# Audit log

> A tamper-evident record of every security-relevant action on your project.

Source: https://docs.grovs.io/docs/enterprise/audit-log

Each project has an append-only log of who did what, when, and from where. Every entry is chained to the previous one with a SHA-256 hash, so a missing or altered entry can be detected.

Admins read it in the dashboard under **Audit Logs**. To pull it into Splunk, Datadog or any other SIEM, see the [SIEM integration guide](https://docs.grovs.io/docs/enterprise/audit-log/siem-integration).

## Availability

The audit log is available on:

- **Self-hosted deployments running the Enterprise edition.** On with no further configuration. The Community edition image does not include the audit log, and its endpoints answer `404`.
- **SaaS projects on an enterprise plan.**

Other projects don't record audit events, and the audit endpoints answer `403`.

> **Note:** Only admins of a project can read its audit log or manage its export tokens. Members don't see the Audit Logs page at all.

## What gets recorded

One entry per business action, no matter how many rows it touched.

| Family         | Examples                                                                                                                        |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Auth           | `user.login`, `user.login_failed`, `user.sso_login`, `user.password_changed`, `user.2fa_enabled`                                |
| Membership     | `instance.member_added`, `instance.member_removed`                                                                              |
| Project        | `instance.renamed`, `instance.retention_changed`, `instance.deletion_requested`, `instance.deleted`                             |
| Credentials    | `audit_export_token.created`, `audit_export_token.revoked`, `mcp_token.revoked`, `api_key.used`, `api_key.auth_failed`          |
| Configuration  | `ios_configuration.updated`, `android_configuration.updated`, `web_configuration.updated`, `redirect.updated`, `domain.updated` |
| Custom domains | `custom_domain.created`, `custom_domain.verified`, `custom_domain.deleted`                                                      |
| Data           | `link.created`, `link.updated`, `link.deleted`, `export.link_data`, `export.usage_data`                                         |
| Billing        | `enterprise_subscription.created`, `subscription.changed`                                                                       |
| System         | `retention.deletion_ran`, `quota.disabled`, `quota.restored`                                                                    |

Each entry carries the actor (`user`, `api_key`, `admin_key`, `scim_token`, or `system`), the credential channel it came through (`password`, `sso:google_oauth2`, `sso:microsoft_graph`, `sso:oidc` for enterprise SSO, `scim`, `mcp_token`, `api_key`…), the target, a before/after diff where one applies, plus IP, user agent, and request ID.

> **Note:** The audit log is project-wide, not per-environment. Production and Test share one chain, because most of what it records (membership, billing, retention) isn't environment-specific.

## What you can rely on

- **Completeness.** The entry is written in the same database transaction as the action itself. An audited action cannot succeed without its record.
- **Append-only.** Entries are never updated or deleted, not even when the project is deleted.
- **Ordering.** `sequence` is a gap-free per-project counter, and the only cursor you need.
- **Integrity.** Every entry stores the previous entry's hash, forming a chain you can [verify independently](https://docs.grovs.io/docs/enterprise/audit-log/siem-integration#verifying-the-chain).

## Secrets are filtered

Credentials never reach the log. Values such as API keys, push certificates, and client secrets are replaced with `[FILTERED]` in the `changes` diff, so an entry records that a secret changed without recording the secret.

## Reading it in the dashboard

Open **Audit Logs** from the sidebar. Filter by action, actor email and date range. Click a row to open the full entry, including the before/after diff and its position in the hash chain.