Audit FAQ
Answers to common questions about the Platform Audit page, the activity data it surfaces, and how the filters and export behave.
Access
Who can access the Platform Audit page?
Only users with the Admin user role can access the Audit tab in Settings. The tab is hidden from Managers, Members, and any other role. The underlying /activity and /activity/insights API endpoints also require the Admin role. See the Permissions page for the full matrix.
Can a Manager see a subset of the audit data?
No. The Audit page is Admin-only in both the UI and the API. Managers who need to review activity should request the data from an Admin or, for per-entity history, use the History tab on the affected entity (datastore, check, anomaly, and others).
Data and retention
How far back does the audit log go?
The Audit page surfaces activity that the platform was already recording for every tracked entity. The same history is also available on the per-entity History tabs across datastores, checks, operations, and other entities. The Audit page adds a workspace-wide view on top of it. There is no separate, configurable retention period for audit records today.
Does the audit log show everything that happens on the platform?
It shows every state-changing action against the entities the platform tracks (datastores, containers, checks, anomalies, operations, schedules, users, teams, integrations, tokens, and others), plus data-masking audit entries. Pure read operations (viewing a page, listing checks) are not recorded.
What is the difference between an Audit row and an entity's History tab?
The Audit page is a workspace-wide log: it tells you who, when, and what kind of action. The History tab on a specific entity tells you exactly which fields changed for that entity. Use the Audit page to discover activity, and drill into the entity History tab to see the before/after detail.
Filters and timeframe
What does the Report Date represent?
The Report Date is the end of the timeframe window. For example, with a Week timeframe and a Report Date of 2026-06-10, the page shows activity from 2026-06-04 through 2026-06-10 inclusive. The Report Date cannot be set to a future date.
What timeframes are available?
Week (7 days), Month (the prior month), Quarter (the prior three months), and Year (the prior year). Each timeframe ends on the Report Date. Month/Quarter/Year are calendar-relative, so the exact day count varies. See How It Works for details.
Why does the chart switch from daily bars to weekly bars when I change the timeframe?
The bucket width adjusts so the chart stays readable. Week uses daily bars, Month uses weekly bars, Quarter uses monthly bars, and Year uses quarterly bars. The underlying data is always daily; the page aggregates it into the wider buckets above.
What does Hide Qualytics do?
When Hide Qualytics is on, the page excludes activity from internal users (scheduled operations and other automated platform actors) from the chart, the Total actions card, the Most active user card, the Top category card, and the activity log. The Active users card always excludes internal users, regardless of the toggle.
Why is Active users not affected by Hide Qualytics?
The Active users card is designed to answer "how many people are using the platform?". Automated accounts are never counted as people, so the card excludes them in both modes.
Activity log
Why does the same day appear on more than one page?
The activity log paginates by row, not by day. If a day has more rows than the current page size allows, the same day header repeats on each page that contains rows from that day, with a count of items on that page in the sub-label.
What happens when I click a row?
Clicking opens a side panel with the full audit-log detail for that action. For data-masking audit rows, clicking opens the dedicated masking-audit side panel instead.
Why is one row tinted?
Delete actions appear with a tinted icon background to make them easier to spot at a glance. The data shape is identical to any other action.
Why does a row say "automated action" instead of an email?
Actions issued by internal users (scheduled operations, platform automation) are labeled automated action in place of an email. The avatar also uses a dedicated styling. Use the Hide Qualytics filter to remove these rows entirely.
Export
What does the Export button download?
A CSV file containing only the rows currently visible on the page. To export a larger dataset, increase the page size, paginate through the log and export each page, or use the GET /api/activity endpoint directly.
What is the file naming convention?
audit-<report-date>.csv, where <report-date> is the value in the Date field of the filter bar at the moment of export.
Why is the Export button disabled?
The button is disabled whenever the activity log on the current page is empty: there are no rows to export. Adjust the filters or reset the page so the log shows rows, then click Export.
Timezone
Why is activity grouped under a different day than I expected?
Day grouping uses your local timezone, not raw UTC. Actions that happened close to midnight UTC may be grouped under the previous or next calendar day depending on your timezone offset. The same audit log opened from two different timezones can show different day boundaries, by design.
Does the chart also follow my timezone?
Yes. The daily counts that feed the chart are bucketed by your local calendar date, using the timezone offset sent with every request.
API and integrations
Can I script the audit data?
Yes. Use the GET /api/activity endpoint for the paginated log and GET /api/activity/insights for the aggregated statistics. Both endpoints accept the same filters as the UI and require the Admin role.
Did the schema fields change names?
Yes. The insights schema previously used total_activities and activities_per_day. The current field names are total_actions and actions_per_day. The top_actor object now includes an action_count sub-field for the actor's action count. The field name verb on individual activity items is unchanged.