> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hightouch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Hightouch offers audit logs so workspace admins can see what actions users took in-app and when.

> [!NOTE]
>
> Audit logs are only available on [Business tier plans](https://hightouch.com/pricing).

Hightouch offers audit logs so workspace admins can see what actions users took in-app and when. For example, suppose someone notices that a sync has sent incorrect data to a destination. A workspace admin can use audit logs to review changes made to the sync before the incorrect data appeared. The admin can correct the issue, and—if necessary—implement [controls](https://docs.hightouch.com/workspace-management/overview.md#roles) to avoid future incidents.

## View audit logs

[Workspace admins](#who-can-view-audit-logs) can view logs by going to the [**Audit log** tab](https://app.hightouch.com/settings/audit-log?from=docs) on the **Settings** page. The logs consist of a table of actions beginning with the most recent. Each row represents one action.

![Audit log table listing recent actions with their date, member, action, and resource type](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/workspace-management/audit-logs/audit-log-table.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=a99f0d1a005b3e1147fefcae5b3a0fc0)

Each action includes:

* The **Date** and time, in the viewer's timezone, the action took place
* The **Action** name, for example, "Sync Updated"
* The **Member** who performed the action, with an **API key** badge if they made the change with an API key
* The **Resource type** of the resource the action was performed on
* The **Resource name** of the resource the action was performed on

Clicking on an action opens its **Action details** panel, which shows the full change in JSON format. Added lines are highlighted in green, while removed lines are highlighted in red.

![Audit log action details showing the JSON diff, with removed lines in red and added lines in green](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/workspace-management/audit-logs/audit-log-details.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=a6a3ef181b66d2116fa9f039cc01888e)

## Filter audit logs

You can filter logs by:

* the workspace member who performed the action
* the API key used to perform the action
* the resource type the action was performed on
* the resource name the action was performed on
* a range of dates

You can select multiple members, API keys, and resource types to filter by simultaneously.

The table shows up to the first 1,000 matching entries. If you're looking for an older action, add filters to narrow the results.

![Audit log filters for workspace member, API key, resource type, resource name, and date range](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/workspace-management/audit-logs/audit-log-filters.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=1bec015406f35c5762b3ef67eb923e58)

## Export audit logs

Workspace admins can export the audit log as a CSV file, for example to keep a copy for compliance reviews. The export includes the workspace's full audit log, not only the entries that match your current filters.

To export the audit log:

1. Go to the [**Audit log** tab](https://app.hightouch.com/settings/audit-log?from=docs) on the **Settings** page.
2. Click **Export**, then confirm.

Hightouch emails you a link to download the CSV file when the export finishes, which can take several minutes. The link expires after seven days.

## FAQ

### Who can view audit logs?

Users with the [**Workspace admin** role](https://docs.hightouch.com/workspace-management/roles.md#pre-built-roles) in a workspace can view its full audit log. Organization admins receive this role automatically. [Custom roles](https://docs.hightouch.com/workspace-management/roles.md#custom-roles) can't grant access to the full audit log.

Users without that role can still see the change history of an individual sync, model, or audience on its **Activity** tab, as long as they can view that resource.

### What do audit logs include?

Audit logs track user-driven activity vs. programmatic changes. They work by taking a JSON snapshot of the changed resource for every user-driven change. Hightouch uses these snapshots for a before and after comparison for any changes.

A snapshot may include programmatic fields such as `last_run_at`, but Hightouch doesn't append a new audit log every time a field like `last_run_at` is updated since sync runs can be configured to run at regular intervals.

The exception to this is activity driven by [Git Sync](https://docs.hightouch.com/extensions/git-sync.md). For example, if a user changes a configuration via [Git Sync](https://docs.hightouch.com/extensions/git-sync.md), Hightouch treats that as a user-driven change, and it appears in the audit logs.

For a complete list of tracked actions, see the following [list](#resource-types-and-tracked-actions).

## Resource types and tracked actions

Audit logs show creation, update, and deletion type actions for the following resource types:

