filter_values`	User queries fact filter values
`user:query_fact_issues`	User queries fact issues
`user:query_facts`	User queries facts

Horizon scanning

Audit Log Type	Description
`user:autofill_horizon_scan_parameters`	User autofills horizon scan parameters with Harvey
`user:create_horizon_scan`	User creates horizon scan
`user:delete_horizon_scan`	User deletes horizon scan
`user:get_horizon_scan`	User fetches horizon scan
`user:get_horizon_scan_revisions`	User fetches horizon scan revisions
`user:list_horizon_scan_taxonomy`	User lists the horizon scanning taxonomy
`user:list_horizon_scans`	User lists horizon scans
`user:update_horizon_scan`	User updates horizon scan

Timekeeping

Audit Log Type	Description
`user:create_timekeeping_time_entry`	User creates timekeeping time entry
`user:delete_timekeeping_auto_draft_schedule`	User deletes timekeeping auto-draft schedule
`user:draft_timekeeping_submission_ledger`	User drafts timekeeping submission ledger
`user:fetch_timekeeping_matters`	User fetches timekeeping matters
`user:fetch_timekeeping_submission_ledger`	User fetches timekeeping submission ledger
`user:fetch_timekeeping_subscriptions`	User fetches timekeeping subscriptions
`user:get_timekeeping_auto_draft_schedule`	User fetches timekeeping auto-draft schedule
`user:upsert_timekeeping_auto_draft_schedule`	User creates or updates timekeeping auto-draft schedule

Invoice review

Audit Log Type	Description
`user:invoice_review_guideline_source_download`	User downloads invoice review guideline source
`user:invoice_review_project_create`	User creates invoice review project
`user:invoice_review_project_get`	User fetches invoice review project

Workflows and agents

Audit Log Type	Description
`user:cancel_workflow_step`	User cancels workflow step
`user:duplicate_workflow`	User duplicates workflow
`user:fetch_recommended_workflows_by_query`	User fetches recommended workflows by query
`user:fetch_workflow_access_counts`	User fetches workflow access counts
`user:fetch_workflow_draft`	User fetches workflow draft
`user:fetch_workflow_event_outputs`	User fetches workflow event outputs
`user:get_workflow_run_steps`	User fetches workflow run steps
`user:get_workflow_step_output`	User fetches workflow step output
`user:list_completed_workflow_runs`	User lists completed workflow runs
`user:list_workflow_sharables`	User lists the targets a workflow can be shared with
`user:list_workflows`	User lists workflows
`user:record_workflow_file_download`	User downloads a file produced by a workflow
`user:upload_file`	User uploads a file to a workflow

Workflow builder

Audit Log Type	Description
`user:workflow_builder_bulk_delete_workflows`	User bulk deletes workflows in the workflow builder
`user:workflow_builder_bulk_unpublish_workflows`	User bulk unpublishes workflows in the workflow builder
`user:workflow_builder_cancel_submitted_workflow_version`	User cancels submitted workflow version in the workflow builder
`user:workflow_builder_check_thread_to_workflow_eligibility`	User checks whether an Assistant thread can become a workflow
`user:workflow_builder_copy_workflow`	User copies workflow in the workflow builder
`user:workflow_builder_create_workflow`	User creates workflow in the workflow builder
`user:workflow_builder_create_workflow_from_thread`	User creates workflow from thread in the workflow builder
`user:workflow_builder_delete_workflow`	User deletes workflow in the workflow builder
`user:workflow_builder_generate_diagram`	User generates diagram in the workflow builder
`user:workflow_builder_generate_steps`	User generates steps in the workflow builder
`user:workflow_builder_get_assistant_thread`	User fetches Assistant thread in the workflow builder
`user:workflow_builder_get_history`	User fetches history in the workflow builder
`user:workflow_builder_get_workflow_definition`	User fetches workflow definition in the workflow builder
`user:workflow_builder_import_workflow`	User imports workflow in the workflow builder
`user:workflow_builder_linked_agent_referenced_child_deleted`	A workflow referenced by a linked agent is deleted in the workflow builder
`user:workflow_builder_list_agent_runs`	User lists agent runs in the workflow builder
`user:workflow_builder_list_linkable_agents`	User lists linkable agents in the workflow builder
`user:workflow_builder_list_workflows`	User lists workflows in the workflow builder
`user:workflow_builder_magic_prompt`	User rewrites a workflow step prompt with Harvey in the workflow builder
`user:workflow_builder_publish_workflow_version`	User publishes workflow version in the workflow builder
`user:workflow_builder_reject_submitted_workflow_version`	User rejects submitted workflow version in the workflow builder
`user:workflow_builder_save_version`	User saves a workflow version in the workflow builder
`user:workflow_builder_share_external`	User shares a workflow outside the workspace from the workflow builder
`user:workflow_builder_submit_for_approval_workflow_version`	User submits a workflow version for approval in the workflow builder
`user:workflow_builder_unpublish_workflow`	User unpublishes workflow in the workflow builder
`user:workflow_builder_update_workflow_metadata`	User updates workflow metadata in the workflow builder
`user:workflow_builder_validate_workflow`	User validates workflow in the workflow builder

Knowledge sources and library

Audit Log Type	Description
`user:create_filter_profile`	User creates filter profile
`user:create_library_item`	User creates library item
`user:delete_filter_profile`	User deletes filter profile
`user:delete_library_item`	User deletes library item
`user:export_knowledge_source_documents`	User exports knowledge source documents
`user:export_library`	User exports library
`user:fetch_knowledge_source_policy`	User fetches knowledge source policy
`user:list_knowledge_source_catalog`	User lists the knowledge source catalog
`user:list_legal_practice_area_taxonomy`	User lists the legal practice area taxonomy
`user:list_library_v2_items`	User lists library items (v2)
`user:update_filter_profile`	User updates filter profile
`user:update_library_item`	User updates library item
`user:update_pinned_practice_areas`	User updates pinned practice areas
`user:view_library_item`	User views library item

Structured datasets

Audit Log Type	Description
`user:structured_dataset_create`	User creates structured dataset
`user:structured_dataset_finalize`	User finalizes structured dataset
`user:structured_dataset_get`	User fetches structured dataset
`user:structured_dataset_get_schema`	User fetches a structured dataset schema
`user:upload_structured_dataset_files`	User uploads structured dataset files

Command Center and analysis

Audit Log Type	Description
`user:billing_analysis_chat`	User chats with the billing analysis agent
`user:billing_analysis_query`	User queries billing analysis
`user:billing_analysis_view`	User views billing analysis
`user:panel_management_create`	User creates a panel dashboard
`user:panel_management_delete`	User deletes a panel dashboard
`user:panel_management_delete_source_file`	User deletes a panel dashboard source file
`user:panel_management_get`	User fetches a panel dashboard
`user:panel_management_pin_chart`	User pins a chart to a panel dashboard
`user:panel_management_unpin_chart`	User unpins a chart from a panel dashboard
`user:view_command_center`	User views Command Center recommended actions

Tasks

Audit Log Type	Description
`user:add_task_resource_links`	User adds task resource links
`user:create_task`	User creates task
`user:create_task_phase`	User creates task phase
`user:delete_task`	User deletes task
`user:delete_task_phase`	User deletes task phase
`user:export_tasks`	User exports tasks
`user:get_task`	User fetches task
`user:get_task_stats`	User fetches task statistics
`user:list_task_activity`	User lists task activity
`user:list_task_assignable_users`	User lists task assignable users
`user:list_task_phases`	User lists task phases
`user:list_task_timeline`	User lists the task timeline
`user:list_tasks`	User lists tasks
`user:preview_task`	User previews task
`user:remove_task_resource_links`	User removes task resource links
`user:reorder_task_phases`	User reorders task phases
`user:update_task`	User updates task
`user:update_task_phase`	User updates task phase

