GET /v1/audit returns only the actions listed below, grouped by what they act on. Each one lists the fields its data carries. Every field an action declares is always present in data: one marked nullable is null whenever Granola had nothing to record for it, and any field reads as null rather than being dropped if the value it recorded could not be read back. Read the Audit API overview first for access, rotation and pagination.
Sign-in and sessions
auth.calendar_linked
A member connected a calendar account to Granola, with the access the provider granted.
auth.login
A member signed in, with how they authenticated and from which client.
auth.login_failed
A login attempt through this workspace’s identity provider failed.
auth.logout
A user logged out of Granola.
data is empty for this action.
auth.session_revoked
One of a member’s sign-in sessions, or all of them, were revoked, with the reason they ended.
auth.sessions_revoked
A member was signed out of every session because their connected calendar credentials stopped validating.
Billing
billing.subscription.canceled
The workspace subscription was canceled, with the state it was in beforehand.
billing.subscription.seats_updated
The number of seats on the workspace subscription changed.
billing.subscription.status_updated
The workspace subscription’s status changed, for example from active to past due.
Chat follow-up emails
chat_follow_up_email.sent
A member sent a follow-up email through Granola’s chat assistant, with the number of direct, CC, and BCC recipients.
Data exports
data_export.failed
A requested data export failed after exhausting its retries. No download link was sent.
data_export.requested
A workspace member requested an export of their notes from this workspace. It is generated in the background and emailed to them as a download link.
data_export.succeeded
A requested data export finished and its download link was emailed to the workspace member who asked for it.
Notes
document.access_granted
One or more users were given access to a note.
document.access_revoked
One or more users lost access to a note.
document.hard_deleted
A note was permanently deleted, along with its transcript and chat history.
document.moved_to_workspace
A note was moved out of this workspace into another one, and dropped out of any folders or spaces it was in here.
document.sharing_link_visibility_changed
The sharing link visibility of a note was changed, which controls who can open the note from its link.
document.user_role_changed
A user’s role on a note was changed, for example from viewer to collaborator.
document.viewed
A user opened a note and saw its content. source says where it was opened from. Only authenticated reads are recorded, from the desktop and web apps.
Folders and spaces
document_list.deleted
A folder or space was deleted. The notes it held are not deleted with it.
document_list.document_added
A note was added to a folder or space.
document_list.document_removed
A note was removed from a folder or space.
document_list.invite_created
People without a Granola account were invited to a folder or space by email address. They get the invited role once they sign up.
document_list.invite_link_created
A shareable invite link to a folder or space was created. Anyone holding the link can join with that link’s role until it expires or is revoked.
document_list.invite_link_joined
Someone joined a folder or space using a shareable invite link.
document_list.invite_link_revoked
A shareable folder or space invite link was revoked and can no longer be used to join.
document_list.invite_role_changed
The role a pending folder or space invitation will grant was changed.
document_list.member_added
One or more users were given access to a folder or space.
document_list.member_removed
One or more users lost access to a folder or space.
document_list.member_role_changed
A member’s role on a folder or space changed, for example from viewer to collaborator.
document_list.updated
A folder or space was renamed, re-described, moved, or had its visibility changed. Only the keys that changed are present, and changes is an empty object when a change touched only keys this endpoint does not report — an icon-only edit, for instance. title and description report as "[redacted]" rather than their text: the edit is recorded, the wording is not. Either still reports null when the value was cleared.
Follow-up emails
follow_up_email.retention_cleanup_run
Granola’s retention policy deleted follow-up emails in this workspace, with how many were removed.
follow_up_email.sent
A member sent a follow-up email for a meeting from Granola’s follow-up composer, with how many people it went to.
Integrations
integration.attio_connected
The Attio integration was connected.
integration.attio_disconnected
The Attio integration was disconnected. Where Granola managed Attio lists for the workspace, the counts record what was removed.
integration.cloud_agent_disconnected
A cloud connector was disconnected and its stored access tokens were revoked.
integration.hubspot_connected
The HubSpot integration was connected.
integration.hubspot_disconnected
The HubSpot integration was disconnected.
integration.notion_connected
The Notion integration was connected.
data is empty for this action.
integration.notion_disconnected
The Notion integration was disconnected.
data is empty for this action.
integration.pipedrive_connected
The Pipedrive integration was connected.
integration.pipedrive_disconnected
The Pipedrive integration was disconnected.
integration.salesforce_connected
The Salesforce integration was connected.
integration.salesforce_disconnected
The Salesforce integration was disconnected.
integration.slack_connected
The Slack integration was connected.
integration.slack_disconnected
The Slack integration was disconnected.
integration.user_connection_removed
A user’s connection to a third-party integration was removed, so notes in the affected folder or space stop syncing for them.
integration.zapier_connection_created
A Zapier connection was created.
integration.zapier_connection_deleted
A Zapier connection was deleted.
