# Check your audit log

> Every sign-in and change made with your login, in the portal, over the API or by an AI assistant, and how to export it.

Source: https://veldhost.eu/docs/audit-log

Last verified: 2026-11-12

The audit log answers "who did what, when, and from where" for your login. It is the first place to look after something changed that you didn't expect, or when a security review asks for evidence.

## What is recorded

Every sign-in, security change and action taken with your login, newest first, however it reached us:

- in the portal, signed in as you;
- through the [API](https://veldhost.eu/docs/api-reference) with one of your personal tokens;
- by an AI assistant or other app you connected (MCP), and by the portal's built-in assistant.

The log shows your own login only. Each team member has their own log, on their own Settings page. To see what happened to your sites, whoever did it, open the [activity feed](https://manage.veldhost.eu/portal/activity).

## Read the log

Open [Settings → Audit log](https://manage.veldhost.eu/portal/activity/audit). Each row shows:

- **When** it happened.
- **Event**: a one-line description, such as the site, domain or record it touched. Hover it to see the event's exact name.
- **Category**, for example **Sign-in**, **Security** or **API**.
- **Via**: **Portal**, **API** or **Connected app**.
- **Credential**: which API token or connected app did it (the built-in assistant shows as *Manage assistant (for you)*). A dash means you did it yourself, signed in to the portal.
- **IP address** the request came from, with a copy button.

Choose **Load more** at the bottom for older entries.

## Narrow it down

- Pick a category from the **All events** list to see only that kind of event.
- Set **From** and **To** to limit the dates.
- **Clear filters** shows everything again.

Filters update the list straight away and stay in the page address, so you can bookmark a filtered view.

## Export it

1. Set the filters you want. The export uses the same category and dates.
2. Choose **Export**, then **CSV (spreadsheet)** or **JSON**.

Without dates, an export covers a recent window, not your whole history. Each file also has a maximum date range and row count. Hover **Export** to see the current limits. If either limit shortened your file, the file says so: as final rows in a CSV, and in `notes` (with `truncated` or `window_clamped` set) in JSON. To get the rest, export again with narrower dates or one category.

What each format holds:

- **CSV:** one row per event, with its time, event name, category, who acted (you, an API token or an app), IP address, the one-line summary, and the event's full details as JSON in the last column.
- **JSON:** the same events in a `data` list, plus the date range the file covers, the limits that applied and the number of rows.

## From the API or an AI assistant

The same log is available as `GET /api/v1/account/audit` with any token that has the **read** scope, and to a connected assistant as the `get_audit_log` tool. Ask your assistant *"What changed on my account yesterday?"* and it reads the log for you.

## Related

- [Sign out other devices and disconnect apps](https://veldhost.eu/docs/sessions-and-connected-apps)
- [Set up two-factor sign-in and passkeys](https://veldhost.eu/docs/two-factor-and-passkeys)
- [Connect your AI assistant](https://veldhost.eu/docs/connect-ai-assistant)
- [Scopes and permissions](https://veldhost.eu/docs/scopes-and-permissions)