Audit trail

Search the organization’s permanent record of who did what, when and from where, by action, severity, source and request.

The audit trail is your organization’s permanent record of every change: who did what, when, and from where. Nobody can edit or delete an audit record, not even UnitX staff. When someone asks months later “who changed this, and when?”, this is where the trustworthy answer is.

Where to find it#

Open Audit trail from the sidebar. The newest records are at the top; select Load more for older ones.

Who can use it#

Permissions

audit.view

By default only the Organization Owner and Organization Admin roles include audit.view. Without it the page says “Not available”. You can add the permission to a custom role in Roles and permissions, for example for a security or compliance lead.

Looking is recorded too

Reading the audit trail is itself an audited action. Each time you load or filter the page, a record with the action audit.accessed is written, containing the filters you used but never the records you saw.

Read a record#

Action: What happened, for example work_item.updated or member.role_changed, shown at the top of the record.
Severity: info, notice, warning or critical.
Category: The standard kind of action: create, update, delete, permission change, login, export, integration disconnect or other.
Actor type: Shown as a badge when the action wasn’t done by a person, for example by an automation or a service account.
Record: The kind of record affected and its ID.
By: The ID of whoever did it, or “no actor recorded”.
Changes: For each field that changed, the old value struck through and the new value after an arrow.
from: Where the action came from: web, mobile, api, webhook, automation, import, integration or system. “not recorded” means the record predates this detail or was raised outside any request, such as a scheduled job.
ip: The internet address the action came from, when known.
request: An ID shared by every record one request produced.

Values under names like password, secret, token or key are replaced with [redacted] before anything is written. The field name stays, so you can still see that a secret was part of a change.

Find what you need#

Set the filters
Choose any combination of:
- Action: Any action or a category, such as permission change, delete or export.
- Severity: Any severity, info, notice, warning or critical.
- Came from: Anywhere, or web, mobile, api, webhook, automation, import, integration or system.
- Request id: paste a request ID to see everything that one request did.
Apply them
Select Apply filters. The list only reloads when you apply, so you can set several filters at once. Select Clear to remove them all.
Page back through time
Select Load more at the bottom to add older records.

Useful searches#

Question	Filters
Who changed permissions?	Action: permission change
What was deleted?	Action: delete
Who exported data?	Action: export
What came in through the API rather than the app?	Came from: api
What did automations change?	Came from: automation
What needs attention now?	Severity: critical (then warning)
Everything one bulk change touched	Request id: the request shown on any one of its records

Tip

When a single action changed several records at once, open any one of its records, copy the request value, and paste it into Request id. That’s the fastest way to see the whole change together.

What is recorded#

Creating, changing and deleting records across UnitX, with before-and-after values.
Changes to roles, permissions and memberships.
Sign-ins, exports and integration disconnections.
Actions taken by automations, integrations, imports and service accounts, marked with their actor type and source.
Decisions made on someone’s behalf, such as a delegated approval, name both people.
Reads of fields classified as Restricted, recorded as sensitive_data.accessed with the field names and number of records, never the values.
Every visit to the audit trail itself.

Where you personally signed in from is not in the organization’s audit trail. That is on your own sessions and login history page.

How long records are kept#

Audit records can’t be edited or deleted by anyone. They are removed only when a retention policy set by your administrators says they are old enough, or when the organization itself is deleted. A legal hold stops even that. Retention policies and legal holds are managed in Governance.

Limitations#

The page shows IDs for people and records rather than names.
There is no export button and no date filter on this page. Filtering by entity, actor, exact action or date range is available through the UnitX API.

Audit trail or Activity?#

Activity is the story of a record for the team working on it, and most members can see it. The audit trail is the organization’s stricter account, with source, IP address, request and field-level changes, and is restricted to audit.view.

Questions#

Can a record be corrected or removed?

No. There is no way to edit an audit record. Records leave only through a retention policy or organization deletion, and a legal hold blocks even that.

Why does a record say “from: not recorded”?

It either predates UnitX recording where actions come from, or it was raised outside any request, such as by a scheduled job. UnitX shows that rather than guessing.

Are passwords or keys ever stored here?

No. Sensitive values are replaced with [redacted] before the record is written.

Why are there so many audit.accessed records?

Every load of this page, and every Load more, is recorded. That’s expected.

Still stuck? Search the docs with ⌘K, open Help inside UnitX, or contact support.