MCP
mcp.token_disabled
A member’s MCP token was removed, revoking MCP client access to their notes.
data is empty for this action.
mcp.token_enabled
A member created an MCP token, letting an MCP client read their notes through Granola’s MCP server.
data is empty for this action.
mcp.token_regenerated
A member replaced their MCP token. The previous token stops working immediately.
data is empty for this action.
mcp.tool_used
A user invoked a Granola tool through an external MCP connection.
Note transfers
notes.transfer_completed
A transfer of another Granola account’s notes into this workspace completed, with how many notes arrived.
notes.transfer_out
A member’s notes were transferred out of this workspace into another Granola account, with how many notes left.
Recipes
recipe.created
A recipe was created. Reported only when the recipe was shared with the workspace as it was created.
recipe.deleted
A recipe was deleted, either by its owner or by Granola for a built-in recipe. Reported only for recipes shared with the workspace.
recipe.updated
A recipe was changed. Names which parts changed, but never the recipe’s own instructions or examples. Reported only for recipes shared with the workspace, and a change that shares or unshares one is reported either way, as config.show_in_shared_tabs. Only the keys that changed are present, and changes is an empty object when a change touched only keys this endpoint does not report.
Transcript views
transcript.viewed
A user opened a note’s transcript and saw its content. source says which surface it was read on. Only authenticated reads are recorded, from the desktop app.
Transcripts
transcription.chunks_deleted
Parts of a note’s transcript were deleted, with the time range of each part removed.
transcription.ended
A recording ended. occurred_at is when the recording actually stopped; the scheduled times and calendar IDs describe the meeting it belongs to, if it was on a calendar. Scheduled times are RFC 3339 timestamps, or a plain YYYY-MM-DD date for an all-day meeting.
transcription.policy_acknowledged_to_continue
A user acknowledged one or more workspace transcription policies and chose to continue. Condition types describe what the client reported showing. This records the user’s selection, not that recording subsequently started.
transcription.started
A recording started. occurred_at is when the recording actually began; the scheduled times and calendar IDs describe the meeting it belongs to, if it was on a calendar. Scheduled times are RFC 3339 timestamps, or a plain YYYY-MM-DD date for an all-day meeting.
User accounts
user.email_changed
A member’s Granola email address changed, with the address before and after.
Groups
user_group.created
A user group was created in the workspace.
user_group.deleted
A user group was deleted. Its members keep their own workspace access.
user_group.document_access_granted
One or more user groups were given access to a note.
user_group.document_access_revoked
One or more user groups lost access to a note.
user_group.document_list_access_granted
One or more user groups were given access to a folder or space.
user_group.document_list_access_revoked
One or more user groups lost access to a folder or space.
user_group.dsync_converted_to_manual
A user group stopped being managed by directory sync and is now maintained by hand.
user_group.dsync_deleted
A directory-synced user group was deleted because it disappeared from the identity provider.
user_group.dsync_linked
A user group was created from an identity-provider directory group and is now managed by directory sync.
user_group.dsync_members_synced
A user group’s membership changed because the linked identity-provider directory group changed.
user_group.dsync_renamed
A directory-synced user group was renamed because the identity-provider group was renamed.
user_group.members_added
One or more users were added to a user group.
user_group.members_removed
One or more users were removed from a user group.
user_group.renamed
A user group was renamed.
