diff --git a/.infisicalignore b/.infisicalignore
index 4c19af70c..638a799e2 100644
--- a/.infisicalignore
+++ b/.infisicalignore
@@ -7,3 +7,4 @@ docs/self-hosting/configuration/envars.mdx:generic-api-key:106
frontend/src/views/Project/MembersPage/components/MemberListTab/MemberRoleForm/SpecificPrivilegeSection.tsx:generic-api-key:451
docs/mint.json:generic-api-key:651
backend/src/ee/services/hsm/hsm-service.ts:generic-api-key:134
+docs/documentation/platform/audit-log-streams/audit-log-streams.mdx:generic-api-key:104
diff --git a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
index fdd8cc7c7..2f38a3930 100644
--- a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
+++ b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
@@ -80,3 +80,143 @@ Your Audit Logs are now ready to be streamed.
3. Create a new header with key **DD-API-KEY** and set the value as **API Key**.
+
+## Audit Log Stream Data
+
+Each log entry sent to the external logging provider will follow the same structure.
+
+### Example Log Entry
+
+```created-secret.json
+{
+ "id": "7dc1713b-d787-4147-9e21-770be01cc992",
+ "actor": "user",
+ "actorMetadata": {
+ "email": "example@infisical.com",
+ "userId": "7383b701-d83f-45c0-acb4-04e138b987ab",
+ "username": "example@infisical.com"
+ },
+ "ipAddress": "127.0.0.1",
+ "eventType": "create-secret",
+ "eventMetadata": {
+ "secretId": "3e5c796e-6599-4181-8dca-51133bb3acd0",
+ "secretKey": "TEST-SECRET",
+ "secretPath": "/",
+ "environment": "dev",
+ "secretVersion": 1
+ },
+ "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+ "userAgentType": "web",
+ "expiresAt": "2025-01-18T01:11:25.552Z",
+ "createdAt": "2025-01-15T01:11:25.552Z",
+ "updatedAt": "2025-01-15T01:11:25.552Z",
+ "orgId": "785649f1-ff4b-4ef9-a40a-9b9878e46e57",
+ "projectId": "09bfcc01-0917-4bea-9c7a-2d320584d5b1",
+ "projectName": "example-project"
+}
+```
+
+### Audit Logs Structure
+
+ The unique identifier for the log entry.
+
+
+
+ The entity responsible for performing or causing the event; this can be a user or service.
+
+
+
+ The metadata associated with the actor. This varies based on the actor type.
+
+
+ This metadata is present when the `actor` field is set to `user`.
+
+
+ The unique identifier for the actor.
+
+
+ The email address of the actor.
+
+
+ The username of the actor.
+
+
+
+
+ This metadata is present when the `actor` field is set to `identity`.
+
+
+ The unique identifier for the identity.
+
+
+ The name of the identity.
+
+
+
+
+ This metadata is present when the `actor` field is set to `service`.
+
+
+ The unique identifier for the service.
+
+
+ The name of the service.
+
+
+
+
+
+ If the `actor` field is set to `platform`, `scimClient`, or `unknownUser`, the `actorMetadata` field will be an empty object.
+
+
+
+
+
+ The IP address of the actor.
+
+
+
+ The type of event that occurred. Below you can see a list of possible event types. More event types will be added in the future as we expand our audit logs further.
+
+ `get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`.
+
+
+
+ The metadata associated with the event. This varies based on the event type.
+
+
+
+ The user agent of the actor, if applicable.
+
+
+
+ The type of user agent.
+
+
+
+ The expiration date of the log entry. When this date is reached, the log entry will be deleted from Infisical.
+
+
+
+ The creation date of the log entry.
+
+
+
+ The last update date of the log entry. This is unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created.
+
+
+
+ The unique identifier for the organization where the event occurred.
+
+
+
+ The unique identifier for the project where the event occurred.
+
+ The `projectId` field will only be present if the event occurred at the project level, not the organization level.
+
+
+
+ The name of the project where the event occurred.
+
+ The `projectName` field will only be present if the event occurred at the project level, not the organization level.
+
\ No newline at end of file