Comments

Audit Log Type	Description
`user:create_comment_message`	User creates comment message
`user:create_comment_thread`	User creates comment thread
`user:delete_comment_message`	User deletes comment message
`user:delete_comment_thread`	User deletes comment thread
`user:edit_comment_memo_formatting`	User edits comment memo formatting
`user:edit_comment_memo_row`	User edits comment memo row
`user:edit_comment_message`	User edits comment message
`user:list_comment_threads`	User lists comment threads
`user:reopen_comment_thread`	User reopens comment thread
`user:resolve_comment_thread`	User resolves comment thread
`user:rewrite_comment_memo_row`	User rewrites comment memo row
`user:update_comment_thread_anchor`	User updates comment thread anchor

Meetings, audio, and transcription

Audit Log Type	Description
`user:audio_stream_authenticate`	User authenticates an audio stream session
`user:audio_stream_complete`	User completes an audio stream
`user:audio_stream_start`	User starts an audio stream
`user:create_meeting`	User creates meeting
`user:delete_meeting`	User deletes meeting
`user:list_meetings`	User lists meetings
`user:mint_transcribe_token`	User mints a transcription service token
`user:rename_meeting`	User renames meeting
`user:transcribe_audio`	User transcribes audio

Email and mailbox

Audit Log Type	Description
`user:create_email_draft`	User creates email draft
`user:create_mailbox_draft_from_notepad`	User creates a mailbox draft from a notepad
`user:mailbox_create_draft`	User creates mailbox draft
`user:mailbox_create_folder`	User creates mailbox folder
`user:mailbox_find_messages`	User searches messages in the connected mailbox
`user:mailbox_get_attachments`	User fetches mailbox attachments
`user:mailbox_get_messages`	User fetches mailbox messages
`user:mailbox_list_folders`	User lists mailbox folders
`user:mailbox_move_messages`	User moves mailbox messages
`user:mailbox_rename_folder`	User renames mailbox folder
`user:mailbox_sensitive_content_skipped`	Mailbox content is skipped because of its sensitivity label
`user:receive_ses_inbound_email`	Harvey receives an inbound email through SES
`user:register_assistant_thread_email_notifications`	User subscribes to email notifications for an Assistant thread
`user:view_email_content`	User views email content

Integrations and DMS

Audit Log Type	Description
`user:connect_integration`	User connects integration
`user:create_dms_one_way_sync`	User creates DMS one-way sync
`user:create_integrations_dialog_token`	User creates a token for the integrations dialog
`user:delete_dms_one_way_sync`	User deletes DMS one-way sync
`user:disconnect_integration`	User disconnects integration
`user:dms_file_export`	User exports file to DMS
`user:dms_file_import`	User imports file from DMS
`user:dms_folder_upload`	User uploads folder via DMS
`user:exchange_integration_authentication`	User exchanges an integration authentication code for a token
`user:fetch_connected_integrations`	User fetches connected integrations
`user:fetch_dms_file_metadata`	User fetches DMS file metadata
`user:fetch_dms_folder_metadata`	User fetches DMS folder metadata
`user:fetch_integration_admin_enablement_urls`	User fetches integration admin enablement URLs
`user:fetch_integration_browse_items`	User fetches integration browse items
`user:fetch_integration_data_rooms`	User fetches integration data rooms
`user:fetch_integration_folder_contents`	User fetches integration folder contents
`user:fetch_integration_resource_url`	User fetches integration resource URL
`user:fetch_integration_tenants`	User fetches integration tenants
`user:fetch_integration_token`	User fetches integration token
`user:integrations_handoff`	User hands a task off to an integration
`user:integrations_handoff_discovery`	User discovers available integration handoff targets
`user:integrations_search`	User searches integrations
`user:list_connectors`	User lists connectors
`user:set_primary_integration_tenant`	User sets primary integration tenant
`user:trigger_dms_one_way_sync`	User triggers DMS one-way sync
`user:update_dms_one_way_sync`	User updates DMS one-way sync
`user:view_dms_one_way_sync`	User views DMS one-way sync

