Skip to content

docs: refresh activity logs for Docker Home #26362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
akristen merged 4 commits into from
Oct 16, 2026
Merged

docs: refresh activity logs for Docker Home #26362

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
319f8ad
docs: rewrite activity logs for Docker Home filters and events
akristen Oct 15, 2026
ec95db5
docs: simplify activity log filter category blurbs
akristen Oct 15, 2026
703b410
docs: freshness pass on activity logs access and filters
akristen Oct 15, 2026
d1f6b51
docs: point activity logs to audit _index.md
akristen Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
356 changes: 226 additions & 130 deletions content/manuals/accounts/organization/activity-logs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,12 @@
---
title: Activity logs
weight: 40
description: Learn how to access and interpret Docker activity logs for organizations and repositories.
keywords: audit log, organization activity, Docker business logs, repository activity, track changes Docker, security logs Docker, filter logs, log Docker events
description: >-
View, filter, and export organization and repository activity logs in Docker
Home.
keywords: >-
activity logs, audit logs, Docker Home, organization activity, repository
activity, filter activity logs, export CSV, security audit trail
aliases:
- /admin/activity-logs/
- /docker-hub/audit-log/
Expand All @@ -11,149 +15,241 @@ aliases:

{{< summary-bar feature_name="Activity logs" >}}

Activity logs display a chronological list of activities that occur at organization and repository levels. The activity log provides organization owners with a record of all
member activities.
Activity logs show a chronological list of organization and repository
changes in Docker Home. Use them to see what changed, when it changed, and who
made the change.

With activity logs, owners can view and track:
Organization owners and members with a custom role that includes the
**View activity logs** permission can open the activity log.

- What changes were made
- The date when a change was made
- Who initiated the change

For example, activity logs display activities such as the date when a repository was created or deleted, the member who created the repository, the name of the repository, and when there was a change to the privacy settings.

Owners can also see the activity logs for their repository if the repository is part of the organization subscribed to a Docker Business or Team subscription.
> [!TIP]
>
> Use activity logs for an admin audit trail of your organization and
> repositories, including AI Governance policy and settings changes. For
> enforcement events, such as policy decisions and sandbox sessions, see
> [AI Governance Audit Logs](/manuals/ai/sandboxes/governance/audit/_index.md).

## Access activity logs

{{< tabs >}}
{{< tab name="Docker Home">}}

To view activity logs in Docker Home:

1. Sign in to [Docker Home](https://app.docker.com) and select your
organization.
organization.
1. Select **Activity**.

{{< /tab >}}
{{< tab name="API">}}
To query activity logs programmatically, use the
[Audit logs endpoints](/reference/api/hub/latest/#tag-audit-logs) in the
Docker Hub API. The API returns events from the last 3 months, up to 31 days
per request.

### Filter by date

By default, the **Activity** page shows events from the last 7 days. Docker
Home keeps activity logs for 90 days, and you can query up to 30 days at a
time.

1. On the **Activity** page, select the **Date range** field.
1. Select a preset such as **Today**, **Yesterday**, **This week**, **This
month**, **Last 7 days**, or **Last 30 days**, or type a start date and an
end date.

On the calendar, you can select dates in the 30 days leading up to the end
date. To view an earlier period within the 90-day retention window, type the
start date and the end date in the field.

The log updates to show only the activities that occurred during that period.

### Filter by type

To show only one category of events:

1. On the **Activity** page, open the **All activities** drop-down and select
a category:
- **Organization**: Organization management events
- **Repository**: Events from repositories for every repository that belongs
to the organization
- **Enterprise**: Configuration events for company settings
- **Billing**: Subscription change events
- **OIDC**: OIDC setup events
- **Offload**: Docker Offload usage
- **Governance**: Admin configuration events for AI Governance
1. Optional. From the **All Actions** drop-down, select a specific event type
within that category.

### Export

To download activity logs as a CSV file from the **Activity** page:

1. Optional. Apply a date range or activity type filter. The export includes
only the events that match your current filters.
1. Select the export icon next to the date range.

