Table of Contents [expand]
Last updated February 05, 2026
Enterprise accounts can export an audit trail, a JSON-formatted archive of certain events associated with the account. This archive helps with compliance, auditing, and accountability requirements.
Access
If you have the manage permission in your company’s Enterprise account, you can find and use the feature under the Settings tab.
Usage
Heroku provides a separate event archive for each calendar month. It doesn’t provide real-time event logging. If you request the event archive for the current month, the archive includes all events from the start of the current month up to midnight UTC of the current day.
First, install the Enterprise Accounts CLI plugin:
$ heroku plugins:install @heroku-cli/plugin-enterprise
To list all available event archives:
$ heroku enterprise:audits -e my-enterprise-account-name
To export the current month’s archive:
$ heroku enterprise:audits:export -e my-enterprise-account-name
To export a particular month’s archive:
$ heroku enterprise:audits:export 2018-01 -e my-enterprise-account-name
The exported archive doesn’t always list audit trail entries in chronological order. You can use jq to sort the entries in the JSON file. For example, jq '.entries |= sort_by(.created_at)' your-exported-file.json.
You can also export the audit trail from your enterprise account in the Heroku Dashboard. From the Settings tab, select a month and then Export as JSON in the Audit Logs row.
Supported Events
Audit trails include the following event types, selected to help with auditing and compliance requirements:
[
"addon.attach",
"addon.create",
"addon.destroy",
"addon.detach",
"addon.update",
"app.create",
"app.destroy",
"app.update",
"app_transfer.create",
"app_transfer.update",
"applink_connection.create",
"applink_connection.refresh",
"applink_connection.destroy",
"applink_authorization.create",
"applink_authorization.refresh",
"applink_authorization.destroy",
"applink_app.publish",
"applink_app.update",
"applink_app.destroy",
"code_release.create",
"collaborator.create",
"collaborator.destroy",
"config_change.remove",
"config_change.set",
"domain.create",
"domain.destroy",
"enterprise_account_membership.create",
"enterprise_account_membership.destroy",
"enterprise_account_membership.update",
"heroku_config_change.update",
"sni_endpoint.create",
"sni_endpoint.destroy",
"sni_endpoint.update",
"space.create",
"space.destroy",
"space.update",
"team_membership.create",
"team_membership.destroy",
"team_membership.update",
"team.destroy",
"team.update",
"trusted_ip.update"
]