Audit log
Review a chronological record of security- and governance-relevant activity in your organization.
The audit log records who did what in your organization, giving you an accountability trail for security reviews and compliance. Admins view it under /app/settings/audit.
#What is recorded
Flax writes audit entries for security- and governance-relevant events using dotted names, such as login.password.success, resource.shared, attribute.set, and user.deleted. Each entry captures:
| Field | Description |
|---|---|
| Actor | The user who performed the action. |
| Organization | The org the event belongs to. |
| Event | The dotted event name. |
| IP address | The client IP the request came from. |
| User agent | The client that made the request. |
| Metadata | Event-specific details, where relevant. |
| Timestamp | When the event occurred. |
#Reviewing activity
Open the Audit page to browse entries newest-first. Use it to answer questions such as who shared a dashboard, when SSO settings changed, or which account was deleted.
Note
Audit entries are written before destructive actions complete — for example, an account deletion is logged while the actor's identity still exists — so the trail stays intact even after data is anonymized.