## Activity log events reference

{{< accordion title="Organization" >}}

The following table lists organization events that cover teams, members, SSO
domains, access tokens, and custom roles.

| Event | Description |
|:------|:------------|
| Team Created | Team was created |
| Team Updated | Team was modified |
| Team Deleted | Team was deleted |
| Team Member Added | Member was added to a team |
| Team Member Removed | Member was removed from a team |
| Org Member Invited | Member was invited to the organization |
| Organization Member Added | Member was added to the organization |
| Organization Member Removed | Member was removed from the organization |
| Member Role Changed | Member's role in the organization was changed |
| Organization Created | Organization was created |
| Organization Settings Updated | Organization setting was updated |
| Registry Access Management enabled | Registry Access Management was enabled |
| Registry Access Management disabled | Registry Access Management was disabled |
| Registry Access Management registry added | Registry was added |
| Registry Access Management registry removed | Registry was removed |
| Registry Access Management registry updated | Registry was updated |
| Single Sign-On domain added | SSO domain was added |
| Single Sign-On domain deleted | SSO domain was removed |
| Single Sign-On domain verified | SSO domain was verified |
| Organization Auto-Provisioning Toggled | Auto-provisioning was turned on or off for a domain |
| Access token created | Access token was created |
| Access token updated | Access token was updated |
| Access token revoked | Access token was revoked |
| Access token deleted | Access token was deleted |
| Custom role created | Custom role was created |
| Custom role updated | Custom role was updated |
| Custom role deleted | Custom role was deleted |

{{< /accordion >}}

{{< accordion title="Enterprise" >}}

The following table lists enterprise events that cover settings policies and
company-level SSO and SCIM connections.

| Event | Description |
|:------|:------------|
| Policy created | Settings policy was added |
| Policy updated | Settings policy was updated |
| Policy deleted | Settings policy was deleted |
| Policy transferred | Settings policy was transferred to another owner |
| Create SSO Connection | Organization or company SSO connection was created |
| Update SSO Connection | Organization or company SSO connection was updated |
| Delete SSO Connection | Organization or company SSO connection was deleted |
| Enforce SSO | SSO enforcement was toggled on a connection |
| Enforce SCIM | SCIM was toggled on a connection |
| Refresh SCIM Token | SCIM token was refreshed |
| Change SSO Connection Type | Connection type was changed |
| Toggle JIT provisioning | JIT provisioning was toggled on a connection |

{{< /accordion >}}

{{< accordion title="Repository" >}}

The following table lists repository events that cover create, delete, privacy,
tags, and related repository changes.

To view activity logs using the Docker Hub API, use the [Audit logs endpoints](/reference/api/hub/latest/#tag-audit-logs).

{{< /tab >}}
{{< /tabs >}}

## Filter and customize activity logs
> [!NOTE]
>
> Event descriptions that include a user action can refer to a Docker username,
> personal access token (PAT), or organization access token (OAT). For example,
> if a user pushes a tag, the description may show:
> `<user-access-token>` pushed the tag to the repository.

| Event | Description |
|:------|:------------|
| Repository Created | Repository was created |
| Repository Deleted | Repository was deleted |
| Repository Updated | Repository description, full description, or status was updated |
| Privacy Changed | Repository privacy settings were updated |
| Tag Pushed | Tags were pushed |
| Tag Deleted | Tags were deleted |
| Categories updated | Repository categories were set or updated |
| Tag immutability updated | Tag immutability was updated |

{{< /accordion >}}

{{< accordion title="Billing" >}}

The following table lists billing events that cover plan changes, seats, and
license assignment.

