How It Works
This page explains the mechanics behind the Platform Audit page: how the timeframe drives what activity the page shows, how rows are grouped, how the chart adjusts its bucketing, and how internal (automated) activity is separated from user activity.
How the page is populated
The Audit page combines two complementary data sources into a single screen:
| Source | Drives |
|---|---|
| Activity records | The paginated activity log: one row per recorded action, sorted by issue time. |
| Activity insights | The four summary cards and the stacked activity chart. |
Both sources share the same set of filters (date, timeframe, users, actions, and the Hide Qualytics toggle), so the cards, chart, and log always agree on the population they represent.
Report Date and Timeframe
The page is anchored to a Report Date and a Timeframe. Together, these define the window of activity that the cards, chart, and log all show.
| Timeframe | Window |
|---|---|
| Week | The seven days ending on the Report Date. |
| Month | The prior month ending on the Report Date (roughly 30 days, varying by calendar month). |
| Quarter | The prior three months ending on the Report Date (roughly 90 days). |
| Year | The prior year ending on the Report Date (365 or 366 days on leap years). |
The Report Date defaults to today and cannot be set to a future date. Changing either control refetches the summary cards, chart, and activity log, and resets pagination to page 1.
Day grouping in the activity log
Rows in the activity log are grouped by the local calendar day on which each action was issued. Each group has a header showing the day label and the count of items in that group on the current page.
This means:
- A single day can span multiple pages if it has more activity than the current page size allows. In that case, the same day header appears on each page, with a count of items shown on that page only.
- A page can contain multiple day groups when activity is light, in which case each group header marks the boundary.
The day used for grouping comes from your local timezone, not raw UTC, so each row is grouped under the day it appeared to happen for you.
Timezone handling
The page uses your browser's local timezone in two places:
- Day grouping in the activity log.
- Bucket grouping in the activity chart.
This means the same audit log opened from two different timezones can show different day groupings for actions that occurred close to midnight UTC. That is intentional: each viewer sees activity grouped by their own local day.
Activity chart bucketing
The chart is a stacked bar showing User vs Automated activity. The bucket width adjusts to keep the chart readable for the selected timeframe:
| Timeframe | Bucket |
|---|---|
| Week | One bar per day |
| Month | One bar per week |
| Quarter | One bar per month |
| Year | One bar per quarter |
Activity is recorded as daily counts and aggregated into wider buckets based on the selected timeframe. Buckets with zero activity display as low, muted bars so the time axis stays continuous.
User vs Automated split
Each action is attributed to a user. The platform tags certain accounts as internal, for example the Qualytics system account that runs scheduled operations and other platform-driven automation. The chart and summary cards treat internal users as Automated activity (the secondary bar segment) and external human users as User activity (the primary bar segment).
The Hide Qualytics toggle in the filter menu removes internal activity from both the chart and the log. When the toggle is off (the default), internal activity is shown alongside user activity. The Active users card always reports the count of unique human actors, regardless of the toggle; the toggle only affects the rest of the page.
The masking audit overlay
The activity log can also include data-masking audit rows. These appear when a user toggles "Show masked values" in surfaces such as Dry Run results or source-records views. They use the same row layout as standard activity items, but clicking them opens a dedicated masking-audit side panel rather than the generic activity side panel.
Empty and loading states
- First load: the log shows a stack of skeleton rows while the first page is fetched.
- Subsequent loads: the previously visible page stays in place while the new page is fetched and shown. The chart keeps the previously loaded data to avoid intermediate flicker.
- No results: when no activity matches the filters, the log shows a "No activity found" empty state with a history icon. The Active users and Total actions cards display
0, the Most active user and Top category cards fall back to dash placeholders, and the chart shows a zero-only bar series.