# Review your account's activity

> See what you and your team members changed in your Coritan account, with the time and the IP address of each change.

Source: https://www.coritan.com/docs/account/activity-log/

In the dashboard:

- /dashboard/settings/activity: https://www.coritan.com/dashboard/settings/activity

The *activity log* lists the changes made in your account, newest first: the ones you make, and every change a [team member](/docs/account/team-members/) asks for in your account. You find it on the **Activity** tab of **Settings**.

## Before you begin

- Sign in to the [dashboard](https://www.coritan.com/dashboard) with your own account. An **Admin** member of your team reads the log [with the API](#with-the-api).
- While [account plans](/docs/billing/account-plans/) apply to your account, the log comes with the Business and Enterprise plans ([What each plan includes](/docs/billing/account-plans/#what-each-plan-includes)). Until they apply, every account has it.

## Open the activity log

1. In the sidebar, select **Settings**, then the **Activity** tab.
2. To see only what one member did, choose them in the list above the table. It shows **Everyone** until you choose someone, and it also names members who have since left your team.
3. The log shows 50 changes a page. Select **Older** for earlier changes, and **Newer** to come back.

Each row of the **Activity log** card is one change:

**When**
: How long ago it happened, with the date and time under it.

**Who**
: You, or the team member who asked for it, with the role they had at the time, such as `Technical member`.

**What**
: What changed, such as `Changed a DNS record`. A member's change also shows the request they sent, such as `PUT /api/v1/dns/zones/318/records/7741`.

**IP address**
: The address the change came from, or `—` when Coritan recorded none.

On a phone, each change is a card with the same details.

## What the log lists

Your own changes
: The changes you make to your account and its services, such as adding a DNS zone or turning on DNSSEC. Your orders, renewals, plan changes and cancellations are in each service's history instead: the **Activity** table on the service's **Billing** tab, or on its page under **Subscriptions** ([Manage your subscriptions](/docs/get-started/services/#the-billing-tab)).

Your team members' requests
: Every request a member sends for your account, except the ones that only read, such as listing your servers. Coritan records each request as it arrives, before it runs, so a request that then failed is listed too. A member's order or cancellation is here as well.

What it leaves out
: What our staff and the platform did, and what a member did in their own account or in another team's account.

## Who can see it

You and every member with the **Admin** role. The other roles cannot read the log, even though they can read the rest of your account ([Roles](/docs/account/team-members/#roles)).

## Result

You can see who changed what in your account, and when.

## Troubleshooting

`The activity log comes with the Business plan`
: Account plans apply to your account, and your plan does not include the log. The card's `Upgrade to Business` button opens the **Plan** tab of **Plan and billing** with Business chosen, where you see the price before you confirm ([Change your account plan](/docs/billing/change-account-plan/)).

**No matches**
: The member you chose has made no changes in your account. Select **Reset filters** to see everyone again.

**No older entries**
: The page you opened is past the end of the log. Select **Show newest entries** to go back to the first page.

## Related

- [Share your account with a team](/docs/account/team-members/)
- [How account plans work](/docs/billing/account-plans/)
- [Sign out and end sessions](/docs/account/sessions/)

## With the API

[`GET /account/audit-log`](/docs/api/reference/client/account-activity/#op-get-api-v1-account-audit-log) returns the log, newest first:

```bash
curl "https://api.coritan.com/api/v1/account/audit-log?page=1&per_page=50" \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "items": [
    {
      "id": 90412,
      "action": "account.act_for",
      "label": "Changed a DNS record",
      "description": "PUT /api/v1/dns/zones/318/records/7741",
      "actor": {"kind": "member", "user_id": 5310, "name": "Sam Taylor", "email": "sam@example.com", "role": "technical"},
      "resource": {"type": "user", "id": 4821},
      "ip_address": "203.0.113.24",
      "created_at": "2026-09-27T09:14:02+00:00"
    }
  ],
  "total": 63,
  "page": 1,
  "per_page": 50,
  "members": [
    {"user_id": 5310, "name": "Sam Taylor", "email": "sam@example.com"}
  ]
}
```

`page` and `per_page`
: The page to read, from 1, and the entries on each page, from 1 to 100. They default to 1 and 50. Any other value answers `422`.

`member_user_id`
: Keeps only the requests one member sent for your account. It takes the member's `user_id` from `members` in the answer, or from [`GET /account/members`](/docs/api/reference/client/account-team/#op-get-api-v1-account-members).

`total`
: Every entry the filter matches, over all pages.

`label`
: What happened, in a short sentence, or `null` when Coritan has none for that kind of change. The dashboard then shows `description`.

`description`
: What the entry recorded. For a member's request, it is the method and the path.

`actor`
: Who made the change: `kind` is `owner` for you and `member` for a team member. `role` is the member's role when they sent the request, and `null` for you.

`members`
: Every member with an entry in the log, by name, whatever the filter and the page. It includes members who have since left your team.

An **Admin** member reads your log by sending your account's ID in the `X-Coritan-Account` header, as [Act for an account](/docs/account/team-members/#act-for-an-account) shows.

| Status | Answer | Why |
| --- | --- | --- |
| `402` | `"code": "entitlement_exceeded"` and `"entitlement": "audit_log"` | Account plans apply to your account, and your plan does not include the log. `upgrade.plan` names the plan that does, and `message` reads `The activity log comes with the Business plan. To see it, upgrade to Business.` ([When you reach a limit](/docs/billing/account-plans/#when-you-reach-a-limit)) |
| `403` | `"code": "role_refused"` | A member whose role is not **Admin** asked for the log. |

## API

- `GET /api/v1/account/audit-log`: The account's activity log: what its owner and its team members changed, newest first (https://www.coritan.com/docs/api/reference/client/account-activity/#op-get-api-v1-account-audit-log)