Audit Log

The audit log records every change made through Tandem's APIs: who made it, what they changed, when, and whether it succeeded. Find it under Admin → Audit Log.

Rejected changes are recorded too. A 403 on someone trying to edit a workflow they don't have access to appears in the log alongside the changes that worked.

The events list

The list opens on the last 7 days, newest first, twenty events to a page. Each row gives you:

• When — the date, over the time to the second in your browser's time zone.
• Who — the person or service that made the change, over their actor type (user or system). A name shows when Tandem could resolve one; otherwise you get their email, and failing that the raw actor ID, so someone who has since left the organization is still identifiable. A change made through Tandy or your own MCP client is still recorded as the person who approved it, marked via Tandy or via MCP client.
• Action — the resource and the verb, such as Workflow update or Org secret created.
• Target — the specific thing that changed, over its type. Not every change records a name, so this reads as an ID or a dash for some events.
• Outcome — one of Success, Denied, Invalid or Error. Denied means the system worked and correctly refused someone; it is not a failure.

Sub-tenant events

If your organization has sub-tenants, their events are listed beside your own, and the list gains an Organization column naming where each event happened. Use the Organization filter to narrow the list to some of them. An organization that is itself a sub-tenant sees only its own events.

A newly created sub-tenant can take up to a minute to appear here.

Select the When header to flip between newest-first and oldest-first. It's the only column you can sort on.

Narrow columns drop off as the window gets smaller, and again when you open an event's detail panel. When is never one of them.

The URL is the view

Every filter, the sort direction and the page number live in the address bar. "Page 3 of the log for this user last Tuesday" is a link you can paste into a ticket, and the browser's back button moves between views rather than leaving the page.

Filtering

• Filters holds Actor, Action and Outcome, plus Organization when your organization has sub-tenants. Organization, Actor and Action are searchable lists built from what actually appears in your current date range, so an action nobody in your organization has performed never clutters the list. The button shows a count when anything is applied.
• Date Range, just to the right of Filters, sets the window every other filter works inside. It's also the control that decides how much of the log each query has to read, so narrow it first when the page feels slow.
• Search matches on the target's name, the action, the target ID, and the actor's ID, name or email address.

Clear All inside the Filters panel clears those facets. Reset, beside the Filters button, clears everything the URL carries: the facets, the date range, the search box and the sort.

Event detail

Selecting a row, or tabbing to it and pressing Enter, opens a panel with everything the table doesn't show, grouped as:

• Event — the time in your time zone and in UTC, the organization (when you have sub-tenants), the raw action string, and the request that caused it as method, route and HTTP status.
• Actor — name, email, actor ID, actor type, and the Channel (Tandy or an MCP client) when the change didn't come from someone using Tandem directly.
• Target — type, name, ID, and the changed fields.
• Request detail — IP address, user agent, which service handled the request, and a trace ID you can hand to support to have the request itself pulled up.
• Detail — extra context for the events that record any, shown as raw JSON. Absent otherwise.

Export

Export downloads the current view as CSV: the same filters and date range you're looking at, but the whole matching range rather than the page on screen. Times in the file are UTC, in the same form as the UTC line in an event's detail panel, so you can find an event from the page in the file. The last column, organization_id, is the ID of the organization each event happened in.

The export is capped at 10,000 events. Past that it refuses rather than handing you a truncated file, with More than 10000 events match. Please narrow the date range or filters. Narrow the range and take it in pieces.

What the log does not record

• Sign-ins. Login, logout and failed login happen in Tandem's identity provider, not in Tandem's own services, and aren't in this log.
• Reads. Only changes are recorded. Who viewed a recording or opened this page is not.
• Workflow and node runs. workflow.execute, workflow.resume and node.execute fire on every conversation turn and every test run in the builder. They're call volume rather than a change an admin reviews, so they're excluded.
• Before and after values. See the callout under Event detail.

Retention

Events are kept for 12 months and dropped a month at a time after that. Export anything you need to hold longer.

Deleting an organization doesn't remove its events. They stay for the same 12 months, and the deletion adds an organization.deleted event. See Delete an Organization.

Troubleshooting

The list is empty for a range I know had activity. The empty list names the range it searched, so check that first, then whether a filter is still applied. The Filters button shows a count when it is, and Reset Filters clears everything at once.

A change I just made isn't there. Events are written in batches a few seconds behind the request. Reload the page.

Next steps

• Manage Users — who is in your organization, and their roles.
• Secrets & Variables — the org-wide values whose changes show up here as Org secret and Org variable events.