MCP

Audit Log Type	Description
`user:connect_mcp_server`	User connects MCP server
`user:disconnect_mcp_server`	User disconnects MCP server
`user:get_mcp_capability_overrides`	User fetches MCP capability overrides
`user:list_mcp_servers`	User lists MCP servers
`user:mcp_ask_about_vault`	User asks Harvey about a vault project through the MCP server
`user:mcp_ask_harvey`	User asks Harvey a question through the MCP server
`user:mcp_ask_with_knowledge_source`	User asks Harvey a question scoped to a knowledge source through the MCP server
`user:mcp_list_knowledge_sources`	User lists knowledge sources through the MCP server
`user:mcp_list_vault_projects`	User lists vault projects through the MCP server
`user:mcp_web_request`	User runs a web request through the MCP server
`user:update_mcp_capability_overrides`	User updates MCP capability overrides

Audit Log Type	Description
`user:bulk_patch_resource_access`	User bulk patches resource access
`user:clone_resources`	User clones resources
`user:create_event_sharing_permissions`	User creates event sharing permissions
`user:create_own_copy`	User creates their own copy of a shared resource
`user:create_user_group`	User creates user group
`user:delete_user_group`	User deletes user group
`user:evaluate_dependent_resources`	User evaluates the dependent resources of a share
`user:fetch_resource_banner`	User fetches the sharing banner for a resource
`user:fetch_sharing_workspace_users`	User fetches sharing workspace users
`user:get_group_resources`	User fetches group resources
`user:get_shareable_targets`	User fetches shareable targets
`user:get_user_group`	User gets user group
`user:get_user_group_members`	User gets user group members
`user:list_resource_access`	User lists resource access
`user:list_user_groups`	User lists user groups
`user:notify_share_result`	Share result is reported back from an external destination
`user:resource_share_to_user_approval_changed`	Approval status changes on a resource shared with a user
`user:revoke_resource_access`	User revokes resource access
`user:search_shareable_targets`	User searches shareable targets
`user:update_event_sharing_permissions`	User updates event sharing permissions
`user:update_resource_matter_link`	User updates the client matter linked to a resource
`user:update_user_group`	User updates user group
`user:update_user_group_members`	User updates user group members
`user:view_share_config`	User views share configuration

Ethical walls

Audit Log Type	Description
`user:create_ethical_wall`	User creates ethical wall
`user:ethical_wall_sync_preflight`	User runs an ethical wall sync preflight check
`user:get_ethical_wall_members`	User fetches ethical wall members
`user:sync_ethical_wall_policy`	User syncs ethical wall policy

Client matters

Audit Log Type	Description
`user:add_client_matters`	User adds client matters
`user:delete_client_matters`	User deletes client matters
`user:dismiss_client_matter_notice`	User dismisses client matter notice
`user:fetch_client_matters`	User fetches client matters
`user:fetch_disallowed_client_matters`	User fetches client matters they are not allowed to use
`user:update_client_matters`	User updates client matters

User settings and notifications

Audit Log Type	Description
`user:accept_workspace_notice`	User accepts workspace notice
`user:add_favorite`	User adds favorite
`user:add_user_profile`	User adds user profile
`user:complete_campaign`	User completes an in-product campaign
`user:create_user_memory`	User creates user memory
`user:create_writing_style`	User creates writing style
`user:delete_user_memory`	User deletes user memory
`user:disable_user_feature`	User disables user feature
`user:disable_workspace_feature`	User disables workspace feature
`user:dismiss_campaign`	User dismisses an in-product campaign
`user:download_writing_style_file`	User downloads writing style file
`user:edit_user_profile`	User edits user profile
`user:edit_user_settings`	User edits their own settings
`user:enable_user_feature`	User enables user feature
`user:enable_workspace_feature`	User enables workspace feature
`user:fetch_announcement_video`	User fetches announcement video
`user:fetch_notification_counts`	User fetches notification counts
`user:fetch_notifications`	User fetches notifications
`user:fetch_user_memory`	User fetches user memory
`user:fetch_workspace_logo`	User fetches workspace logo
`user:fetch_workspace_permission_admin_emails`	User fetches the workspace admin emails for a permission
`user:get_user_features`	User fetches user features
`user:list_workspaces`	User lists workspaces
`user:list_writing_styles`	User lists writing styles
`user:migrate_campaign_state`	User in-product campaign state is migrated
`user:prefetch_user_memory`	User prefetches user memory
`user:remove_favorite`	User removes favorite
`user:rewrite_user_memory`	User rewrites user memory
`user:search_user_memories`	User searches user memories
`user:submit_feedback`	User submits feedback
`user:subscribe_realtime`	User subscribes to real-time channels
`user:update_notification_state`	User updates notification state
`user:update_user_feature_config`	User updates user feature configuration
`user:update_user_memory`	User updates user memory
`user:view_recommended_prompts`	User views recommended prompts
`user:workspace_switch`	User switches workspace