Workspace
workspace.access_requested
A user asked to join the workspace and is waiting for an admin to approve or decline.
workspace.invite_link_created
A shareable invite link to the workspace was created. Anyone holding the link can join until it expires or is revoked.
workspace.invite_link_domain_blocked
Someone tried to join the workspace with an invite link and was refused because their email domain is not allowed.
workspace.invite_link_revoked
A shareable workspace invite link was revoked and can no longer be used to join.
workspace.member_added
A user was added straight into the workspace, without an invitation they had to accept.
workspace.member_invited
A user was invited to the workspace. They become a member once they accept.
workspace.member_joined
A user became a member of the workspace, by accepting an invitation, using an invite link, or joining through a verified email domain.
workspace.member_left
A member left the workspace themselves.
workspace.member_removed
A member was removed from the workspace by someone else.
workspace.member_role_changed
A member’s workspace role changed, for example from member to admin.
workspace.member_status_changed
A member’s workspace status changed, for example from invited to active, or to deactivated.
workspace.public_api_key_created
A public API key was created for the workspace.
workspace.public_api_key_first_used
A public API key made its earliest recorded authenticated request for the workspace.
workspace.public_api_key_revoked
A public API key was revoked and can no longer authenticate requests.
workspace.public_api_key_updated
A public API key’s scope was changed.
workspace.public_api_key_used
A five-minute summary of requests authenticated with a public API key.
workspace.restored
A deleted workspace was restored.
workspace.soft_deleted
The workspace was deleted. Its data is retained until it is permanently deleted, and it can still be restored.
workspace.sso-config-created
Single sign-on was configured for the workspace, setting how members are allowed to log in.
workspace.sso-config-updated
The workspace’s single sign-on configuration changed, including whether members may still log in with Google or Microsoft directly.
workspace.sso-connection-activated
A single sign-on connection became active for the workspace, so members can sign in through the identity provider.
workspace.sso-connection-deactivated
A single sign-on connection was deactivated for the workspace and can no longer be used to sign in.
workspace.sso-connection-deleted
A single sign-on connection was deleted from the workspace’s identity provider configuration.
workspace.updated
A workspace setting changed, with the value before and after. Only the keys that changed are present, and changes is an empty object when a change touched only keys this endpoint does not report.
changes and previousValues may contain: display_name, slug, logo_url, is_locked, discoverable, transcript_retention_hours, transcript_retention_hours_updated_at, sharing_link_visibility, link_sharing_allowed_domains, allow_moving_notes, allow_transfer_notes, allow_data_export, hipaa_enabled, allowed_ip_cidrs, disable_chat_web_access, dictionary, mcp_enabled, user_notes_api_enabled, zoom_rtms_enabled, self_email_enabled, privacy_mode_enabled, affirmative_consent_enabled, speaker_attribution_enabled, google_meet_consent_enabled, google_meet_consent_settings, chat_paste_enabled, chat_paste_message, legal_hold_enabled, in_meeting_copy_consent_message_banner_enabled, in_meeting_copy_consent_message_banner_message, virtual_webcam_notice_enabled, virtual_webcam_notice_enabled_at, virtual_webcam_notice_enforced, virtual_webcam_notice_require_installation_by, pre_call_email_enabled, pre_call_email_large_meeting_threshold, pre_call_email_blocklist, pre_call_email_allowlist, allow_external_sharing, allow_external_invites, allow_external_users_to_share_with_workspace, allow_public_folders, restrict_invite_links_to_domain.
workspace.webhook_endpoint_created
An API-managed webhook endpoint was created for the workspace.
workspace.webhook_endpoint_deleted
An API-managed webhook endpoint was deleted from the workspace.
workspace.webhook_endpoint_updated
A webhook endpoint for the workspace was changed. Names which parts changed, never their values, and reports whether the endpoint is delivering afterwards. Also covers the changes Granola makes on its own: disabling an endpoint after sustained delivery failures, and re-enabling it once delivery recovers.
Automations
workspace_automation.created
A workspace automation was created. It files matching meetings into a folder, or sends them to a webhook.
workspace_automation.deleted
A workspace automation was deleted.
workspace_automation.opt_in_prompt_dismissed
A workspace member dismissed an offer to enroll in an automation.
workspace_automation.self_enrolled
A workspace member enrolled themselves in an automation.
workspace_automation.updated
A workspace automation was changed. Only the keys that changed are present, and changes is an empty object when a change touched only keys this endpoint does not report.
changes and previousValues may contain: name, description, trigger_type, action_type, rule_type, selected_ids, filters, applies_to_all_users, allows_user_opt_in, destination_folder_id, owner_user_id, action_config.