# Audit log

Source: https://kirora.io/docs/guides/account/audit-log

See who sent, changed, exported or signed in to your workspace, filter the record and export it as CSV.

The audit log is a record of the important actions taken in your workspace: who sent a campaign, changed someone's role, created an API key, exported contacts or signed in, and when. Use it to answer a security review, check what changed before a problem, or see who did something.

## Open the audit log

Go to **Settings › Workspace › Audit log**. Only admins and the owner can open it. The log is on every plan; how far back it goes depends on the plan (see [How long entries are kept](#how-long-entries-are-kept)).

## What each entry shows

| Column | What it shows |
| --- | --- |
| **When** | The date and time of the action |
| **Who** | The person, or the API key, that did it. Your own actions read "You". A person who has since left keeps the name they had then |
| **What** | The action, such as "Sent a campaign" or "Changed someone's role" |
| **On** | What it was done to, by its name at the time, such as a campaign or a sending domain. Where the record still exists and has a page, the name links to it |
| **Details** | What changed, such as a setting's old and new value, or the new role |
| **IP address** | Where the request came from, or "Not recorded" |

Workspace changes are recorded once they succeed. Sign-ins are recorded whether they succeed or fail. Actions taken through the API, including by an AI assistant's agent key, are recorded against the key that made them. Nobody can edit or delete an entry.

## What's recorded

The **Action** filter lists every recorded action, in six groups:

- **Sending:** sending, scheduling, unscheduling, cancelling and deleting campaigns; choosing an A/B test winner; activating, pausing, ending and deleting journeys, and taking a contact out of one; publishing, restoring and deleting templates and forms; deleting shared blocks, images and conversion goals; changing the sending rules and message limits; resuming paused marketing email; approving an agent's action; cancelling a timed transactional email or viewing one's content; and exporting delivery records.
- **Contacts:** imports and exports, bulk changes, deleting and merging contacts, exporting a contact's data, changes to suppression, removing contacts from a list, deleting lists, segments, topics and event names, deleting and merging tags, and changes to the signup blocklist.
- **Users and sign-in:** invitations and invite links, role changes, removals, handing over ownership, people joining and leaving, sign-ins (successful and failed), password changes and resets, signing out devices, and turning two-factor sign-in on or off.
- **Goals:** creating, changing and retiring goals, and adding or changing their targets.
- **Plan and billing:** plan changes, cancelled plan changes, voided invoices, billing settings, balance top-ups and saved cards.
- **Developer and setup:** API keys, the SDK keys, webhooks, sending domains, push apps, integrations and connected AI apps, workspace settings, turning Kiro AI on or off, and asking to delete the workspace or cancelling that. In a partner workspace it also covers suspending, resuming and viewing client workspaces and starting builder sessions.

A sign-in is recorded in the workspace it opened, or would have opened.

## Filter the log

Use the filters above the table, together or alone:

- **Action**: one kind of action, such as "Changed someone's role".
- **Who**: one person (under **Users**) or one API key (under **API keys**).
- **From** and **To**: a date range, read in your own time zone. **To** includes the whole of that day.

Choose **Clear filters** to see everything again.

## Export the log

Choose **Export CSV** to download `audit-log.csv`. It contains every entry that matches your current filters, newest first, not only the page you're looking at. Each row has the time, action, who did it (with their type and ID), the resource's type, ID and name, the IP address and the details.

The button is unavailable when no entry matches the filters.

## How long entries are kept

Entries are kept for your plan's audit period, from 30 days on Free to two years on Enterprise; [Pricing](https://kirora.io/pricing) lists each plan's period. Older entries are deleted. See [Data retention](https://kirora.io/docs/guides/account/data-retention) for what happens after a plan change.

For a longer record, export the log regularly and keep the files yourself.

## Audit log and request log

The audit log records what people and keys did in the workspace. The **Request log**, under **Developer**, is a diagnostic view of every API request for the last 31 days: its method, path, status and timing. Admins and the owner can see both; developers see the request log.

## Next steps

- [Security and access](https://kirora.io/docs/guides/account/security-and-access): roles, two-factor sign-in and workspace rules
- [Data retention](https://kirora.io/docs/guides/account/data-retention): what Kirora keeps and for how long
- [Notifications and alerts](https://kirora.io/docs/guides/account/notifications): what Kirora tells admins about as it happens