Skip to main content
Passport keeps two separate records:
  • Activity records calls made through Passport.
  • Admin activity records privileged workspace changes.
Keeping them separate makes it clear whether an event came from an agent or from an administrator changing the workspace.

​
Your Activity

Everyone can open Activity to see their own calls. A row shows the app, action, agent, outcome, and timing.
  • Allowed means the call completed.
  • Blocked means access, Safety, an approval, or a guardrail stopped it.
  • Error means the call was allowed but did not complete successfully.

​
Workspace activity

On Pro and Enterprise, the admin Activity page shows calls across the workspace. Filters cover person, apps, team, agent, outcome, time, and search text. Choose Me in the person filter to see only your own calls. You can select several apps at once. Filtered views have shareable URLs, and on Enterprise, Guardrail findings can open the relevant view. Passport CLI may add an optional via CLI label so the record can distinguish tools such as Codex and Claude Code. That label is self-reported; the signed-in person or agent and the agent policy remain authoritative. Dynamic MCP agents can appear by their reported name or title, with their reported version retained when available. Like the CLI caller label, this is self-reported context; it does not change the authenticated identity or grant access. See agent names.

​
Admin activity

Open Settings → Admin activity on Pro or Enterprise to review changes such as:
  • approving or removing an app;
  • changing a role or team;
  • creating or editing a guardrail;
  • changing agent policy; or
  • generating or revoking a SCIM token.
Each entry records the actor, action, target, time, and a concise description of the change.

​
Export

Activity export

GET /export/activity.csv and GET /export/activity.jsonl require Pro or Enterprise. They accept the same member, app, outcome, department, via, since, and q filters as the Activity page. Repeat app to include several apps. In this API, department means team, via means agent, and q is search text.

Audit export

GET /export/audit.csv exports the privileged-action trail and also requires Pro or Enterprise.
Every plan lets an admin download a full workspace backup. On Free, use Settings → Workspace essentials → Manage workspace → Advanced. On Pro and Enterprise, use Settings → Workspace → Workspace backup. A backup is for recovery and support, not for security monitoring.
Passport scrubs sensitive content before Activity is stored. A blocked credential cannot reappear through an export. See Guardrails.

​
Stream to your SIEM

Enterprise can stream both record types to a SIEM over HTTP or to an OpenTelemetry collector. See SIEM and OTLP export.