The audit log records sensitive actions in your organisation: sign-ins and failures, member and role changes, credential and key changes, high-impact commands, firmware actions, deletions, setting changes and more. Rows are never edited by the application. Use the log to answer “who changed this, and when?”, to support an investigation, and as evidence for an audit. The list of recorded actions is in What is audited.
Open the log
Open Audit Logs at the address /admin/audit-logs of your organisation. It says “Tamper-evident record of actions taken in this organization”. You need the Admin role or higher.
The newest events come first. Select a row to open Audit Log Detail.
What a row holds
| Column or field | Meaning |
|---|---|
| Time | When it happened. |
| Actor | Who did it: a member, the system, an API key or a service. The detail adds Actor type and Actor ID. |
| On behalf of | When someone acted for someone else, the person acted for. The actor stays the true actor. |
| Action | What was done, for example iot_device.credential.rotated or auth.login_failed. |
| Severity | Low, Medium, High or Critical. |
| Resource | Resource type and Resource ID of what was changed, for example iot_device and the device id. |
| Metadata | Extra facts, such as the changed field names. Secrets, passwords, tokens and keys are never written. |
| IP and User agent | Where the request came from. |
| Integrity (hash chain) | Prev hash and Row hash of the row (see below). |
High and critical events also fire the audit.high_risk webhook, so you can forward them to your own security tools. See Webhooks.
Find events
Use the filters above the table:
| Filter | Use |
|---|---|
| Actor | Search by email… |
| Action | Part of the action name, for example auth.login or iot_rpc |
| Severity | One severity |
| Date range | From and To |
Clear filters resets them. Over the API you can also filter by resource type and resource id:
GET /tenant/{tenantId}/api/audit-logs?resourceType=iot_device&resourceId=<deviceId>&fromDate=2026-11-01&toDate=2026-11-08&page=1&pageSize=100pageSize is at most 100 by default; Max Page Size in the audit log settings can raise it up to 500.
Export
Export CSV downloads the log for the date range of the filter. Over the API you can choose CSV or NDJSON and limit the export to one actor, for example to answer a person’s request to see their data:
GET /tenant/{tenantId}/api/audit-logs/export?format=ndjson&actorId=<userId>&fromDate=2026-01-01&toDate=2026-11-08Tamper evidence
Each row is linked to the previous row of your organisation by a hash chain: a row’s hash covers its content and the hash of the row before it. Any change or deletion of a kept row breaks the chain. To check the chain, call:
GET /tenant/{tenantId}/api/audit-logs/verifyThe answer is { "ok": true, "checked": <rows> } for an intact chain, or "ok": false with brokenAt naming the first row that does not fit. After old rows were removed by retention, the first kept row refers to a row that is gone; the check accepts that start point.
Retention
Open Audit Logs > settings (Audit Log Settings):
| Setting | Default | Meaning |
|---|---|---|
| Retention Period (days) | 0 | How long rows are kept before the nightly purge deletes them. 0 keeps them forever. Set it per your compliance needs, for example 2,555 days for a seven-year hold. |
| Max Page Size | 100 | The largest page an API caller may ask for, at most 500. |
The audit log is recorded on every plan. If a plan does not include reading the log, the list and the export are refused until the plan includes it again; nothing is lost in between.
Privacy
An owner can anonymise a person in the log: the link between the rows and the person is withdrawn, while the actions themselves stay and the chain still verifies. This is part of answering an erasure request; see Privacy and data erasure.
POST /tenant/{tenantId}/api/audit-logs/anonymize
Content-Type: application/json
{ "actorId": "<userId>" }Permissions
| Action | Default role |
|---|---|
| Read the log | Admin |
| Export | Admin |
| Verify the chain | Admin |
| Anonymise a person | Owner |
| Purge expired rows now | Owner |
A member’s own events also appear on their member page, on the Activity tab. See Users and roles.