## Overview

**Audit logs** record the relevant actions taken in the account: configuration changes, agent and
team management, permission changes and other administrative actions. They answer the question
**“who did what and when”**, which is essential for security, compliance and incident investigation.

The list offers **search by person, filters by event type and date range, and sorting**. That is how
you narrow thousands of events down to the handful that matter before investigating.

## Prerequisites

- The **Administrator** role to access the logs.
- **Audit logs** is a **premium/optional** feature and may not be enabled on your account. If the
  area doesn't appear, talk to the account owner or support.

## Step by step

1. In Settings, open **Audit Logs** in the sidebar.
2. View the chronological list of events: actor (who), action (what), target and date/time.
3. Use the available **filters** to narrow the scope (by period, by action type, etc.).
4. Use the **search** box in the header to find a person's actions by **name or email**. It kicks in
   from **3 characters** onwards.
5. Pick an **event type** from the grouped list (Access, Agents & teams, Configuration, Conversations)
   or keep **All events**.
6. Set the **date range** in the date selector and the **sort order** (newest or oldest first).
7. Use **Clear filters** to go back to the full list.
8. Read the event row: it already carries the full description of the action, the time and the
   source IP address. The row **is** the whole record — there is no detail screen behind it.
9. For external analysis, read the same history through the API at
   `GET /api/v1/accounts/{account_id}/audit_logs`, which accepts exactly the filters of the screen
   (`q`, `types`, `since`, `until`, `sort` and `page`).

## Settings & options

- **Chronological view**: events from newest to oldest.
- **Filters**: help locate a specific action among many records.
- **Search by person**: the search box looks for an **agent name or email**. It starts from
  **3 characters** and waits for a short typing pause before querying, so it doesn't fire on every
  keystroke.
- **Event type filter**, organized into four groups:

  | Group | Available types |
  |---|---|
  | Access | Sign in / sign out |
  | Agents & teams | Agents · Teams · Team members · Inbox collaborators |
  | Configuration | Account settings · Inboxes · Webhooks · Automation rules · Macros |
  | Conversations | Conversation deletions |

- **Date range filter**: the platform's standard date selector. The chosen range is applied from the
  **start of the first day to the end of the last one**.
- **Sorting**: **Newest first** (default) or **Oldest first**.
- **Counter**: the header shows the total number of events matching the current filters.
- **Clear filters**: the button appears as soon as a search term, event type, date range or sort order
  is active.
- **State in the URL**: search, type, period, sort order and page live in the page address. You can
  reload, use the browser's back/forward buttons and **share the already-filtered link** with another
  administrator.
- **Pagination**: **25 events per page**.
- **Columns**: the activity described in plain text (who did what), the time and the source
  **IP address**.
- **Export**: the screen does **not** export CSV. To take the events elsewhere, use the API named in
  step 9.
- **Retention**: history is available according to your plan's policy. The platform does not prune
  these entries on its own and the screen has no retention field — the trail with a configurable
  window is the native one described below.
- **Native trail (Governance & LGPD)**: besides the premium logs, the account can enable the
  **native audit trail**, read from the **Audit trail** tab of **Settings → Governance & LGPD** —
  sign-ins, settings changes, role/routing template applies, agent and inbox changes, contact
  deletions and data subject requests, with **admin-configurable retention**. That trail has its own
  filters (**Action**, **From** and **Until**) and does **not** offer free-text search.

## Use cases

- Investigate when and by whom a setting was changed.
- Confirm an agent's permission changes after a complaint.
- Meet your company's compliance and security requirements.
- Reconstruct an agent's day: search by their email and sort from oldest to newest.
- Isolate configuration changes in a suspicious window: filter by **Configuration** and by the
  incident's period.
- Check deletions: filter by **Conversations → Conversation deletions**.

## Tips, limits & best practices

- Combine audit with **well-defined roles**: less broad access means fewer surprises in the log.
- Review logs periodically, not only after incidents.
- Logs are **read-only** — they record history and should not be edited.
- Search covers **who** performed the action (name or email), not the text of the event description.
  To answer “what changed”, combine **event type + date range**.
- Filter before sharing: an already-filtered link saves the other person from repeating the whole
  investigation.
- An unknown event type or sort order in the address is simply ignored, and the date range is only
  applied when **both start and end** are present.

## Troubleshooting

- **I can't see the audit area**: the premium feature is not enabled for the account.
- **I can't find a specific action**: adjust the filters (period/type) and confirm the action is one
  that's recorded in audit.
- **Search returns nothing**: it needs at least **3 characters** and looks for a user's name or
  email — a fragment of the action description will not find the record.
- **The list says “There are no items matching this query”**: active filters matched no event. Use
  **Clear filters** to start over.
- **I pasted a link and got fewer filters than expected**: unsupported values are discarded when the
  address is read.
- **I want to export to a spreadsheet**: the screen has no export button. Use the API from step 9
  and convert the result.
- **I need more history**: retention depends on the plan — talk to the account owner.

## See also

- [Governance & LGPD](/hc/ajuda/articles/administration-governanca-lgpd-en)
- [Custom roles and governance (RBAC)](/hc/ajuda/articles/administration-custom-roles-governanca-rbac-en)
- [Account, agents and teams](/hc/ajuda/articles/administration-conta-agentes-equipes-en)
- [Integrations](/hc/ajuda/articles/administration-integracoes-en)
- [Administration overview](/hc/ajuda/articles/administration-overview-en)