## Audit log

Review actions taken in your workspace.

### Overview

The audit log records actions taken across your workspace, including sign-ins, file activity, billing changes, contract signatures, and more. Use it to review who did what and when, troubleshoot issues, and support security and compliance reviews.

The audit log is available on the _Advanced_ and _Enterprise_ plans. Workspaces on _Starter_ and _Professional_ see a 24-hour preview of recent events with the option to upgrade.

### How to access the audit log

1. Click _Settings_ in the sidebar.
2. Click _Audit log_.

The table displays events in reverse chronological order. Timestamps are shown in your local timezone, displayed in the header above the table.

### Filtering

Use the filters above the table to narrow down what you see.

- _User_: Filter to actions performed by one or more specific users. Use the search box to find a user by name, then select one or more checkboxes and click _Apply_.
- _Event_: Filter to one or more specific event types, such as _Login Succeeded_ or _Magic Link Sent_. Use the search box to find an event, then select one or more checkboxes and click _Apply_.

Filters can be combined. For example, you can view all _Login Failed_ events for a specific user.

### What's recorded

Each event in the audit log includes the following:

| Field | Details |
| --- | --- |
| Actor | The internal user, client, automation, or API key that performed the action. |
| Source | Where the action originated: _web_, _automation_, or _api_. |
| Event | The action that occurred, such as _Login Succeeded_ or _Magic Link Sent_. |
| IP address | The IP address of the actor. |
| User agent | Browser and device information for the actor. |
| Timestamp | When the action occurred, shown in your local timezone. |

### Event categories

The audit log covers events across the following areas:

| Category | Examples |
| --- | --- |
| Authentication | Login Succeeded, Login Failed, Logout, Password Reset, Password Changed, Google Delinked, Magic Link Sent. |
| Internal Users | Internal users added, removed, or updated. Role changes. |
| CRM | Clients and companies created, updated, or deleted. |
| Files | Files uploaded, downloaded, moved, or deleted. |
| Contracts | Contracts sent, signed, voided, or downloaded. |
| Forms | Forms created, sent, and submitted. |
| Billing | Invoices created, paid, refunded, or voided. |
| Messages | Messages sent, edited, or deleted. |
| Internal Notes | Internal notes created, edited, or deleted. |
| Notifications | Notifications delivered and viewed. |
| Tasks | Tasks created, updated, completed, or deleted. |
| Developer | API key activity and events from custom apps. |

### Exporting the audit log

On the _Advanced_ and _Enterprise_ plans, you can export the audit log to CSV. Click _Export_ in the top right of the audit log to download the file.

Any filters you have applied are reflected in the export.

### Custom app events

Custom apps in your workspace can record events to the audit log using the [Events API](https://docs.assembly.com/reference/create-event). This lets you track actions taken inside custom apps alongside Assembly's native events. Refer to the [Events API](https://docs.assembly.com/reference/create-event) reference for endpoint details.