Microsoft add-ins

Microsoft Word, Outlook, Teams, and Copilot activity is captured as user audit log events. Filter for these events with the log_type query parameter, for example log_type=user:word_add_in_docx_drafting or log_type=user:outlook_add_in_ask.

Word add-in

Audit Log Type	Description
`user:playbook_suggest`	User requests Playbook suggestions from the Word add-in
`user:word_add_in_apply_edit`	User applies a Word add-in edit
`user:word_add_in_apply_suggestions`	User applies Word add-in suggestions
`user:word_add_in_ask`	User submits a Word add-in ask request
`user:word_add_in_capture_word_snapshot`	User captures a Word document snapshot from the Word add-in
`user:word_add_in_create_word_document`	User creates a Word document session
`user:word_add_in_detect_language`	User detects document language from the Word add-in
`user:word_add_in_dismiss_suggestions`	User dismisses Word add-in suggestions
`user:word_add_in_docx_drafting`	User drafts or edits a Word document using the Word add-in agent
`user:word_add_in_extract_definitions`	User extracts definitions from the Word add-in
`user:word_add_in_format_ooxml`	User formats OOXML from the Word add-in
`user:word_add_in_get_contextual_prompts`	User fetches Word add-in contextual prompts
`user:word_add_in_get_export_event_summary`	User fetches Word add-in export event summary
`user:word_add_in_get_history`	User fetches Word add-in history
`user:word_add_in_get_latest_export_event`	User fetches the latest export event for a Word document
`user:word_add_in_get_native_workflow_favorites`	User fetches Word add-in native workflow favorites
`user:word_add_in_get_recent_agents`	User fetches Word add-in recent agents
`user:word_add_in_get_source_event_files`	User fetches Word add-in source event files
`user:word_add_in_get_source_projection`	User fetches the source projection for a Word add-in workflow
`user:word_add_in_get_word_document`	User fetches a Word document session or snapshot
`user:word_add_in_get_word_event_suggestions`	User fetches suggestions for Word events
`user:word_add_in_insert`	User inserts generated text from the Word add-in
`user:word_add_in_legal_qa_review`	User runs a Legal Q&A review from the Word add-in
`user:word_add_in_list_block_workflows`	User lists block workflows available in the Word add-in
`user:word_add_in_metadata_redaction`	User redacts metadata from the Word add-in
`user:word_add_in_proofread_document`	User proofreads a document from the Word add-in
`user:word_add_in_restore_suggestions`	User restores Word add-in suggestions
`user:word_add_in_run_block_workflow`	User runs a block workflow from the Word add-in
`user:word_add_in_translation`	User translates content from the Word add-in
`user:word_add_in_update_suggestions`	User updates Word add-in suggestions
`user:word_contextual_prompts`	User requests contextual prompts from the Word add-in
`user:word_fill_template`	User runs Fill Template from the Word add-in
`user:word_redact`	User runs Redact or Convert to Template from the Word add-in
`user:word_suggest`	User requests Word add-in suggestions

