The activity log is the platform-wide audit trail of every meaningful action taken by a user or by the system. It's the answer to “who did what, when?” and is the first place to look during incident investigation or compliance review.
What's Logged
- Sign-in, sign-out, failed sign-in attempts.
- Record creation, update, deletion (with before/after for updates).
- Permission changes — role assignments, group memberships.
- Configuration changes — settings tweaked.
- File uploads / downloads / views.
- API key creation / revocation.
- Workflow actions — approve, archive, transfer.
- Bulk operations (with counts).
Row Structure
- Timestamp — ISO-8601 UTC.
- Actor — user, API client or system (cron task).
- Action verb — created, updated, deleted, viewed, signed_in.
- Object — what was acted on (record, file, setting).
- Context — IP, user agent, session ID.
- Diff — for updates, the before/after of changed fields.
Worked Examples
- Compliance audit: “Who accessed patient X's records in the last 30 days?” Filter by object = patient_X, action = viewed.
- Incident response: “How did the bad data get in there?” Filter by record, sort by timestamp, see the user, IP and field-level changes.
- Suspicious access: “Were there sign-ins from unusual locations?” Filter by action = signed_in, look for non-corporate IPs.
- Permission change audit: “Why does so-and-so have admin? Who promoted them?” Filter by action = updated, object type = user, field = security_group.