Audit FAQ

Answers to common questions about the Platform Audit page, the activity data it surfaces, and how the filters and export behave.

Access

Who can access the Platform Audit page?

Only users with the Admin user role can access the Audit tab in Settings. The tab is hidden from Managers, Members, and any other role. The underlying /activity API endpoints also require the Admin role. See the Permissions page for the full matrix.

Can a Manager see a subset of the audit data?

No. The Audit page is Admin-only in both the UI and the API. Managers who need to review activity should request the data from an Admin or, for per-entity history, use the per-entity change record on the affected entity. Containers, quality checks, check templates, and anomalies carry it in their Timeline section.

Data and retention

How far back does the audit log go?

The Audit page surfaces activity that the platform was already recording for every tracked entity. The same history is also available per entity, and containers, quality checks, check templates, and anomalies expose it in their Timeline section. The Audit page adds a workspace-wide view on top of it. There is no separate, configurable retention period for audit records today.

Does the audit log show everything that happens on the platform?

It shows every state-changing action against the entities the platform tracks (datastores, containers, checks, anomalies, operations, schedules, users, teams, integrations, tokens, and others), plus data-masking audit entries. Pure read operations (viewing a page, listing checks) are not recorded.

What is the difference between an Audit row and an entity's change record?

The Audit page is a workspace-wide log: use it to discover activity across the platform. For update actions, its side panel also shows exactly which properties changed, with their original and updated values, even if the entity was later deleted. The change record on a specific entity covers that entity only, and containers, quality checks, check templates, and anomalies carry it in their Timeline section. Use it when you are already working on the entity and want its full history in context.

Filters and timeframe

What does the Report Date represent?

The Report Date is the end of the timeframe window. For example, with a Week timeframe and a Report Date of 2026-06-10, the page shows activity from 2026-06-04 through 2026-06-10 inclusive. The Report Date cannot be set to a future date.

What timeframes are available?

Week (7 days), Month (the prior month), Quarter (the prior three months), and Year (the prior year). Each timeframe ends on the Report Date. Month/Quarter/Year are calendar-relative, so the exact day count varies. See How It Works for details.

Why does the chart switch from daily bars to weekly bars when I change the timeframe?

The bucket width adjusts so the chart stays readable. Week uses daily bars, Month uses weekly bars, Quarter uses monthly bars, and Year uses quarterly bars. The underlying data is always daily; the page aggregates it into the wider buckets above.

What does Hide Qualytics do?

When Hide Qualytics is on, the page excludes activity from internal users (scheduled operations and other automated platform actors) from the chart, the Total actions card, the Most active user card, the Top category card, and the activity log. The Active users card always excludes internal users, regardless of the toggle.

Why is Active users not affected by Hide Qualytics?

The Active users card is designed to answer "how many people are using the platform?". Automated accounts are never counted as people, so the card excludes them in both modes.

Activity log

Why does the same day appear on more than one page?

The activity log paginates by row, not by day. If a day has more rows than the current page size allows, the same day header repeats on each page that contains rows from that day, with a count of items on that page in the sub-label.

What happens when I click a row?

Clicking opens a side panel with the full audit-log detail for that action. For update actions, the panel also includes a Changes section listing each property that changed, with its original and updated values. See How It Works for the details. For data-masking audit rows, clicking opens the dedicated masking-audit side panel instead.

Can I see what an update changed if the entity was deleted?

Yes. The original and updated values remain available after the entity is deleted.

Why is one row tinted?

Delete actions appear with a tinted icon background to make them easier to spot at a glance. The data shape is identical to any other action.

Why does a row say "automated action" instead of an email?

Actions issued by internal users (scheduled operations, platform automation) are labeled automated action in place of an email. The avatar also uses a dedicated styling. Use the Hide Qualytics filter to remove these rows entirely.

Export

What does the Export button download?

A CSV file containing only the rows currently visible on the page. To export a larger dataset, increase the page size, paginate through the log and export each page, or use the GET /api/activity endpoint directly.

What is the file naming convention?

audit-<report-date>.csv, where <report-date> is the value in the Date field of the filter bar at the moment of export.

Why is the Export button disabled?

The button is disabled whenever the activity log on the current page is empty: there are no rows to export. Adjust the filters or reset the page so the log shows rows, then click Export.

Timezone

Why is activity grouped under a different day than I expected?

Day grouping uses your local timezone, not raw UTC. Actions that happened close to midnight UTC may be grouped under the previous or next calendar day depending on your timezone offset. The same audit log opened from two different timezones can show different day boundaries, by design.

Does the chart also follow my timezone?

Yes. The daily counts that feed the chart are bucketed by your local calendar date, using the timezone offset sent with every request.

API and integrations

Can I script the audit data?

Yes. Use the GET /api/activity endpoint for the paginated log, GET /api/activity/insights for the aggregated statistics, and GET /api/activity/{transaction_id}/changeset for the property changes behind a specific update record. The first two accept the same filters as the UI, and GET /api/activity/verbs returns the action verbs you can filter on. All of these endpoints require the Admin role.

Did the schema fields change names?

Yes. The insights schema previously used total_activities and activities_per_day. The current field names are total_actions and actions_per_day. The top_actor object now includes an action_count sub-field for the actor's action count. The field name verb on individual activity items is unchanged.