> For the complete documentation index, see [llms.txt](https://docs.usepylon.com/pylon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usepylon.com/pylon-docs/platform/audit-logs.md).
# Audit Logs
View granular logging of key actions taken in Pylon to maintain an audit trail for your workspace.
Audit logs record who did what in your workspace, and when. Use them for security reviews, compliance, and troubleshooting unexpected changes.
Open them from **Settings > Admin console > Audit logs**. Only Admins can view audit logs.
## What's captured
Each event records the time, who performed it, the event, and the object it affected. Events performed by a trigger, macro, AI, or Pylon itself show that as the actor. Where available, the event details also include the IP address the request came from.
Pylon logs several hundred kinds of events. The table shows the main categories with a few examples of each.
| Category | Example events |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Sign-ins | Login Succeeded, Login Failed, Portal Login Succeeded, Portal Login Denied |
| Users and teams | User Invited, User Updated (including role changes, email changes, and deactivation), Team Created, Team Member Added, Team Member Removed |
| API tokens | API Token Created, API Token Rotated, API Token Revoked, API Token Deleted, API Token Role Updated, API Token IP Allowlist Updated |
| Issues | Issue Assigned, Issue Closed, Issue Tags Changed, Issue Merged, Issue Deleted, Issue Restored, Issue Message Deleted, Issue Message Redacted, SLA breaches |
| Accounts and contacts | Account Created, Account Owner Changed, Accounts Merged, Account Deleted, Contact Created, Contact Updated, Contact Merged, Contact Deleted |
| Exports | Issues Exported, Accounts Exported, Contacts Exported, Users Exported, Custom Objects Exported, Audit Logs Exported |
| Triggers and macros | Trigger Created, Trigger Updated, Trigger Enabled, Trigger Disabled, Trigger Deleted, Trigger Restored, Macro Created, Macro Updated, Macro Deleted |
| Knowledge base | Knowledge Base Article Created, Knowledge Base Article Updated, Knowledge Base Article Deleted, Knowledge Base Article Restored, Knowledge Base Collection Created, Knowledge Base Settings Updated, Knowledge Base Custom Theme Published |
| Fields, objects, and tags | Custom Field Created, Custom Field Updated, Custom Field Deleted, Custom Object Definition Created, Tag Created, Tag Deleted |
| Workspace settings | Organization Access Settings Updated, Organization Email Settings Updated, Organization Ticket Settings Updated, Organization Customer Portal Settings Updated, Support Hours Schedule Updated, Chat Widget Identity Verification Secret Changed |
| Integrations | Organization App Installed, Organization App Uninstalled, Slack App Revoked, Slack Bot Joined Channel |
| Phone and SMS | Phone Number Purchase Requested, Phone Number Port Requested, Phone Number Deleted, Inbound Call Answered, Outbound Call Placed, SMS Numbers Blocked |
| Views, reports, and surveys | View Created, View Updated, View Deleted, Report Created, Report Deleted, Survey Schedule Created, CSAT Survey Sent |
| Projects, tasks, and feature requests | Project Created, Task Assigned, Feature Request Created, Feature Requests Merged |
To see every event type, open the **Event** filter on the Audit logs page. It lists all of them. Through the API, each entry's `action` field holds the event name.
## History and plans
Full audit log history is available on the Enterprise plan. The list shows the last 30 days by default, and you can use the **Happened At** filter to look further back.
Without it, audit logs cover the last 30 days. The **Happened At** filter isn't available, and CSV exports and the API return only events from the last 30 days.
## Find an event
* **Filters:** narrow the list by **Actor User** (a teammate), **Actor Contact** (a customer), **Event**, and, on the Enterprise plan, **Happened At**.
* **Search:** type in the search box to match actor names, the names of affected accounts, contacts, teams, triggers, users, views, projects, and tasks, and attribute values.
* **Event details:** click a row to open **Event details**, which shows the time, user, IP address (when recorded), event, the affected object, and the event's attributes. Switch the attributes between **Columns** and **Code** views.
Your filters and the open event are saved in the page URL, so you can share a link to a specific event or search.
## Restore deleted items
Some deletion events have a **Restore** button. Only Admins can restore.
| Deleted item | Event | What to know |
| ---------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Issue | Issue Deleted | **Restore** is turned off if the issue was already restored or has no messages left to restore. Hover over the button to see why. Some data, such as SLAs and surveys, may not come back. |
| Trigger | Trigger Deleted | The trigger is restored to the **Archived** group and stays disabled until you turn it on. |
| Knowledge base article | Knowledge Base Article Deleted | You can restore an article within 30 days of deletion. After that, it's permanently deleted. Restoring is best-effort: feedback, issue links, and URL path mappings may not come back. |
Each restore adds its own event, such as Issue Restored or Trigger Restored.
## Export audit logs
### CSV
1. Set the filters and search you want.
2. Click **Export as CSV**, then **Export to CSV**.
The export includes every event that matches your current filters and search. Large exports run in the background, and you'll get a notification when the file is ready. Download it from **Recent exports** in the same menu. Files are available for 7 days. Starting an export adds an Audit Logs Exported event.
The CSV includes the event ID, time, actor, actor type, actor user and contact IDs, IP address, event, object type, object ID, and attributes.
### API
Use the API to pull audit logs into a SIEM or other tool. You need an API token with the Admin role.
* `GET /audit-logs` lists audit log entries, newest first, with pagination.
* `POST /audit-logs/search` filters by `action`, `action_happened_at`, or `object_id`.
Without full audit log history, a search that starts more than 30 days ago returns an error. See the [Audit Logs API reference](/pylon-docs/developer/api/api-reference/audit-logs.md) for parameters and response fields.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.usepylon.com/pylon-docs/platform/audit-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
