# Anypoint Platform audit logs and retention

*MuleSoft Platform Integration Architect Study Guide · Designing integration solutions to meet security requirements · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect/designing-integration-solutions-to-meet-security-requirements/anypoint-platform-audit-logs-and-retention*

What the Anypoint Platform audit logging service records and who can see it, how sign-in events are logged by identity type, how to configure retention, and how to export audit logs with Telemetry Exporter or pull them reliably through the Audit Log Query API.

- Certification: Salesforce MuleSoft Platform Integration Architect
- Exam section: Designing integration solutions to meet security requirements
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect

**Official exam objective:**

> Recognize the audit logging capabilities of Anypoint Platform.

## What the exam expects

- Recognize what an Anypoint Platform audit log entry contains, including Anypoint Staff and connected app attribution.
- Determine who can view audit logs and why a business-group-scoped viewer sees only part of the history.
- Predict which sign-in events appear in the audit log for Anypoint Platform accounts, SAML, LDAP and OpenID Connect (OIDC) users.
- Configure audit log retention to meet a compliance period, with the right permissions, scope and timing.
- Design a reliable export or extraction of audit logs with Telemetry Exporter or the Audit Log Query API.

**Audit logging service:** a queryable, timestamped history of user interactions with objects in Anypoint Platform ([Audit Logging](https://docs.mulesoft.com/access-management/audit-logging)). **Audit Log Viewer:** the permission, besides Organization Administrator, that opens the audit log UI and Query API ([Audit Logging](https://docs.mulesoft.com/access-management/audit-logging)). **Audit Log Config Manager:** the permission that lets a user change the retention period ([Audit Log Retention](https://docs.mulesoft.com/access-management/audit-log-retention)). **Telemetry Exporter:** the Anypoint Monitoring feature that sends audit logs to third-party observability tools ([Audit Logging](https://docs.mulesoft.com/access-management/audit-logging)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default retention | One year; six years for organizations created before July 10, 2023 | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| Retention range | 30 to 2190 days | [Audit Log Retention](https://docs.mulesoft.com/access-management/audit-log-retention) |
| Retention effective date | At least seven days ahead; starts 00:00:00 UTC | [Audit Log Retention](https://docs.mulesoft.com/access-management/audit-log-retention) |
| Retention permissions | Audit Log Config Manager; Organization Administrator for the UI | [Audit Log Retention](https://docs.mulesoft.com/access-management/audit-log-retention) |
| Viewing permissions | Organization Administrator or Audit Log Viewer | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| Login and logout scope | Organization level only | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| OIDC or LDAP login failures | Not recorded | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| Export deduplication key | mulesoft.audit.id | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| Export payload limit | Truncated above 30KB compressed | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |
| Automatic date-patch entry | Logged by Anypoint Staff | [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates) |
| Query API rate limit | 700 per minute per IP in US; 40 in EU and Gov | [Audit Logging](https://docs.mulesoft.com/access-management/audit-logging) |

## Check yourself

- Why might a failed sign-in with a mistyped, nonexistent username leave no audit entry for an Anypoint Platform account?
- When can an organization configure its audit log retention period at all?
- Which products' audit entries carry an Environment value?
- What does the payload of an organization-creation audit entry contain?

## Sources

- [Audit Logging in Anypoint Platform](https://docs.mulesoft.com/access-management/audit-logging)
- [Configure Audit Log Retention in Anypoint Platform](https://docs.mulesoft.com/access-management/audit-log-retention)
- [CloudHub Runtime Continuous Updates](https://docs.mulesoft.com/cloudhub/cloudhub-app-runtime-version-updates)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams