The audit log records every change in your organization — the person, the time and the fields that changed. Rows can never be edited or deleted, so it's the place to answer "who changed this?" and "was that us?".
Before you start
You need admin:audit. It's its own permission: admin:read doesn't include it, so an auditor can see history without the user list, and an admin without the key can't see the log. See the permission reference.
Open the log
Select Settings at the foot of the rail, then the Audit log tab. The page opens for anyone who holds admin:audit; if your role has it but the rail shows no Settings icon, open /en/settings/audit (or /ar/settings/audit) directly.
The table has these columns: Time, Who, What happened, On and a details arrow. Each row reads as a sentence, such as "Ali created the role Supervisor". Select Load older at the bottom to go further back.
See what changed
Select a row's arrow to expand it. It shows each changed field as Before and After, with the request details: Request, Address, Browser and, where relevant, via. Values Natiq redacts show as hidden. A row with nothing to compare says "No field changes recorded". Copy link copies a link straight to that entry.
Filter the log
- 1Filters
- 2Export
Pick a Date range: Today, Last 7 days, Last 30 days, Custom… or All time. The log opens on Last 30 days.
Narrow it with the dropdowns. Anyone picks a person, Actor type picks People, Automations or System, Any object picks a kind of thing (a role, user, queue, channel line and so on), and Any action picks one or more actions, grouped by area such as Access, Sign-in or Channels.
To look at one thing, type its number in Object id. Selecting an entry in the On column does the same: it filters the log to that object's history over All time.
Select Clear filters to start again.
The filters live in the page address, so a view is a link. Copy it from your browser and send it to a reviewer who also holds admin:audit.
History links
Some settings screens carry a History link, for example on a role. It opens the audit log already filtered to that one object and set to All time. It only appears for people with admin:audit.
The Anyone filter only appears if you also have admin:read.
Export
Select Export as CSV to download what the current filters show (up to 100,000 rows) as a file Excel opens. The arrow beside it, Other export formats, offers Export as JSON Lines. The export is itself recorded: "The export was recorded in the audit log."
What the log covers
Among the things it records are sign-ins, failed sign-ins, sign-outs, signed-out sessions, and password reset requests and resets; invitations, users and role grants; roles; channel lines and external bots; queues, teams, routing and SLA policies; automation rules, macros and labels; ticket changes such as assignment, status and priority; contact merges; storage profiles; and organisation settings. Automations and Natiq itself appear as actors too — "An automation" and "The system".
How long it's kept
The footer reads Kept for N months. Select Change retention, enter the Months to keep — the field accepts 1 to 120 — and select Save. Rows older than the window stop showing in the log and in exports straight away. Natiq deletes them later, and adds a "Retention removed … rows older than the retention window" entry when it does.