System audit log

The system audit log (/system/audit) records every modifying action of system administration: creating, changing and deleting tenants, API key management, system settings, PII word lists, proxy changes, password resets and impersonation sessions.

Filtering

Above the table there is a quick period selection (Today · Last 24h · Last 7 days · Last 30 days · This month · Last month · This quarter · Last quarter · All) plus the fields From/To (date and time), Action (multiple selection with a search field), Entity (Tenant, for example) and Admin (prefix search). “Apply filter” runs the query, “Reset” clears every filter. Clicking an admin name in the table sets the admin filter directly.

How the entries are structured

The columns are: time, admin, action, type, entity ID, details, IP. The actions follow the {object}.{verb} taxonomy, for example:

Action	Meaning
tenant.create / tenant.update / tenant.delete	Tenant created / changed / deleted
tenant.license.update / tenant.license.clear	Licence applied / removed
user.password_reset	The password of a tenant user was reset
apikey.create / apikey.update / apikey.delete	API key managed
setting.update / setting.delete	System setting changed / reset
wordlist.replace / wordlist.delete	PII word list replaced / reset to the default
proxy.update / proxy.test	Proxy configuration saved / tested
impersonation.start / impersonation.stop	Impersonation started / ended
demo.inspect.enter / demo.inspect.download	Demo session inspected / bundle downloaded

The list is paged at 100 entries per page (“Showing x–y of z”, “Previous”/“Next”).

Example — “who deactivated tenant X yesterday?”: the “Last 24h” quick selection, select the action tenant.update, then “Apply filter” — the details column shows IsActive=False together with the admin and the IP.