Skip to main content

​
Overview

Audit log, under Reporting in the sidebar, lists your organization’s audit events with the columns Time, Actor, Action and Related. You can filter the list by Range, actor, Source and Level, open an event to see its details, and download the filtered list with Export CSV. Only organization admins can view the audit log, and the sidebar entry is shown only to them. See Navigating ZeroPath for the sidebar. Open it at zeropath.com/app/audit-log. Links to the older /app/settings/audit-log address open the same page.

​
Who can open it

The audit log is for organization admins. Its sidebar entry requires the Edit Organization Details permission, which can’t be granted through a team, and the page also checks that you are an admin of the organization. Anyone else who opens the address sees “Only organization admins can view the audit log.”

​
What it records

Each event is one action ZeroPath recorded for your organization, with who took it, where it came from and what it was about. Events come from people in the web app, API tokens, the CLI, the IDE plugin, MCP clients, the ZeroPath Assistant and background jobs. The audit log lists the actions ZeroPath records, which is not every action in the product. Viewing the audit log is not recorded. Exporting it is, as an organizations.exportAuditLogs event. The page covers up to the last 90 days. Credentials are redacted before an event is stored. The audit log always covers the whole organization, so the top-bar repository filter does not apply to it.

​
Filtering the list

The toolbar above the list narrows it: Each Actor, Source and Level option shows how many events in the range match it. Clear filters appears while a search, actor, source or level filter is set, and resets them without changing the range. The page address keeps your filters, so a bookmarked or shared link opens the same view.

​
Reading the list

Events are grouped by day, newest first. Each day header shows Today, Yesterday or the weekday, the date, and the number of events that day. Times use your browser’s time zone. The footer shows the number of events that match, and Load older events loads the next page.

​
Event details

Select a row to open the Event panel. It shows:
  • The event’s message, or its endpoint name with the note “No message was recorded for this event. Showing the endpoint name.”
  • Actor (with the person’s email), Role, Source, Time, Endpoint and, when there is one, Related.
  • Arguments: the values recorded with the action. Redacted values show a lock, and the heading shows how many were redacted. Copy JSON copies the arguments. Events with none show “No arguments were recorded.”
Two buttons at the bottom narrow the list from the event you are reading: Events by this actor filters by its actor, and Same endpoint searches for its endpoint name. While the panel is open, press the Up arrow for the newer event, the Down arrow for the older one, and Escape to close it.

​
Exporting

Export CSV downloads the events the list currently shows: the same range and filters, newest first. The file is named audit-log-<start date>-<end date>.csv and has these columns: callerId, callerName, callerEmail, callerRole, apiEndpointName, apiEndpointArguments, createdAt, message, level, source. One export holds at most 100,000 events. When the list matches more, ZeroPath refuses the export and asks you to narrow the range or filters.

​
Settings › General › Audit logs

Settings › General also has an Audit logs tab for admins. Its Export Last 30 Days button downloads every event from the last 30 days, with no filters, as audit-logs-<start date>-<end date>.csv. The same 100,000-event limit applies; when an export is larger, narrow it on the Audit log page. Contact Support for More opens an email to ZeroPath support.