Audit log

The audit log answers "what was done on this account, when, and from where". It is the record to consult after an unexpected change, and the one to show a reviewer who asks whether activity is tracked.

What it shows

A single table, newest event first, 50 rows per page:

Column	What it holds
When	The date and time the event was recorded.
Action	The operation performed, as the request method and the path it acted on.
Subject	The identifier of the record affected, where the request identified one.
IP	The client IP address the request came from.
Request	The request identifier, for correlating one event with a specific call.

What is recorded

Recorded	Not recorded
Every change-making request made while signed in — creations, updates and deletions	Ordinary reads: opening a screen, listing transactions, running a report
Data exports	Requests made before signing in, and anonymous or public traffic
File downloads	The content of a change — the log does not store before-and-after values
The outcome of each request, including failed attempts	Events belonging to other users

Two points are worth being explicit about:

• The log is per user. You see the events recorded for your own account only. It is not a whole-organisation activity feed, and it cannot be pointed at somebody else's activity.
• It is an activity record, not a change history. An entry tells you that a record was changed, when, from which IP, and whether the request succeeded — not what the previous value was.

Features

Feature	What it does
Chronological list	Shows events newest first.
Paging	Loads events in pages of 50 as you scroll or page through.
Record identifier	Links an event to the specific record it affected, where the request named one.
Origin details	Records the client IP address and a request identifier for each event.

How to use it

1. Open Audit.
2. Read down from the top — the most recent event is first.
3. Use the Action column to see what was done and to which part of the account.
4. Match the Subject value against the record you are investigating.
5. Page forward to go further back in time.

Notes and limits

• There is no search, filter or date range on this screen. Events are read in chronological order, page by page.
• There is no export from this screen. The data export in Settings covers your account data; it is a separate thing from this log.
• The IP address is the one the request arrived from. Where a proxy forwarded the request, the originating client address is recorded.
• Recording an event never blocks or fails the underlying request.