---
id: audit-log
title: Audit log
sidebar_label: Audit log
---

Anything that changes something is recorded, whether it was done in the UI or by
a script. The log is at **Audit Log**.

## What an event carries

| Field  | Meaning                                                  |
| ------ | -------------------------------------------------------- |
| Action | A dotted name, e.g. `server.created`, `settings.updated` |
| Actor  | Who did it                                               |
| Target | The object acted on                                      |
| Detail | A short human-readable note                              |
| Time   | When                                                     |

## What is recorded

Creation, modification and deletion across the product: servers and enrolments,
keys and assignments, workflow and step changes, runs triggered, monitors and
channels, secret groups and reveals, console sessions opened, settings and
member changes, licence installs.

Simply looking at something is not recorded, with one exception: **revealing a
secret** is.

## What is not recorded

- Sign-ins and sign-outs.
- Anything inside a console session.
- Step output. That lives in the run log, kept under the workflow retention
  setting rather than with the audit log.

## Retention

How long audit events are kept comes from your licence: 30 days on Free, a year
on Professional, and unlimited on Enterprise. See
[Licensing and entitlements](../hq/licensing-and-entitlements.md).

This is separate from the workflow log retention setting, which covers run logs
only.

:::warning It is a log, not a control
The audit log tells you what happened. It does not restrict what can happen, and
an admin can do anything an admin can do. Use roles for restriction and the log
for accountability.
:::

## Searching and exporting

The page searches by actor, detail and event type, and filters by category, such
as `workflow`, `key` or `server`. The count shown is the number of matching
events, not the number on screen.

The same events are available from the API if you want them in a log system of
your own. See [Automating Vantage](../reference/rest-api.md).