> ## Documentation Index > Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Audit log > Review and export the actions taken in your organization ## Overview **Audit log**, under Reporting in the sidebar, lists your organization's audit events with the columns **Time**, **Actor**, **Action** and **Related**. You can filter the list by **Range**, actor, **Source** and **Level**, open an event to see its details, and download the filtered list with **Export CSV**. Only organization admins can view the audit log, and the sidebar entry is shown only to them. See [Navigating ZeroPath](/docs/platform/navigation) for the sidebar. Open it at [zeropath.com/app/audit-log](https://zeropath.com/app/audit-log). Links to the older `/app/settings/audit-log` address open the same page. ## Who can open it The audit log is for organization admins. Its sidebar entry requires the **Edit Organization Details** permission, which can't be granted through a team, and the page also checks that you are an admin of the organization. Anyone else who opens the address sees "Only organization admins can view the audit log." ## What it records Each event is one action ZeroPath recorded for your organization, with who took it, where it came from and what it was about. Events come from people in the web app, API tokens, the CLI, the IDE plugin, MCP clients, the ZeroPath Assistant and background jobs. The audit log lists the actions ZeroPath records, which is not every action in the product. Viewing the audit log is not recorded. Exporting it is, as an `organizations.exportAuditLogs` event. The page covers up to the last 90 days. Credentials are redacted before an event is stored. The audit log always covers the whole organization, so the top-bar repository filter does not apply to it. ## Filtering the list The toolbar above the list narrows it: | Control | Options | | - | - | | **Search actions, endpoints, people** | Matches an event's message, its endpoint name, or the name or email of the person who took it. | | **Range** | **Last 24 hours**, **Last 7 days** (the default), **Last 30 days**, **Last 90 days**. | | **Actor** | **All actors**, or one actor: a person, **ZeroPath Assistant**, **System** or **Unknown**. | | **Source** | **All sources**, **Web app**, **API token**, **MCP**, **CLI**, **IDE**, **System**. **Not captured** appears when the range holds events with no recorded source. | | **Level** | **All levels**, **Warnings**, **Errors**. | Each Actor, Source and Level option shows how many events in the range match it. **Clear filters** appears while a search, actor, source or level filter is set, and resets them without changing the range. The page address keeps your filters, so a bookmarked or shared link opens the same view. ## Reading the list Events are grouped by day, newest first. Each day header shows **Today**, **Yesterday** or the weekday, the date, and the number of events that day. Times use your browser's time zone. | Column | What it shows | | - | - | | **Time** | When the action happened. | | **Actor** | Who took the action, with their role underneath. People show **Admin** or **Member**. The Assistant shows as **ZeroPath Assistant** with **Automated**, and background jobs as **System** with **Background job**. Actions ZeroPath can't attribute show as **Unknown**. | | **Action** | The event's message when one was recorded, with the endpoint name below it. Most events have no message and show the endpoint name, such as `jira.exportIssue`. A **Warning** or **Error** badge marks events at those levels. | | **Related** | A link to the issue, repository or SLA policy the action was about, when its arguments name exactly one. This column is hidden on narrow screens. | The footer shows the number of events that match, and **Load older events** loads the next page. ## Event details Select a row to open the **Event** panel. It shows: * The event's message, or its endpoint name with the note "No message was recorded for this event. Showing the endpoint name." * **Actor** (with the person's email), **Role**, **Source**, **Time**, **Endpoint** and, when there is one, **Related**. * **Arguments**: the values recorded with the action. Redacted values show a lock, and the heading shows how many were redacted. **Copy JSON** copies the arguments. Events with none show "No arguments were recorded." Two buttons at the bottom narrow the list from the event you are reading: **Events by this actor** filters by its actor, and **Same endpoint** searches for its endpoint name. While the panel is open, press the Up arrow for the newer event, the Down arrow for the older one, and Escape to close it. ## Exporting **Export CSV** downloads the events the list currently shows: the same range and filters, newest first. The file is named `audit-log--.csv` and has these columns: `callerId`, `callerName`, `callerEmail`, `callerRole`, `apiEndpointName`, `apiEndpointArguments`, `createdAt`, `message`, `level`, `source`. One export holds at most 100,000 events. When the list matches more, ZeroPath refuses the export and asks you to narrow the range or filters. ## Settings › General › Audit logs **Settings** › **General** also has an **Audit logs** tab for admins. Its **Export Last 30 Days** button downloads every event from the last 30 days, with no filters, as `audit-logs--.csv`. The same 100,000-event limit applies; when an export is larger, narrow it on the Audit log page. **Contact Support for More** opens an email to ZeroPath support. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.