| Event | Description |
|:------|:------------|
| Plan Upgraded | Billing plan was upgraded |
| Plan Downgraded | Billing plan was downgraded |
| Seat Added | Seat was added to the billing plan |
| Seat Removed | Seat was removed from the billing plan |
| Billing Cycle Changed | Billing cycle interval was changed |
| Plan Downgrade Canceled | Scheduled plan downgrade was canceled |
| Seat Removal Canceled | Scheduled seat removal was canceled |
| Plan Upgrade Requested | User requested a plan upgrade |
| Plan Downgrade Requested | User requested a plan downgrade |
| Seat Addition Requested | User requested additional seats |
| Seat Removal Requested | User requested fewer seats |
| Billing Cycle Change Requested | User requested a billing cycle change |
| Plan Downgrade Cancellation Requested | User requested cancellation of a scheduled plan downgrade |
| Seat Removal Cancellation Requested | User requested cancellation of a scheduled seat removal |
| Billing Product Changed | Subscribed product was changed |
| License Assigned | Product license was assigned to a user |
| License Removed | Product license was removed from a user |
| Auto-assign rule created | Automatic license assignment rule was created |
| Auto-assign rule removed | Automatic license assignment rule was removed |
| Automatic License Assignment Enabled | Automatic license assignment was turned on for a product |
| Automatic License Assignment Disabled | Automatic license assignment was turned off for a product |
| Licenses Expired | Licenses expired |

{{< /accordion >}}

{{< accordion title="OIDC" >}}

The following table lists OIDC events that cover creating, updating, and
deleting OIDC connections.

| Event | Description |
|:------|:------------|
| OIDC connection created | OIDC connection was created |
| OIDC connection updated | OIDC connection was updated |
| OIDC connection deleted | OIDC connection was deleted |

{{< /accordion >}}

{{< accordion title="Offload" >}}

The following table lists Offload events that cover lease start and end.

> [!IMPORTANT]
> [!NOTE]
>
> Docker Home retains activity logs for 30 days. To retrieve
activities beyond 30 days, you must use the
[Docker Hub API](/reference/api/hub/latest/#tag-audit-logs).
> Event descriptions show the Docker username of the actor and details about
> the lease.

By default, the **Activity** tab displays all recorded events within
the last 30 days. To narrow your view, use the calendar to select a specific
date range. The log updates to show only the activities that occurred during
that period.
| Event | Description |
|:------|:------------|
| Offload lease start | Offload lease started |
| Offload lease end | Offload lease ended |

You can also filter by activity type. Use the **All Activities** drop-down to
focus on organization-level, repository-level, or billing-related events.
In Docker Hub, when viewing a repository, the **Activities** tab only shows
events for that repository.
{{< /accordion >}}

After selecting a category—**Organization**, **Repository**, or **Billing**—use
the **All Actions** drop-down to refine the results even further by specific
event type.
{{< accordion title="Governance" >}}

> [!NOTE]
>
> Events triggered by Docker Support appear under the username **dockersupport**.

## Types of activity log events

Refer to the following section for a list of events and their descriptions:

### Organization events

| Event | Description |
|:------------------------------------------------------------------|:------------------------------------------------|
| Team Created | Activities related to the creation of a team |
| Team Updated | Activities related to the modification of a team |
| Team Deleted | Activities related to the deletion of a team |
| Team Member Added | Details of the member added to your team |
| Team Member Removed | Details of the member removed from your team |
| Team Member Invited | Details of the member invited to your team |
| Organization Member Added | Details of the member added to your organization |
| Organization Member Removed | Details about the member removed from your organization |
| Member Role Changed | Details about the role changed for a member in your organization |
| Organization Created | Activities related to the creation of a new organization |
| Organization Settings Updated | Details related to the organization setting that was updated |
| Registry Access Management enabled | Activities related to enabling Registry Access Management |
| Registry Access Management disabled | Activities related to disabling Registry Access Management |
| Registry Access Management registry added | Activities related to the addition of a registry |
| Registry Access Management registry removed | Activities related to the removal of a registry |
| Registry Access Management registry updated | Details related to the registry that was updated |
| Single Sign-On domain added | Details of the single sign-on domain added to your organization |
| Single Sign-On domain removed | Details of the single sign-on domain removed from your organization |
| Single Sign-On domain verified | Details of the single sign-on domain verified for your organization |
| Access token created | Access token created in organization |
| Access token updated | Access token updated in organization |
| Access token deleted | Access token deleted in organization |
| Policy created | Details of adding a settings policy |
| Policy updated | Details of updating a settings policy |
| Policy deleted | Details of deleting a settings policy |
| Policy transferred | Details of transferring a settings policy to another owner |
| Create SSO Connection | Details of creating a new org/company SSO connection |
| Update SSO Connection | Details of updating an existing org/company SSO connection |
| Delete SSO Connection | Details of deleting an existing org/company SSO connection |
| Enforce SSO | Details of toggling enforcement on an existing org/company SSO connection |
| Enforce SCIM | Details of toggling SCIM on an existing org/company SSO connection |
| Refresh SCIM Token | Details of a SCIM token refresh on an existing org/company SSO connection |
| Change SSO Connection Type | Details of a connection type change on an existing org/company SSO connection |
| Toggle JIT provisioning | Details of a JIT toggle on an existing org/company SSO connection |

