> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Security audit trail of key actions taken in your organization.

> [!NOTE]
>
> Admin-only. Records security-sensitive actions for 90 days. Read-only by design (no edit, no delete). For longer retention, contact support.

# Audit log

The audit log records key security-sensitive actions taken in your org. Built for admins who need to trace who did what, when, and from where.

Navigate to **Settings > Audit Log** to view the log. **Admin access is required.**

## What is logged

| Action | Description |
| - | - |
| `member.invite` | A new team member was invited |
| `member.remove` | A team member was removed from the organization |
| `role_change` | A member's role was changed |
| `delete` | A product, score, or account resource was deleted |
| `impersonate` | An admin impersonated another user (dacard\_admin only) |
| `account.update` | Organization name or settings were changed |
| `api_key.create` | A new API key was created |
| `api_key.delete` | An API key was deleted |
| `sso.enforce` | SSO enforcement was enabled or disabled |

## Reading the log

Each entry shows:

| Field | Description |
| - | - |
| **Time** | When the action occurred |
| **User** | The user ID who performed the action |
| **Action** | The action type (color-coded by severity) |
| **Resource** | The resource type and ID affected (if applicable) |
| **IP** | The IP address the action originated from |

Action badges are color-coded:

* **Red** destructive actions (delete)
* **Amber** elevated privilege actions (impersonate)
* **Purple** role changes
* **Green** standard administrative actions

## Retention

Audit log entries are retained for **90 days**. Entries older than 90 days are automatically removed. If you need longer retention for compliance purposes, contact [support@dacard.ai](mailto:support@dacard.ai).

## Access control

Only users with the `dacard_admin` role or account `admin` role can view the audit log. Members and leads do not have access.

> [!NOTE]
>
> The audit log is read-only. Entries cannot be modified or deleted this is by design for security integrity.

> **[Roles & Permissions](https://docs.dacard.ai/rbac.md)**
>
> Understand who can access the audit log and perform sensitive actions.

> **[SSO](https://docs.dacard.ai/knowledge-base/sso.md)**
>
> SSO enforcement events appear in the audit log.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.