Audit log

The audit log records every significant action in your organization: who did what, to what, from where, and when.

What the audit log records

The log captures the full event stream of your org, including:

• Captures, uploads, and media edits and deletes
• Assignment creation, edits, status changes, and deletes
• Invitations sent, accepted, and revoked
• Access grants and revocations
• Profile lifecycle events (created, published, archived)
• Webhook endpoint and integration token changes
• Denied actions: attempts that were blocked by permissions, flagged with a red denied badge

Every entry carries the actor (who did it), the subject (what it happened to), structured data (including diffs showing what changed), the source (mobile, api, webhook, or system), the IP address, and the user agent (the device or browser used).

Who can see it

Viewing the audit log requires the audit.read permission, held by org admins, business unit admins, and team admins. Members, collaborators, and observers never see it.

Using the page

Open System → Audit log.

• Filters: an event-type dropdown with friendly labels (for example "Assignment status changed" rather than a raw code) plus a free-text filter that matches across actor, subject, and data.
• Counter: "{n} of {total}" shows how many entries match your filters.
• Columns: When, Event (a friendly label badge with detail, plus the raw event type in monospace), Actor (name, falling back to email, phone, or a short id; system actions show "System"), Subject (kind and id), and Source (mobile, api, webhook, or system).
• Load more: the log pages forward as you need older entries.

The event detail dialog

Click any row to open the detail dialog:

• The friendly label and a plain-language detail line, for example "Status changed to in review".
• When, Actor, Source, Event type, Subject, IP.
• A "What happened" per-system breakdown for actions that touched external systems: sign-in identity (Clerk), app install invitations (TestFlight), or infrastructure (Cloudflare), each with its request and response and action badges.
• Warnings when part of an action did not fully succeed.
• A collapsible Raw event JSON block for support escalations.

Assignment-scoped audit

Every assignment has its own Audit tab showing only the entries for that assignment. Use it for claim-level questions ("who changed this status?") without filtering the org-wide log. See Assignment detail.

Impersonation

Platform support staff can impersonate users to diagnose problems, and every impersonated action is recorded in the audit log like any other action, with impersonation start events logged as well. If you ever see activity you do not recognize, the log will show whether it came from a support session.

Use cases

• Dispute resolution. "Who deleted this photo?" Filter by the media item and see the actor, the device, and the exact time.
• Carrier questions. When a carrier asks when documentation was captured or altered, the log plus the immutable submissions give you a defensible answer.
• Security review. Audit access grants, invitation activity, and denied actions to confirm your permission model is holding.
• Integration debugging. Webhook and integration entries show exactly when partner-facing events fired.