| Resource type | Tracked actions |
| - | - |
| **Alert** | Creations, updates, or deletions of [alerts](https://docs.hightouch.com/syncs/alerting.md) you configure to inform you of syncing issues |
| **Analytics query** | Queries Hightouch runs against your source to calculate [Intelligence](https://docs.hightouch.com/campaign-intelligence/overview.md) charts and funnels, including the SQL it ran |
| **API key** | Creations and deletions of [API keys](https://docs.hightouch.com/developer-tools/api-guide.md) *Note: Audit logs record changes made with an API key, not every request that uses it* |
| **Approval request** | Actions taken during [approval flows](https://docs.hightouch.com/workspace-management/approval-flows.md), including sending a request to review a draft or approving a draft |
| **Audience** | Creations, updates, or deletions of [audience](https://docs.hightouch.com/customer-studio/overview.md) configurations |
| **Audience schema** | Creations, updates, or deletions of [parent models, relationships, and event models](https://docs.hightouch.com/customer-studio/schema.md) |
| **Audience split** | Creations, updates, or deletions of split groups in audience [experiments](https://docs.hightouch.com/customer-studio/experiments.md) |
| **Audience template** | Creations, updates, or deletions of [audience templates](https://docs.hightouch.com/customer-studio/templates.md#audience-templates) |
| **Cloud credential** | Creations, updates, or deletions of cloud credentials, including changing your [external storage configuration](https://docs.hightouch.com/security/storage.md) |
| **Dashboard** | Creations, updates, or deletions of [dashboards](https://docs.hightouch.com/campaign-intelligence/dashboards.md) |
| **Dashboard chart** | Creations, updates, or deletions of [charts](https://docs.hightouch.com/campaign-intelligence/charts.md) on a dashboard |
| **Destination** | Creations, updates, or deletions of [destination](https://docs.hightouch.com/destinations/overview.md) configurations |
| **Destination rule** | Creations, updates, or deletions of [destination rules](https://docs.hightouch.com/customer-studio/destination-rules.md) |
| **Draft** | Creations, updates, or deletions of drafts used in [approval flows](https://docs.hightouch.com/workspace-management/approval-flows.md) |
| **Event contract** | Creations, updates, or deletions of [event contracts](https://docs.hightouch.com/events/contracts/management.md) |
| **Event schema** | Creations, updates, or deletions of the [event schemas](https://docs.hightouch.com/events/contracts/management.md#1-define-the-event-schema) in an event contract |
| **Git credential** | Creations, updates, or deletions of Git credentials used for [Git Sync](https://docs.hightouch.com/extensions/git-sync.md) |
| **Git Sync configuration** | Creations, updates, or deletions of [Git Sync](https://docs.hightouch.com/extensions/git-sync.md) configurations; for example, changing your tracked Git branch |
| **IDR** | Creations, updates, or deletions of identity graphs in Identity Resolution |
| **IDR golden record** | Creations, updates, or deletions of an identity graph's Golden Record configuration |
| **IDR model** | Creations, updates, or deletions of the models an identity graph uses as inputs |
| **Journey** | Creations, updates, or deletions of [journeys](https://docs.hightouch.com/customer-studio/journeys.md) |
| **Model** | Creations, updates, or deletions of [general model](https://docs.hightouch.com/models/creating-models.md) configurations, including updating the model query or primary key |
| **Model column** | Creations, updates, or deletions of [model columns](https://docs.hightouch.com/models/creating-models.md#column-descriptions) |
| **Model preview** | Actions taken while [previewing a model](https://docs.hightouch.com/models/creating-models.md#preview-model-results), including a user clicking “Preview” while editing a model or running a SQL query against a source during model setup |
| **Model trait definition** | Creations, updates, or deletions of [traits](https://docs.hightouch.com/customer-studio/traits.md) |
| **Realtime audience sync** | Creations, updates, or deletions of syncs for [realtime audiences](https://docs.hightouch.com/real-time/overview.md) |
| **Role** | Creations, updates, or deletions of [custom roles](https://docs.hightouch.com/workspace-management/roles.md#custom-roles) |
| **Session** | User sign-ins and sign-outs |
| **Source** | Creations, updates, or deletions of [source](https://docs.hightouch.com/sources/overview.md) configurations, including updating credentials or adding labels |
| **SSO connection** | Creations, updates, or deletions of [SSO](https://docs.hightouch.com/workspace-management/sso.md) connections, including changing SAML settings |
| **Subset** | Creations, updates, or deletions of [subsets](https://docs.hightouch.com/customer-studio/subsets.md) |
| **Subset audience assignment** | Changes to which [subsets an audience is assigned to](https://docs.hightouch.com/customer-studio/subsets.md#how-subsets-apply-to-audiences) |
| **Subset category** | Creations, updates, or deletions of [subset categories](https://docs.hightouch.com/customer-studio/subsets.md#2-create-a-subset-category) |
| **Subset category required model** | Changes to whether a subset category is [required](https://docs.hightouch.com/customer-studio/subsets.md#3-decide-whether-the-category-is-required) for a parent model |
| **Subset grant** | Changes to which [user groups can access a subset](https://docs.hightouch.com/customer-studio/subsets.md#5-grant-access-to-user-groups) |
| **Sync** | Creations, updates, or deletions of [sync](https://docs.hightouch.com/syncs/overview.md) configurations, including adding labels, scheduling, and turning a sync on or off |
| **Sync run** | Actions taken while viewing a sync; for example, a user clicking “Run” to start a [manual run](https://docs.hightouch.com/syncs/schedule-sync-ui.md#manual-runs) *Note: Audit logs don't include scheduled sync runs nor API-triggered sync runs* |
| **Sync template** | Creations, updates, or deletions of [sync templates](https://docs.hightouch.com/customer-studio/templates.md#sync-templates) |
| **User group membership** | Additions and removals of users in [user groups](https://docs.hightouch.com/workspace-management/user-management.md#groups) |
| **Workspace** | [Workspace](https://docs.hightouch.com/workspace-management/workspaces.md) creation |

### Older resource types

The **Resource type** filter also lists three types that Hightouch no longer records. They hold entries from before Hightouch moved workspace access to user groups:

* **Invite** — Workspace invitations. Invitations sent today are organization-level invitations, which workspace audit logs don't record.
* **Membership** — Workspace memberships. Adding or removing someone from a group now appears as **User group membership**.
* **Membership request** — Requests to join a workspace. Hightouch no longer supports these requests.

### Changes not in the Resource type filter

Some changes appear in the audit log but aren't in the **Resource type** filter, so you can't filter for them by type. These include changes to which user groups can access the workspace, the roles and grants those groups have in it, and Identity Resolution graph runs. To find them, filter by member, resource name, or date range instead.