Audit Log
The Security audit log records changes to access in your organization: who changed an access policy, who created or revoked an API key, and what API keys did.
Who can use this: organization admins. Open Settings from your avatar menu, then Security → Audit Log.
Querri keeps two audit logs. This is the security one. Plan, payment and subscription changes are in the separate billing audit log, under Billing & Usage → Audit.
- Action: what happened.
- Actor: who did it.
- Target: what it happened to.
- IP Address: where the request came from.
What’s recorded
Section titled “What’s recorded”| Area | Actions |
|---|---|
| Access policies | policy.create, policy.update, policy.delete, policy.assign_user, policy.unassign_user |
| API keys | api_key.create, api_key.revoke, and api_key.use, at most once a minute per key |
| Admin permission grants | permission.admin_grant, permission.admin_revoke |
| Skills | skill.* |
Calls made with an API key add more: data reads, queries and questions (data.read, data.query, data.ask), and public API changes to permissions, projects, files, users, views and embed sessions. For dashboards, public API updates and refreshes are recorded (dashboard.update, dashboard.refresh).
Some things aren’t recorded. Opening a dashboard, exporting, and sharing from inside the web app don’t appear here.
The action badge prints the stored name with a capital letter, such as “Policy.create”.
The table
Section titled “The table”Events load 50 at a time. Load More shows how many you’ve loaded out of the total.
| Column | What it shows |
|---|---|
| Timestamp | When it happened |
| Actor | Who did it, or System |
| Action | What happened |
| Target | What it happened to |
| IP Address | Where the request came from |
Click a row to open Audit Event Details. Along with the columns above, it shows the event ID, the actor and target types, the target ID, and the full Details as JSON.
- Actor Type: what kind of actor made the change.
- Details: the full event, as JSON.
Filter the log
Section titled “Filter the log”Pick an Actor by searching their name or email, set a Start date and an End date, then click Apply. Clear removes the filters.
When there’s nothing to show, the tab reads No Audit Events.
Next steps
Section titled “Next steps”- Access Policies: the policy changes recorded here
- API Keys: key creation, use and revocation
- Billing audit log: plan and payment changes