The audit log answers "who did what, when, and from where" for your login. It is the first place to look after something changed that you didn't expect, or when a security review asks for evidence.
What is recorded
Every sign-in, security change and action taken with your login, newest first, however it reached us:
- in the portal, signed in as you;
- through the API with one of your personal tokens;
- by an AI assistant or other app you connected (MCP), and by the portal's built-in assistant.
The log shows your own login only. Each team member has their own log, on their own Settings page. To see what happened to your sites, whoever did it, open the activity feed.
Read the log
Open Settings → Audit log. Each row shows:
- When it happened.
- Event: a one-line description, such as the site, domain or record it touched. Hover it to see the event's exact name.
- Category, for example Sign-in, Security or API.
- Via: Portal, API or Connected app.
- Credential: which API token or connected app did it (the built-in assistant shows as Manage assistant (for you)). A dash means you did it yourself, signed in to the portal.
- IP address the request came from, with a copy button.
Choose Load more at the bottom for older entries.
Narrow it down
- Pick a category from the All events list to see only that kind of event.
- Set From and To to limit the dates.
- Clear filters shows everything again.
Filters update the list straight away and stay in the page address, so you can bookmark a filtered view.
Export it
- Set the filters you want. The export uses the same category and dates.
- Choose Export, then CSV (spreadsheet) or JSON.
Without dates, an export covers a recent window, not your whole history. Each file also has a maximum date range and row count. Hover Export to see the current limits. If either limit shortened your file, the file says so: as final rows in a CSV, and in notes (with truncated or window_clamped set) in JSON. To get the rest, export again with narrower dates or one category.
What each format holds:
- CSV: one row per event, with its time, event name, category, who acted (you, an API token or an app), IP address, the one-line summary, and the event's full details as JSON in the last column.
- JSON: the same events in a
datalist, plus the date range the file covers, the limits that applied and the number of rows.
From the API or an AI assistant
The same log is available as GET /api/v1/account/audit with any token that has the read scope, and to a connected assistant as the get_audit_log tool. Ask your assistant "What changed on my account yesterday?" and it reads the log for you.