Admin audit log

The admin audit log is your day-to-day window into everything happening in the tenant. See the security-level audit log for the deeper story; this page covers admin workflows.

Where

/app/admin/audit-log. Access: TENANT_ADMIN, ADMIN, COMPLIANCE.

Common filters

• Actor — a specific user, system integration, or API key.
• Action — e.g. invoice.issue, user.invite, ratecard.publish.
• Target — a specific record id (e.g. invoice INV-2026-00042).
• Time — absolute or relative.
• Source IP / country — flag suspicious access.

Saved searches

Admins often rerun the same queries:

• All role changes in the last 90 days.
• All invoice voids in the last month.
• All rate-card publications by Commercial.
• All failed logins past 24h.

Save these for one-click refresh.

Alerts

Admins can set alerts that fire on audit patterns:

• Any login from outside the tenant's allowed country.
• Any invoice void > $X.
• Any role grant to TENANT_ADMIN.
• Any off-hours data export.

Alerts go to email / Slack / webhook.

Exports

CSV export of any filter result. Exports themselves are audited — you'll see your own export appear when you reload.

Before / after diffs

Edit events include a diff of changed fields. Useful for reconciliations:

• "Customer's credit limit changed from $50k to $200k on 10 April by Mary."
• "Invoice amount changed from $2,340 to $2,034 on 12 April — typo fix, voided + reissued."

Retention

Default 7 years. Stricter jurisdictions (banking / insurance) may extend. Configurable per tenant.

Integrations

Stream the audit log to SIEM or data warehouse. The format is one JSON object per event.

Practical tip

Schedule a monthly "access review" task: pull role grants + changes for the last 30 days, confirm each one was expected. Five minutes that prevents privilege creep.