Outlook add-in

Audit Log Type	Description
`user:create_outlook_email`	User creates an Outlook email session
`user:get_outlook_email`	User fetches an Outlook email session
`user:outlook_add_in_ask`	User submits an initial ask request from the Outlook add-in
`user:outlook_add_in_create_reply_draft`	User creates a reply draft from the Outlook add-in
`user:outlook_add_in_get_history`	User fetches Outlook add-in history
`user:outlook_add_in_get_recent_agents`	User fetches Outlook add-in recent agents
`user:outlook_add_in_resolve_native_open`	User opens a Harvey thread natively from the Outlook add-in

Microsoft Teams and Copilot

Audit Log Type	Description
`microsoft:create_query`	User creates a query from the Microsoft Teams bot
`microsoft:create_query_custom_engine_copilot`	User creates a query from the Microsoft Copilot custom engine agent

Shared Spaces

Shared Spaces and external connection audit logs capture collaboration activity: space membership, resource publishing, and external connection lifecycle. Events are scoped per workspace; each workspace sees audit events for actions its users perform or approve.

Space membership and lifecycle

Audit Log Type	Description
`admin:approve_collab_request`	Admin approved a collaboration request (member or resource addition to a space)
`admin:approve_space_request`	Admin approved a space request
`admin:cancel_collab_request`	Admin cancelled a collaboration request
`admin:decline_collab_request`	Admin declined a collaboration request
`admin:decline_space_request`	Admin declined a space request
`user:get_collab_request`	User retrieved a collaboration request
`user:get_shared_space_users`	User fetches the users in a shared space
`user:list_collab_request_approvers`	User lists the approvers for a collaboration request
`user:list_collab_requests`	User listed collaboration requests
`user:list_space_activity_feed`	User views a shared space activity feed
`user:preview_collab_request`	User previews a collaboration request
`user:spaces_accept_welcome_modal`	User accepts the Shared Spaces welcome modal
`user:spaces_add_members_failed`	Adding members to a shared space failed
`user:spaces_add_members_to_space`	User requested one or more people to be added to a shared space
`user:spaces_create_space`	User created a new shared space
`user:spaces_delete_hero_image`	User deletes a shared space hero image
`user:spaces_delete_space`	User deleted a shared space
`user:spaces_duplicate_space`	User duplicates a shared space
`user:spaces_duplicate_space_preview`	User previews duplicating a shared space
`user:spaces_get_details_page`	User viewed a specific shared space’s details page
`user:spaces_get_home_page`	User viewed the Shared Spaces home page
`user:spaces_get_invitable_members`	User fetched invitable members for a space
`user:spaces_get_members`	User fetched members of a space
`user:spaces_leave_space`	A user left a shared space
`user:spaces_member_approval_changed`	A member was approved (or status changed) to be added to a shared space
`user:spaces_record_visit`	User visit to a shared space is recorded
`user:spaces_remove_member_from_space`	A member was removed from a shared space
`user:spaces_status_changed`	Shared space status changed
`user:spaces_update_hero_image`	User updates a shared space hero image
`user:spaces_update_member_role`	User updates a member’s role in a shared space
`user:spaces_update_space`	User updated shared space settings (e.g. name, color)

Audit Log Type	Description
`user:generate_space_context`	User generates the context summary for a shared space
`user:get_publishable_connections`	User fetches the external connections a resource can be published to
`user:get_shared_space_files`	User fetches the files in a shared space
`user:get_shared_space_resources`	User fetches the resources in a shared space
`user:get_shared_space_threads`	User fetches the Assistant threads in a shared space
`user:list_resource_publish_access_rules`	User lists the access rules applied when a resource is published
`user:list_space_workspace_access`	User lists the workspaces with access to a space
`user:spaces_add_resources_to_space`	User requested to publish resources (e.g. playbooks, vaults) to a shared space
`user:spaces_can_publish_to_connection`	User checks whether a resource can be published to an external connection
`user:spaces_get_publishable_resources`	User fetched the list of resources that can be published to a space
`user:spaces_get_vault_file_counts`	User fetches vault file counts for a shared space
`user:spaces_pin_resource`	User pins a resource in a shared space
`user:spaces_read_denied_by_ethical_wall`	A read in a shared space is denied by an ethical wall
`user:spaces_resource_approval_changed`	Resource(s) were approved and added to a shared space (new access granted)
`user:spaces_resource_unshared`	Resource(s) were removed from a shared space
`user:spaces_unpin_resource`	User unpins a resource in a shared space

Space templates and configuration

Audit Log Type	Description
`user:apply_space_template`	User applies space template
`user:create_space_template`	User creates space template
`user:create_workspace_space_custom_field`	User creates workspace space custom field
`user:create_workspace_space_stage`	User creates workspace space stage
`user:delete_space_template`	User deletes space template
`user:delete_workspace_space_custom_field`	User deletes workspace space custom field
`user:delete_workspace_space_stage`	User deletes workspace space stage
`user:edit_space_template`	User edits space template
`user:list_space_templates`	User lists space templates
`user:preview_space_template`	User previews space template
`user:reorder_workspace_space_custom_fields`	User reorders workspace space custom fields
`user:reorder_workspace_space_stages`	User reorders workspace space stages
`user:spaces_clear_workspace_client_matter_config`	User clears the workspace client matter configuration for shared spaces
`user:spaces_get_workspace_client_matter_config`	User fetches the workspace client matter configuration for shared spaces
`user:spaces_get_workspace_settings`	User fetches the workspace Shared Spaces settings
`user:spaces_preview_workspace_client_matter_config`	User previews a workspace client matter configuration for shared spaces
`user:spaces_set_workspace_client_matter_config`	User sets the workspace client matter configuration for shared spaces
`user:spaces_update_workspace_settings`	User updates the workspace Shared Spaces settings
`user:update_workspace_space_custom_field`	User updates workspace space custom field
`user:update_workspace_space_stage`	User updates workspace space stage
`user:view_space_template`	User views space template

External connections

Audit Log Type	Description
`admin:add_users_to_external_connection`	Admin added users to an external connection
`admin:approve_external_connection_request`	Admin approved an external connection request
`admin:delete_external_connection`	Admin deleted an external connection
`admin:reject_external_connection_request`	Admin rejected an external connection request
`admin:remove_resource_from_external_connection`	Admin removed a resource from an external connection
`admin:remove_user_from_external_connection`	Admin removed a user from an external connection
`admin:update_external_connection_invite`	Admin updated an external connection invite
`admin:update_user_role_in_external_connection`	Admin updated a user’s role in an external connection
`user:get_external_connections`	User fetches external connections
`user:get_external_connections_details_page`	User viewed the external connection details page

Spaces administration

Audit Log Type	Description
`admin:get_internal_space_activity`	Admin fetches internal space activity
`admin:get_internal_space_details`	Admin fetches internal space details
`admin:get_internal_space_members`	Admin fetches internal space members
`admin:get_internal_space_resources`	Admin fetches internal space resources
`admin:list_internal_spaces`	Admin lists internal spaces

System Operations

Audit Log Type	Description
`system:create_client_matters`	System creates client matters
`system:create_ethical_wall`	System creates ethical wall
`system:create_service_user`	System creates service user
`system:deregister_integration_webhook`	System deregisters integration webhook
`system:ethical_wall_sync_completed`	System completes an ethical wall sync
`system:ethical_wall_sync_wall_update`	System updates an ethical wall during a sync
`system:invalidate_integration_credential`	System invalidates integration credential
`system:invoice_review_guideline_activate`	System activates an invoice review guideline
`system:register_integration_webhook`	System registers integration webhook
`system:trigger_dms_one_way_sync`	System triggers DMS one-way sync
`system:update_client_matters`	System updates client matters

Automations

Automation events record actions a Harvey automation takes on a workspace’s behalf, without a user in the request.

