Read the organization audit log

The audit log records the changes made in your organization: who made each one, what they changed, when, and from which IP address. Members, API keys, customers, your staff console, Coritan staff and the platform itself all write to it, newest entry first.

You need the owner or admin role to read the whole log. In the staff console, support and billing roles can read parts of it, as described in The staff console's activity view.

1. Go to Organizations, open your organization and choose Audit.
2. Read the Audit log table. Each row shows When the change happened, the Actor who made it, the Action, its Target, the first few Details and the IP address.
3. To narrow the list, type in the search box, choose a kind of actor, or choose an area such as customers or services.
4. Select a row to open the full entry, with every detail it recorded. Choose Copy details to copy them as JSON.
5. Use the pages at the bottom to go back to older entries.

The table loads 200 entries at a time, and the search and the filters only look through the page on screen. To find an older change, move to an older page first.

Actor

Who made the change, with a badge for their kind. Members show as You or a user number, API keys and customers by their number, and the platform as System. A change made from your staff console carries a Staff badge, and one made by Coritan staff carries an Admin badge.

Action

What happened, as a name in two parts: the area and the verb, such as customer.created or discord.config_updated. The badge colour shows whether it added, changed or removed something.

Target

The record the change applies to, such as a customer or a service, with its number.

Your staff console reads the same log through its activity view, and each role sees a different part of it:

• Owners and admins read all of it, and can filter by customer, service, server, member, action, date and text.
• Support tier 3 and billing members must name a customer, a service or a server, or ask for their own actions.
• Support tiers 1 and 2 can only read their own actions.
• Read-only members cannot open it.

The staff console describes the rest of the console.

You can see who made a change, when, from where, and exactly what they changed.

The Audit tab says your role cannot open it

Only owners and admins can read the log. Ask one of them, or ask for your role to change.

A change you expected is missing

The search and the filters only cover the page on screen. Clear them and move to an older page.

• Roles and permissions
• Members and roles
• Receive organization webhooks

The route needs an owner's or admin's access token, sent as Authorization: Bearer $CORITAN_TOKEN.

curl "https://api.coritan.com/api/v1/orgs/acme/audit-log?limit=100&offset=0" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

limit takes 1–200 and defaults to 50; offset skips that many of the newest entries. The route filters nothing else. The answer is a list, newest first, and each entry has:

To filter by customer, service, server, member, action or date on the server side, use GET /api/v1/orgs/{org_slug}/staff/activity, which the staff console page covers.