Read the organization audit log

The audit log records the changes made in your organization: who made each one, what they changed, when, and from which IP address. Members, API keys, customers, your staff console, Coritan staff and the platform itself all write to it, newest entry first.

You need the owner or admin role to read the whole log. The Audit log page is not in the menu for other roles. In the staff console, support and billing roles can read parts of it, as described in The staff console's activity view.

1. Go to Organizations, open your organization and choose Audit log under Team.
2. Read the table. Each row shows When the change happened, Who made it, the Action, its Target, the first few Details and the IP address.
3. To narrow the list, search the entries, choose who made the change (Anyone, a kind such as API keys, or one member by name), choose an area such as customers or services in place of Any area, or set the From and To dates. The filters and the page stay in the address, so a reload or a shared link shows the same entries.
4. Select a row to open the full entry: When, Who, Action, Target, IP address, Entry ID and every detail it recorded. Choose Copy details to copy the details as JSON.
5. Use the pages at the bottom to go back to older entries.

The search and the filters look through the whole log, not only the page on screen, and the count above the table is of every entry that matches. The search finds words in the action, the details, the target's kind and the IP address, a member by name or email, and a target by its number. Each area in the list shows how many entries it holds for the other filters, and only areas with entries are listed. The table shows 50 entries to a page. From and To count whole days in your browser's time zone, both included.

Who

Who made the change. A member shows by name, with In this console or In the staff console under it to say where they made it; your own changes show as You. Someone who has left shows by user number. API keys and customers show by their number, Coritan staff as Coritan staff, and the platform as System.

Action

What happened, in words such as Customer created, with its name in two parts under it: the area and the verb, such as customer.created or discord.config_updated. The colour shows whether it added, changed or removed something.

Target

The record the change applies to, such as a customer or a service, with its number.

Your staff console reads the same log through its Activity page, and each role sees a different part of it:

• Owners and admins read all of it, and can filter by customer, service, server, member, action, date and text. On the Activity page they narrow it by area, period, record, action and person, and download the filtered log as a CSV.
• Support tier 3 and billing members must name a customer, a service or a server, or ask for their own actions.
• Support tiers 1 and 2 can only read their own actions.
• Read-only members cannot open it.

The staff console describes the rest of the console.

You can see who made a change, when, from where, and exactly what they changed.

The Audit log is not in your menu

Only owners and admins can read the log, and its address takes anyone else to the overview. Ask one of them, or ask for your role to change.

A change you expected is missing

A filter may be leaving it out. Choose Reset filters, or clear the search, who and area, and widen the dates. A change made in the staff console shows under the member who made it, with In the staff console under their name.

• Roles and permissions
• Members and roles
• Receive organization webhooks

The route needs an owner's or admin's access token, sent as Authorization: Bearer $CORITAN_TOKEN.

curl "https://api.coritan.com/api/v1/orgs/acme/audit-log?action=member&since=2026-09-01T00:00:00Z&with_total=true" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Every filter is applied before the page is cut:

An action or an actor outside those words answers 422. Without with_total the answer is a list, newest first. With with_total=true it is {items, total, limit, offset, counts}: total is every matching entry, and counts holds how many entries each area has for the other filters, with all for every area, so the number beside an area is the total you get when you choose it. Each entry has:

To filter by a customer, a service or a server, use GET /api/v1/orgs/{org_slug}/staff/activity, which the staff console page covers.