Audit Log Type	Description
`automation:apply_contract_review_routing_decision`	Automation applies contract review routing decision
`automation:event_sanitization`	Automation sanitizes a history event
`automation:notify_contract_review_requester`	Automation notifies the requester of a contract review
`automation:route_contract_review_request_from_email`	Automation routes contract review request from email

Retired log types

These types were removed from Harvey and are no longer emitted. They remain documented because historical logs can still carry them. The log_type query parameter rejects them with a 400, so filter for them client-side.

Audit Log Type	Description
`admin:create_external_connection_invite`	Admin created an external connection invite
`user:add_user_group_members`	User adds user group members
`user:get_external_connections_requests_page`	User viewed the external connection requests page
`user:remove_user_group_members`	User removes user group members

Need help getting started? Contact your Harvey Customer Success Manager for more information.

​Overview

​Endpoints

​Search Audit Logs

​Get Earliest Audit Log

​Get Latest Audit Log

​Query Audit Logs

​Use Cases

​Use Case 1: Compliance Monitoring and Audit Trail Capture

​Use Case 2: Incident Response and User Investigations

​Use Case 3: Continuous Monitoring

​Regular Cadence Fetching

​Initial Backfill

​Incremental Updates

​Scheduling Recommendations

​Key Considerations

​Best Practices

​Error Handling

​Audit Log Types

​API Operations

​Authentication

​SCIM Provisioning

​Directory sync events

​SCIM configuration

​Admin Operations

​Users, roles, and permissions

​Workspace configuration

​Client matters

​Clients

​Billing and usage

​Single sign-on

​Ethical walls

​Integrations and MCP servers

​Playbooks

​History, exports, and retention

​User Operations

​Assistant, history, and threads

​Files and documents

​Vault

​Review tables

​Playbooks and playbook review

​Clause library

​Contract review

​Legal Hub

​Deals, diligence, and portfolios

​Facts and chronology

​Horizon scanning

​Timekeeping

​Invoice review

​Workflows and agents

​Workflow builder

​Knowledge sources and library

​Structured datasets

​Command Center and analysis

​Tasks

​Comments

​Meetings, audio, and transcription

​Email and mailbox

​Integrations and DMS

​MCP

​Sharing, groups, and resource access

​Ethical walls

​Client matters

​User settings and notifications

​Microsoft add-ins

​Word add-in

​Outlook add-in

​Microsoft Teams and Copilot

​Shared Spaces

​Space membership and lifecycle

​Resource sharing in spaces

​Space templates and configuration

​External connections

​Spaces administration

​System Operations

​Automations

​Retired log types

Overview

Endpoints

Search Audit Logs

Get Earliest Audit Log

Get Latest Audit Log

Query Audit Logs

Use Cases

Use Case 1: Compliance Monitoring and Audit Trail Capture

Use Case 2: Incident Response and User Investigations

Use Case 3: Continuous Monitoring

Regular Cadence Fetching

Initial Backfill

Incremental Updates

Scheduling Recommendations

Key Considerations

Best Practices

Error Handling

Audit Log Types

API Operations

Authentication

SCIM Provisioning

Directory sync events

SCIM configuration

Admin Operations

Users, roles, and permissions

Workspace configuration

Client matters

Clients

Billing and usage

Single sign-on

Ethical walls

Integrations and MCP servers

Playbooks

History, exports, and retention

User Operations

Assistant, history, and threads

Files and documents

Vault

Review tables

Playbooks and playbook review

Clause library

Contract review

Legal Hub

Deals, diligence, and portfolios

Facts and chronology

Horizon scanning

Timekeeping

Invoice review

Workflows and agents

Workflow builder

Knowledge sources and library

Structured datasets

Command Center and analysis

Tasks

Comments

Meetings, audio, and transcription

Email and mailbox

Integrations and DMS

MCP

Sharing, groups, and resource access

Ethical walls

Client matters

User settings and notifications

Microsoft add-ins

Word add-in

Outlook add-in

Microsoft Teams and Copilot

Shared Spaces

Space membership and lifecycle

Resource sharing in spaces

Space templates and configuration

External connections

Spaces administration

System Operations

Automations

Retired log types