> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Tamper-evident history of every action in your Zwiron organization for compliance and investigations.

**Audit Logs** record every action performed in your Zwiron organization — who did what, when, and from where. Use them for compliance, security investigations, and change management.

***

## What is logged

Every operation that creates, modifies, or deletes a resource is recorded:

| Resource                  | Actions logged                                                      |
| ------------------------- | ------------------------------------------------------------------- |
| **Jobs**                  | Created, updated, triggered, cancelled, deleted                     |
| **Connections**           | Created, updated, tested, deleted                                   |
| **Agents**                | Installed, updated, key rotated, uninstalled                        |
| **Team members**          | Invited, role changed, removed                                      |
| **API keys**              | Created, deleted *(feature coming soon)*                            |
| **Webhooks**              | Created, updated, deleted, enabled/disabled *(feature coming soon)* |
| **SSO**                   | Configured, enabled, disabled                                       |
| **Organization settings** | Any settings change                                                 |

***

## Log entry fields

Each audit log entry contains:

| Field         | Description                                              |
| ------------- | -------------------------------------------------------- |
| `timestamp`   | When the action occurred (UTC)                           |
| `user_email`  | Who performed the action                                 |
| `action`      | What was done (e.g. `job.created`, `connection.deleted`) |
| `resource`    | The type of resource affected                            |
| `resource_id` | The ID of the specific resource                          |
| `ip_address`  | IP address of the request                                |
| `user_agent`  | Browser or API client string                             |

***

## Viewing audit logs

1. Go to **Settings** → **Audit Logs**
2. Browse the log in reverse-chronological order
3. Filter by:
   * **Action** — e.g. only show `connection.deleted` events
   * **Resource** — e.g. only show events for jobs
   * **Date range** — narrow to a specific window

***

## Exporting logs

Click **Export** to download the current filter view as a CSV file. Use this for compliance reports, security reviews, or importing into your SIEM.

***

## Retention

Audit log retention depends on your plan. Logs are stored securely and are read-only — they cannot be modified or deleted by organization members.

***

## Common use cases

**Security investigation:**

> Someone deleted a connection. Filter by `connection.deleted` and identify the user, timestamp, and IP address.

**Compliance audit:**

> "Who had access to production credentials?" — filter by team events and SSO logins over the audit period.

**Change tracking:**

> "When was this job last changed and by whom?" — filter by `job.updated` and the specific job ID.