Audit log

Audit log records who did what, and when: sign-ins and failed attempts, users and roles, access tokens, workspaces, scopes, every step of a submission, releases, versions and tags, and the instance's settings. Only roots can read it, nothing can change it, and it keeps every event for now.

Each event is one line: the time in your time zone (UTC on hover), who did it, the action, and a sentence saying what happened, such as “Changed [email protected] from user to moderator”. system and cli mean no one was signed in, such as the setup.

Open a line for every detail: both times, the actor and target with their ids, the IP address, everything the event recorded, and the raw JSON to copy. Each event's details have their own link, so you can share one.

• Filter by action (one, or a whole group such as user.*), by actor (part of an email, or system), and by dates, which are UTC days. Filters apply as you change them, show as chips you can remove one at a time, and Clear removes them all.
• Sort by time (newest first, the default) or by action, from the column headers. Click the same header again to reverse it.
• Pages hold 25, 50 or 100 events, with First, Previous and Next. The count stops at 10,000 (“10,000+ events”). New events don't shift the pages you're reading.

The whole view (filters, sort, page and an open event) is in the address, so a link shows someone else exactly what you see.

The server's incident commands are recorded too, under instance.*:

• instance.access_revoked when revoke-access ended sessions or revoked tokens, with how many.
• instance.secret_rotated when rotate-secret replaced the secret.

An identity provider's SCIM changes are recorded with no one as the actor, marked as through SCIM: accounts it creates, updates and disables, and memberships its groups change, each naming the provider. A request Ronne refused is scim.request_refused, with why.

user.two_factor_reset is a root's reset of someone's two-factor, or reset-two-factor's. For what to do in an incident, see Incidents.