Viewing Audit Logs
The audit log is a tamper-evident record of who changed what across your tenant — configuration edits, user and permission changes, security events, and commerce actions. It's the first place to look when you need to answer "who did this, and when?" for a security review, a support escalation, or a compliance request. Every entry is scoped to your tenant, so you only ever see your own organization's activity.
Open the log from the user menu (your name, bottom-left) → Settings → Audit Logs (under Observability).
What each entry records
Time
When the change was made
Actor
The user who made the change (system actions appear without a user)
IP Address
The IP address the change came from
Item
The record or field that changed (resource type and id)
Type
The kind of change (Created, Field Updated, Deleted, …)
Action
The before/after values (From → To) and any additional detail
Working with the log
Entries are listed newest-first. Open any entry to see its full detail, including related events — other actions taken by the same actor from the same IP address around the same time, which helps you reconstruct a sequence rather than a single change. You can export the log (CSV or JSONL) for offline review or to hand to an auditor.
Retention and categories
Entries are grouped into categories — authentication, security, admin, data access, data change, and system — and each category can keep records for a different length of time. A background sweeper purges entries once they pass their cutoff, so retention is enforced automatically rather than relying on manual cleanup. Control how long entries are kept under Settings → Audit Log Retention (default 90 days; configurable from 1 day up to 10 years per category). Security and admin events default to a longer 365-day window; short-lived access events default to 30 days.
Related
Last updated
Was this helpful?