Audit: query events and create a JSON copy

Under «Operate» › «Audit» you see your organization's security events: sign-ins, settings changes, phones linked and removed, approvals, application sign-ins, GDPR requests and more.

How do I query?

1. Open «Operate» › «Audit».
2. Use the filters «Event type», «Outcome» («All», «Success», «Failure»), «Actor / UUID», «Subject / UUID», «From» and «To».
3. Choose «Apply filters».

«Events returned by the server, with no edit or delete actions.» Events keep identifiers (of people, sessions, applications), not emails or names.

How do I copy the events?

1. Apply the filters.
2. Choose «Create JSON copy ↗» and confirm with your passkey or phone.
3. Up to 10,000 events of the chosen filters are copied. If the limit is reached, the message says «(partial copy: 10,000 limit reached)»: repeat with a shorter date range.

The copy is sensitive and unsigned: it certifies neither integrity nor completeness. Keep it somewhere protected.

Useful events

Integrity

Each event joins a chain of cryptographic digests in the same transaction. Signed receipts cover approvals. See Receipts and evidence.

Errors

«The copy exceeds the size limit. Narrow the filters.» and «The copy ran out of time. No file was created; narrow the filters.»