# Read the organization audit log

> See who changed what in your organization, and when, from the dashboard, the staff console and the API.

Source: https://www.coritan.com/docs/organizations/audit-log/

In the dashboard:

- /dashboard/organizations/…/audit: https://www.coritan.com/dashboard/organizations

The audit log records the changes made in your organization: who made each one, what they changed, when, and from which IP address. Members, API keys, customers, your staff console, Coritan staff and the platform itself all write to it, newest entry first.

## Before you begin

You need the `owner` or `admin` role to read the whole log. In the staff console, support and billing roles can read parts of it, as described in [The staff console's activity view](#the-staff-console-s-activity-view).

## Read the log

1. Go to [Organizations](https://www.coritan.com/dashboard/organizations), open your organization and choose **Audit**.
2. Read the **Audit log** table. Each row shows **When** the change happened, the **Actor** who made it, the **Action**, its **Target**, the first few **Details** and the **IP** address.
3. To narrow the list, type in the search box, choose a kind of actor, or choose an area such as customers or services.
4. Select a row to open the full entry, with every detail it recorded. Choose **Copy details** to copy them as JSON.
5. Use the pages at the bottom to go back to older entries.

The table loads 200 entries at a time, and the search and the filters only look through the page on screen. To find an older change, move to an older page first.

## What the columns mean

**Actor**
: Who made the change, with a badge for their kind. Members show as `You` or a user number, API keys and customers by their number, and the platform as `System`. A change made from your staff console carries a Staff badge, and one made by Coritan staff carries an Admin badge.

**Action**
: What happened, as a name in two parts: the area and the verb, such as `customer.created` or `discord.config_updated`. The badge colour shows whether it added, changed or removed something.

**Target**
: The record the change applies to, such as a customer or a service, with its number.

## The staff console's activity view

Your staff console reads the same log through its activity view, and each role sees a different part of it:

- Owners and admins read all of it, and can filter by customer, service, server, member, action, date and text.
- Support tier 3 and billing members must name a customer, a service or a server, or ask for their own actions.
- Support tiers 1 and 2 can only read their own actions.
- Read-only members cannot open it.

[The staff console](/docs/organizations/staff-console/) describes the rest of the console.

## Result

You can see who made a change, when, from where, and exactly what they changed.

## Troubleshooting

The Audit tab says your role cannot open it
: Only owners and admins can read the log. Ask one of them, or ask for your role to change.

A change you expected is missing
: The search and the filters only cover the page on screen. Clear them and move to an older page.

## Related

- [Roles and permissions](/docs/organizations/roles-and-permissions/)
- [Members and roles](/docs/organizations/members-and-roles/)
- [Receive organization webhooks](/docs/organizations/webhooks/)

## With the API

The route needs an owner's or admin's access token, sent as `Authorization: Bearer $CORITAN_TOKEN`.

```bash
curl "https://api.coritan.com/api/v1/orgs/acme/audit-log?limit=100&offset=0" \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

`limit` takes 1–200 and defaults to 50; `offset` skips that many of the newest entries. The route filters nothing else. The answer is a list, newest first, and each entry has:

| Field | Meaning |
| --- | --- |
| `id` | The entry's ID. |
| `actor_type` | `user`, `staff`, `api_key`, `customer`, `admin`, `partner` or `system`. |
| `actor_id` | The ID of the actor within its kind, or `null`. |
| `action` | The action name, such as `customer.created`. |
| `resource_type` and `resource_id` | The record the change applies to. |
| `details` | What changed, as a JSON object. Its fields depend on the action. |
| `ip_address` | The IP address the change came from, when we know it. |
| `created_at` | When it happened, in UTC. |

To filter by customer, service, server, member, action or date on the server side, use `GET /api/v1/orgs/{org_slug}/staff/activity`, which the [staff console](/docs/organizations/staff-console/) page covers.

## API

- `GET /api/v1/orgs/{org_slug}/audit-log`: List audit log (https://www.coritan.com/docs/api/reference/organizations/organizations-members/audit-log/#op-get-api-v1-orgs-org-slug-audit-log)