Skip to main content

Audit Log

The Audit Log records all significant actions performed by team members and the system. Use it to monitor changes and investigate issues.

It lives inside the unified Logs & Monitoring hub - open Settings → Logs & Monitoring and pick Audit from the left rail (alongside Alerts, History, and Error logs - see Monitoring).

Tabs​

The audit log is split into two tabs:

Admin actions​

Shows all create, update, and delete operations performed by team members. Each entry includes:

  • Time - When the action was performed
  • User - Who performed the action
  • Action - a soft-colored pill: Created, Updated, or Deleted
  • Resource - The type of resource affected (e.g., campaigns, settings, users)
  • Resource ID - The identifier of the affected resource
  • IP Address - The IP address of the user
  • Details - Expandable JSON with the full change payload

Authentication​

Shows login attempts, MFA events, password changes, and SSO logins. Each entry includes the action type, user, IP address, and a Success / Failed status pill.

Filtering​

  • Admin actions tab: Filter by action type - Created (POST), Updated (Full) (PUT), Updated (Partial) (PATCH), Deleted (DELETE) - and by resource type.
  • Authentication tab: Filter by action type (Login Success, Login Failed, MFA Verified, etc.).

Retention​

Audit entries are retained for 180 days, then deleted automatically by a daily cleanup job. This window is the same across admin actions, authentication events, and entity version history, so an investigation can correlate all three over the same period. Export anything you need to keep longer before it ages out.

Tips​

  • Use the audit log to investigate unauthorized access or unexpected configuration changes.
  • Authentication failures may indicate brute-force attempts - check the IP addresses involved.
  • The log is paginated; use Previous/Next to browse older entries.