> ## Documentation Index > Fetch the complete documentation index at: https://docs.cognite.com/llms.txt > Use this file to discover all available pages before exploring further. # About CDF audit logs > Learn about Cognite Data Fusion (CDF) audit logs, how they are structured, and how to use them to monitor access and activity in your projects. Audit logs record every authenticated API request made to CDF. They give you a record of who accessed which CDF resources, when, and from where — supporting security investigations, access reviews, and compliance audits. ## What audit logs capture Every authenticated API call to CDF produces an audit log entry. The entry answers four questions: | Dimension | What is recorded | | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Who** | The principal ID of the user or service account that made the request | | **When** | The UTC timestamp of the request, in milliseconds after epoch | | **Which** | The CDF organization name, project name, service name, and event type, along with request parameters that identify which resources were modified | | **Where** | Client headers sent with the request (`x-cdp-sdk`, `x-cdp-app`, and `x-cdp-clienttag`) and the caller's IP address, which identify from where the request was made | Audit logs capture details from all requests made with valid access tokens. Sometimes, audit logs contain personally identifiable information (PII), IP addresses, and other sensitive data. Treat audit log contents as confidential and restrict access to people with the appropriate security clearance. Audit logs (and associated detail) should generally be consumed and analyzed in a separate purpose-built system for security monitoring — a security information and event management (SIEM) solution — owned by the customer. ## Delivery and availability Audit logs are delivered as a [Delta Lake](https://delta.io/) table to the cloud storage destination you configure. Under normal operating conditions, log entries are available in your storage within **one hour** of the corresponding API call being made. In rare, unforeseen circumstances — such as infrastructure disruptions or exceptional system load — delivery may be delayed by up to 12 hours. Such delays are uncommon and do not indicate data loss; entries are durably queued and will be delivered once normal operation resumes. For information on configuring your storage destination and querying delivered logs, see [Setting up audit log streaming](/cdf/admin/audit/streaming) and [Audit log query reference](/cdf/admin/audit/queries). ## Audit log schema Each audit log entry contains the following fields. | Field | Type | Description | | -------------------- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `version` | string | Schema version of the audit log message | | `timestamp` | int | UTC timestamp of when the event occurred, in milliseconds after epoch | | `orgName` | string | The name of the organization | | `projectName` | string | The name of the project within the organization | | `requestHeaders` | Map\ | A map of request headers associated with the event | | `principalId` | string | The identifier of the principal (user, service account, or system) that performed the action, sourced from the access token | | `serviceName` | string | The CDF service that generated the audit log entry | | `eventType` | string | The specific event that occurred (see [Event types reference](/cdf/admin/audit/event-types)) | | `requestId` | string | A unique identifier for the request that triggered this event | | `responseCode` | int | The HTTP or gRPC status code of the response (for example, `200`, `404`, `500`) | | `requestParameters` | JSON | Event-specific parameters of the request that triggered the event. The structure varies by `serviceName` and `eventType`(see [Event types reference](/cdf/admin/audit/event-types)) | | `responseParameters` | JSON | Parameters or body of the response to the request. The structure varies by `serviceName` and `eventType` (see [Event types reference](/cdf/admin/audit/event-types)) | Headers such as `x-cdp-sdk`, `x-cdp-app`, and `x-cdp-clienttag` are captured inside `requestHeaders` only when the calling client sets them. They are absent from the map when not present in the original request.