# Audit Logs

Track every administrative action across your AVCodex organization with a complete, immutable trail. Useful for compliance reviews, security audits, internal change reviews, and the kind of "who pushed that?" question every AV ops manager has asked.

Audit Logs are a chronological record of who did what, when, and on which resource: agents created, members invited, integrations connected, monetization packages changed.

> **Warning:** Audit Logs require a Studio Pro plan or higher and are visible to organization owners and admins only.

## Accessing Audit Logs

Open **Settings** -> **Access Control** -> **Audit Log**.

You will see a chronological list of administrative events with:
- **Actor**: who performed the action (name and email).
- **Action**: what they did (color-coded by type).
- **Timestamp**: when it happened (with a relative time display).
- **Details**: click any row to see full context.

## What Gets Tracked

Audit Logs capture more than 100 event types across every administrative area:

### Member Management
- Member invited, invite accepted, invite revoked.
- Role changed, member offboarded, member reactivated.
- Workspace member added, removed, permissions updated.

### Agent Lifecycle
- Agent created, deleted, duplicated, moved.
- Agent published, rolled back, version restored.
- Agent settings updated.

### Billing and Subscriptions
- Subscription changed, cancelled.
- Top-up settings updated, notification settings updated.
- Stripe Connect initiated, disconnected.

### Integrations and Connections
- OAuth connected, disconnected.
- Channel configured (WhatsApp, Slack, Email, Discord, GitHub).
- MCP integration created, updated, deleted.
- Phone number purchased, released.
- Custom domain and sender domain events.

### Knowledge and AI
- Knowledge source created, deleted, linked, unlinked.
- Agent links created, deleted.
- Voice clones created, deleted.

### Organization Settings
- Workspace created, updated, deleted.
- Whitelabel configuration changes.
- Consumer monetization (packages created, updated, deleted).

## Filtering Events

Use the **action type dropdown** to filter by category. Events are grouped and color-coded:

| Color | Meaning | Examples |
|-------|---------|---------|
| **Green** | Creates, invites, connections | Member invited, agent created, integration connected |
| **Blue** | Updates, changes | Role changed, settings updated |
| **Red** | Deletions, removals | Member offboarded, agent deleted, integration disconnected |

## Event Details

Click any event row to expand:

| Field | What It Shows |
|-------|---------------|
| **Actor** | Email of the person who performed the action, or "System" for automated events |
| **Target user** | If applicable, the person affected (an invited member, an offboarded tech) |
| **Resource** | Type and ID of the affected resource (workspace, agent, domain) |
| **Timestamp** | Exact date and time (ISO 8601) |
| **IP address** | Client IP of the actor |
| **User agent** | Browser and device |
| **Context (JSON)** | Action-specific details (previous values, new values, reasons) |

### Example: Role Changed

```
Actor: admin@yourintegrator.com
Action: member.role_changed
Target: jordan@yourintegrator.com
Details:
  Previous role: member
  New role: admin
```

A typical audit moment for an AV firm: a senior programmer is promoted to admin so they can publish updates to the field-tech assistant.

## API Access

Query audit logs programmatically:

```
GET /api/organization/rbac/members/audit-log
```

**Query parameters:**

| Parameter | Description | Example |
|-----------|-------------|---------|
| `action` | Filter by event type | `member.invited` |
| `targetUserId` | Filter by affected user | UUID |
| `since` | Filter by date | `2026-03-15` |
| `limit` | Results per page (max 200) | `50` |
| `offset` | Pagination offset | `0` |

## Use Cases

| Scenario | What to Look For |
|----------|-----------------|
| **Security audit** | Filter for `member.offboarded`, `member.role_changed`, `integration.connected`. |
| **Billing investigation** | Filter for `subscription.changed`, `billing.top_up`. |
| **Compliance review** | Export the full trail for a date range. |
| **Incident response** | Search around a specific timestamp ("the agent went down at 3:14 PM, who changed what at 3:13?"). |
| **Onboarding verification** | Track invite acceptance and permission grants for a new programmer or PM. |

*AVCodex · Your AV expertise. Amplified by AI.*