Audit log
The audit log records who did what to the desk's settings and security: sign-ins, changes to people and units, configuration, tokens and agreements. Admins find it under Settings → Audit log, newest first.
Each entry shows:
| Column | What |
|---|---|
| Event | What happened. |
| Who | Who did it. |
| Target | The id of what was changed, or a case reference or email address. |
| Address | The address it came from, where known. |
| When | When it happened. Hover over the time for the exact date. |
What is recorded
| Area | Events |
|---|---|
| Sign-in | Signed in (with a passkey, its name), failed sign-ins (with the email address that was tried), invites accepted, passwords changed, reset, or asked to be reset, two-factor turned on, passkeys added and removed. |
| Team | People invited or sent a new invite link, changes to a person (including their country and email address, with old and new value), password reset links sent, two-factor reset, signed out everywhere. |
| Your organization | Units created, changed (including access rules), moved and deleted; brands created, changed, deleted, and logos uploaded or removed. |
| Channels | Forms created, changed, deleted, paused by the hourly cap or resumed; form secrets rotated or revoked; IP allowlists and portals created, changed and deleted. |
| Workflow | Automation rules, business hours and service-level policies created, changed and deleted; satisfaction surveys created, changed, archived and restored, and the survey a unit sends. |
| Integrations | Webhooks created, changed and deleted, and their secrets rotated; API tokens created and revoked; AI assistants approved, connected and disconnected. |
| Customers | Accounts created, changed and deleted; contacts added and changed, their data exported, and contacts deleted permanently (with what went, never the address); who may work on an account (before and after); agreements created, sent, signed, declined, recorded, withdrawn, downloaded and deleted, and their templates; held requests accepted or rejected. |
| Cases | Cases logged by hand with New case; legal holds set and lifted, with the reason. |
| System | Installation settings changed, the setup started and finished, housekeeping tasks changed and run. |
| Compliance and audit | Process controls created, changed, switched off and on; exceptions explained; approvals on cases asked and decided; every export (export.created), with its checksum; and every record or list an auditor with Reading is logged opens (Read case, Read the audit log…, audit.viewed, with the reference as the target). |
[!NOTE] Case content is never recorded: not subjects, messages, notes or attachments. Replies, status changes and other work on cases are on each case's timeline instead.
Finding entries
Type in the filter above the list (Filter by person, action, address or a deleted contact’s email). It matches:
- the event, by its name on screen ("Signed in") or its code (
login.failed), - the name of the person who did it,
- the target, whatever the case,
- the start of an address, for example
203.0.113..
The count next to the field shows how many entries match.
A whole email address also checks it against contacts deleted on request: if one matches, a note above the list says when they were deleted, from which organization, by whom and how much went.
Exporting the log
Export downloads the entries of a period (the last 90 days by default) that match the filter:
- as Excel, CSV or PDF,
- up to 100,000 entries.
The file carries who exported it, when, the filters and a checksum, and the export itself is logged (exports).
Changes made with a token
Changes made through the API or an AI assistant are recorded too:
- Every write with an API token adds an entry Changed something with an API token, with the method, route and parameters.
- Write actions by an AI assistant through the MCP server add Used a tool through an AI assistant, with the tool's name and the case.
- Any other entry made during such a request, for example a unit changed with a token, is recorded with the token's name and id (and the AI assistant, when there is one). Who is the token's owner.
The log shows these details in small type under the event:
- the method and route of an API write (for example
PATCH /api/v1/cases/:ref), - the tool an AI assistant used,
- "via token" with the token's name, or "via" with the AI assistant's name.
They're also returned by the API at GET /api/v1/audit (admin scope), with the parameters.
How long entries are kept
[!IMPORTANT] Entries are kept until you remove them. To remove old entries automatically, switch on the Audit log task under Housekeeping.