# Audit Log (/docs/overview/audit-log)

> For the complete documentation index, see [llms.txt](https://docs.tandemcx.ai/llms.txt). Any page on this site can be fetched as Markdown by appending `.md` to its URL.

<Callout type="info">
    **This page is being rolled out.** If **Admin → Audit Log** isn't in your sidebar, it isn't
    enabled for your organization yet — contact support.
</Callout>

The audit log records every change made through Tandem's APIs: who made it, what they changed,
when, and whether it succeeded. Find it under **Admin → Audit Log**.

Rejected changes are recorded too. A `403` on someone trying to edit a workflow they don't have
access to appears in the log alongside the changes that worked.

<Callout type="info">
    This page is gated on the administrator role, and the Admin section is hidden from anyone
    without it. Every role Tandem issues today — Owner, Admin and Member — carries administrator
    access, so in practice everyone in your organization can open it. That changes as roles gain
    distinct permissions.
</Callout>

## The events list

The list opens on the **last 7 days**, newest first, twenty events to a page. Each row gives you:

- **When** — the date, over the time to the second in your browser's time zone.
- **Who** — the person or service that made the change, over their actor type (`user` or
  `system`). A name shows when Tandem could resolve one; otherwise you get their email, and
  failing that the raw actor ID, so someone who has since left the organization is still
  identifiable. A change made through Tandy or your own MCP client is still recorded as the
  person who approved it, marked **via Tandy** or **via MCP client**.
- **Action** — the resource and the verb, such as `Workflow update` or `Org secret created`.
- **Target** — the specific thing that changed, over its type. Not every change records a
  name, so this reads as an ID or a dash for some events.
- **Outcome** — one of **Success**, **Denied**, **Invalid** or **Error**. **Denied** means the
  system worked and correctly refused someone; it is not a failure.

### Sub-tenant events

If your organization has [sub-tenants](/docs/overview/sub-tenants), their events are listed
beside your own, and the list gains an **Organization** column naming where each event
happened. Use the **Organization** filter to narrow the list to some of them. An organization that
is itself a sub-tenant sees only its own events.

A newly created sub-tenant can take up to a minute to appear here.

Select the **When** header to flip between newest-first and oldest-first. It's the only column
you can sort on.

Narrow columns drop off as the window gets smaller, and again when you open an event's detail
panel. **When** is never one of them.

### The URL is the view

Every filter, the sort direction and the page number live in the address bar. "Page 3 of the log
for this user last Tuesday" is a link you can paste into a ticket, and the browser's back button
moves between views rather than leaving the page.

## Filtering

- **Filters** holds **Actor**, **Action** and **Outcome**, plus **Organization** when your
  organization has sub-tenants. Organization, Actor and Action are searchable
  lists built from what actually appears in your current date range, so an action nobody in
  your organization has performed never clutters the list. The button shows a count when
  anything is applied.
- **Date Range**, just to the right of Filters, sets the window every other filter works
  inside. It's also the control that decides how much of the log each query has to read, so
  narrow it first when the page feels slow.
- **Search** matches on the target's name, the action, the target ID, and the actor's ID, name
  or email address.

**Clear All** inside the Filters panel clears those facets. **Reset**, beside the Filters
button, clears everything the URL carries: the facets, the date range, the search box and the
sort.

## Event detail

Selecting a row, or tabbing to it and pressing Enter, opens a panel with everything the table doesn't show, grouped as:

- **Event** — the time in your time zone and in UTC, the organization (when you have
  sub-tenants), the raw action string, and the request that caused it as method, route and HTTP
  status.
- **Actor** — name, email, actor ID, actor type, and the **Channel** (Tandy or an MCP
  client) when the change didn't come from someone using Tandem directly.
- **Target** — type, name, ID, and the **changed fields**.
- **Request detail** — IP address, user agent, which service handled the request, and a
  **trace ID** you can hand to support to have the request itself pulled up.
- **Detail** — extra context for the events that record any, shown as raw JSON. Absent
  otherwise.

<Callout type="warn">
    **Changed fields lists what was submitted, not what moved.** It's built from the fields present
    in the request, never from comparing the old and new values. A save that sends the whole object
    back lists every field on it, whether the value changed or not. The log does not record what a
    value changed from or to.
</Callout>

## Export

**Export** downloads the current view as CSV: the same filters and date range you're looking
at, but the whole matching range rather than the page on screen. Times in the file are UTC, in
the same form as the **UTC** line in an event's detail panel, so you can find an event from the
page in the file. The last column, `organization_id`, is the ID of the organization each event
happened in.

The export is capped at **10,000 events**. Past that it refuses rather than handing you a
truncated file, with `More than 10000 events match. Please narrow the date range or filters.`
Narrow the range and take it in pieces.

## What the log does not record

- **Sign-ins.** Login, logout and failed login happen in Tandem's identity provider, not in
  Tandem's own services, and aren't in this log.
- **Reads.** Only changes are recorded. Who viewed a recording or opened this page is not.
- **Workflow and node runs.** `workflow.execute`, `workflow.resume` and `node.execute` fire on
  every conversation turn and every test run in the builder. They're call volume rather than a
  change an admin reviews, so they're excluded.
- **Before and after values.** See the callout under [Event detail](#event-detail).

## Retention

Events are kept for **12 months** and dropped a month at a time after that. Export anything you
need to hold longer.

Deleting an organization doesn't remove its events. They stay for the same 12 months, and the
deletion adds an `organization.deleted` event. See [Delete an
Organization](/docs/overview/delete-organization#the-audit-log).

## Troubleshooting

**The list is empty for a range I know had activity.** The empty list names the range it
searched, so check that first, then whether a filter is still applied. The Filters button shows a
count when it is, and **Reset Filters** clears everything at once.

**A change I just made isn't there.** Events are written in batches a few seconds behind the
request. Reload the page.

## Next steps

- [Manage Users](/docs/overview/manage-users) — who is in your organization, and their roles.
- [Secrets & Variables](/docs/overview/secrets-and-variables) — the org-wide values whose
  changes show up here as `Org secret` and `Org variable` events.