### Repository events
The following table lists governance events that cover the AI Governance
admin audit trail, such as policy and settings changes. For enforcement
events, such as policy decisions and sandbox sessions, see
[AI Governance Audit Logs](/manuals/ai/sandboxes/governance/audit/_index.md).

> [!NOTE]
>
> Event descriptions that include a user action can refer to a Docker username, personal access token (PAT) or organization access token (OAT). For example, if a user pushes a tag to a repository, the event would include the description: `<user-access-token>` pushed the tag to the repository.

| Event | Description |
|:------------------------------------------------------------------|:------------------------------------------------|
| Repository Created | Activities related to the creation of a new repository |
| Repository Deleted | Activities related to the deletion of a repository |
| Repository Updated | Activities related to updating the description, full description, or status of a repository |
| Privacy Changed | Details related to the privacy policies that were updated |
| Tag Pushed | Activities related to the tags pushed |
| Tag Deleted | Activities related to the tags deleted |
| Categories Updated | Activities related to setting or updating categories of a repository |

### Billing events

| Event | Description |
|:------------------------------------------------------------------|:------------------------------------------------|
| Plan Upgraded | Occurs when your organization’s billing plan is upgraded to a higher tier plan.|
| Plan Downgraded | Occurs when your organization’s billing plan is downgraded to a lower tier plan. |
| Seat Added | Occurs when a seat is added to your organization’s billing plan. |
| Seat Removed | Occurs when a seat is removed from your organization’s billing plan. |
| Billing Cycle Changed | Occurs when there is a change in the recurring interval that your organization is charged.|
| Plan Downgrade Canceled | Occurs when a scheduled plan downgrade for your organization is canceled.|
| Seat Removal Canceled | Occurs when a scheduled seat removal for an organization’s billing plan is canceled. |
| Plan Upgrade Requested | Occurs when a user in your organization requests a plan upgrade. |
| Plan Downgrade Requested | Occurs when a user in your organization requests a plan downgrade. |
| Seat Addition Requested | Occurs when a user in your organization requests an increase in the number of seats. |
| Seat Removal Requested | Occurs when a user in your organization requests a decrease in the number of seats. |
| Billing Cycle Change Requested | Occurs when a user in your organization requests a change in the billing cycle. |
| Plan Downgrade Cancellation Requested | Occurs when a user in your organization requests a cancellation of a scheduled plan downgrade. |
| Seat Removal Cancellation Requested | Occurs when a user in your organization requests a cancellation of a scheduled seat removal. |

### Offload events
| Event | Description |
|:------|:------------|
| AI Governance Policy created | AI governance policy was created |
| AI Governance Policy updated | AI governance policy was updated |
| AI Governance Policy deleted | AI governance policy was deleted |
| AI Governance Settings updated | AI governance settings were updated |

> [!NOTE]
>
> Event descriptions show the Docker username of the actor and details about the lease.
{{< /accordion >}}

## Next steps

| Event | Description |
|:------------------------------------------------------------------|:------------------------------------------------|
| Offload Lease Start | Occurs when an Offload lease is started in your organization. |
| Offload Lease End | Occurs when an Offload lease is ended in your organization. |
- [Roles and permissions](/manuals/security/roles-and-permissions/_index.md) for
the **View activity logs** permission and custom roles
- [AI Governance Audit Logs](/manuals/ai/sandboxes/governance/audit/_index.md) for
enforcement events such as policy decisions and sandbox sessions
- [Audit logs API](/reference/api/hub/latest/#tag-audit-logs) to query events
programmatically