Activity Feed

Keep track of what happens in your Sanity organizations and projects

The Activity Feed lets you investigate what happened in your Sanity organizations and projects. If you are uncertain how a scenario took place, you can use the Activity Feed to investigate what actually happened.

An event describes a recorded action, when it happened, and the person or service that performed it, when available. Each event has a unique ID. The actor is the person or service performing the action; the affected user or resource is the target.

The following categories are examples of management activity. They are not a complete list of every platform action.

• Organization settings, billing details, and legal contacts.
• Membership, invitations, roles, and permissions.
• Authentication settings, such as SAML enforcement.
• Project assignment and ownership changes.

• Project settings, including the name and custom studio URL.
• Membership, invitations, roles, and permissions.
• Dataset creation, configuration, copying, and deletion.
• API tokens, CORS origins, webhooks, and GraphQL configuration.
• Project archival and reactivation, and Activity Feed visibility changes.

You can download your organization’s or project’s activity as a CSV file:

• In the organization's or project's Activity view, click Export.
• Select the From and To dates.
• In the export dialog, click Export to download the CSV file.

Manage's CSV download returns up to 10,000 events. If your chosen range contains more events, narrow the date range and export smaller periods.

The CSV includes standard event fields such as id, action, timestamp, actor details, and available organization, project, dataset, and target-user details. Optional values can be empty.

Additional metadata.<key> columns depend on the metadata in the selected events. For example, an export can contain metadata.email, metadata.invitedBy, or metadata.role. Column names are sorted alphabetically; metadata columns can differ between downloads.

For field definitions and filtered API access, see Retrieve management events with the Activity Log API.

Activity Feed Export delivers recorded management activity from your organization and its projects to a Google Cloud Storage (GCS) bucket you control, once an hour. Use the files to retain activity history and ingest it into your security or analysis tools.

The export contains selected fields mapped to Open Cybersecurity Schema Framework (OCSF) version 1.9.0. It is a different format from the CSV download.

Activity Feed Export must be enabled for your organization. Contact Enterprise Support to confirm availability. To connect a bucket and verify delivery, see Export activity to Google Cloud Storage. For file paths, manifests, and event fields, see the Activity Feed Export data reference.