Audit Log

CompassDocs keeps an append-only audit log of significant actions, so admins can answer “who changed this, and when?” Find it under Settings → Audit log (admins only).

What’s recorded

Each entry captures the actor (and their role), the action, the target, the time, and the client IP address. Logged actions include:

Authentication — sign-in, sign-out, failed sign-in attempts (from 1.16.0 including a wrong two-factor code, with stage: two_factor, and a wrong current password when changing a password, with via: change_password), and login lockouts from the throttle (auth.lockout). When the sign-in page’s email-first lookup hits its limit, one auth.lookup_throttled entry per address and window; single lookups are not logged. From the 1.16.0 Enterprise image, a first single sign-on that could not be linked to an existing account is recorded as Refused a single sign-on link (auth.sso_link_refused), with the cause and the account that blocked it (see How accounts are matched).
User management — creating users, role changes, password resets, and enabling, disabling, or deleting accounts; from 1.16.0 also setting or confirming an account’s email (Changed email).
Content — creating, editing, publishing, and deleting documents; submitting changes for review; and approving or rejecting change requests.
Versioning — restoring a previous version, and creating or merging draft branches (each entry records which version or branch was involved).
Comments — posting a comment (with who was mentioned) and removing one (including whether it was an admin moderation).
Spaces — creating, editing, and deleting spaces.
Handbooks: from 1.18.0, every change to a policy handbook: Created handbook (handbook.created), Edited handbook (handbook.updated), Changed handbook contents (handbook.contents_changed), Changed where people find a document (handbook.find_mode_changed, shown as “Changed where people find a policy” before 1.18.2), Published handbook (handbook.published), Unpublished handbook (handbook.unpublished) and Deleted handbook (handbook.deleted), plus Printed handbook (handbook.printed) for every print and Confirmed handbook (handbook.confirmed) when someone confirms a whole handbook. Each policy confirmed from a handbook is a document.acknowledge entry like any other, with via: "handbook" and the handbook’s id. From 1.18.2 a handbook created or changed through the Claude connector (handbook.created, handbook.contents_changed, handbook.find_mode_changed) carries via: "mcp" in its details, with the caller’s IP address.
Links: creating, editing and deleting quick links and uploading their icons, and from 1.17.0 where a link appears: Featured link on the dashboard (link.dashboard_featured), Removed link from the dashboard (link.dashboard_unfeatured), Added link to the sign-in page (link.signin_shown) and Removed link from the sign-in page (link.signin_hidden, with reason: restricted_to_groups when restricting the link to groups took it off). Turning these on or off is recorded only as these entries, not as an edit. People’s own dashboard pins and link clicks are not logged.
Settings — workspace and appearance, approval mode, custom domain & HTTPS, the AI model and key, and backup destinations; the logo and, from 1.16.0, the sign-in page (uploading or removing its artwork, and saving its text, with the fields changed).
Compliance — read confirmation requests, reminders, re-asks, exports, retirements, from 1.13.0 audiences, deadlines, exemptions, extensions and snoozes, one entry per person, and from 1.14.0 snapshots and audit packages, the scheduled report, a person’s record export, policy sets, a lead’s reminder and one summary row per bulk action; the keys are listed on the read confirmation page.
Helpdesk (Enterprise, from 1.19.0): every change to the helpdesk’s configuration, under the helpdesk category. Teams (helpdesk.team.created, .updated, .deleted, .members_changed, .calendar_changed, .sla_updated, .sla_reset); calendars and holidays (helpdesk.calendar.*, helpdesk.holiday_set.*); request types (helpdesk.request_type.created, .updated, .deleted, .reordered); workflows (helpdesk.workflow.created, .updated, .published, .draft_discarded, .deleted, .test_run) and runs (helpdesk.workflow_run.step_retried, .step_skipped, .cancelled); decisions and grants (helpdesk.approval.approved, .declined, helpdesk.space_access.granted, the read access a Request access approval gives); reply targets and settings (helpdesk.sla.updated, helpdesk.settings.updated, helpdesk.setup.starter, helpdesk.inbound.secret_rotated; contact card settings are a helpdesk.settings.updated entry too); automations and macros (helpdesk.automation.created, .updated, .deleted, .reordered; helpdesk.macro.created, .updated, .deleted); desk roles and reviews (helpdesk.agent_role.assigned, .changed, .removed, helpdesk.roles.updated, .reset, helpdesk.reply.reviewed); assignment (helpdesk.assignment.team_updated, .member_paused, .rule_created, .rule_updated, .rule_deleted, .rules_reordered, .on_call_updated); integrations (helpdesk.integration.created, .updated, .deleted, .key_rotated); reports (helpdesk.dashboard.created, .updated, .deleted, helpdesk.report_schedule.created, .updated, .deleted, helpdesk.report.exported); and deleted tickets (helpdesk.ticket.deleted). Refused mail and alerts are recorded too: Rejected helpdesk email (helpdesk.inbound.rejected) and Rejected an alert or API ticket (helpdesk.intake.rejected). Ticket replies, notes and status changes are on the ticket’s own timeline, not in the audit log. From 1.19.1 the category also holds merges and bulk edits (helpdesk.ticket.merged, .bulk_updated), CCs and followers (helpdesk.ticket.cc_added, .cc_removed, .follower_added, .follower_removed), saved views (helpdesk.view.created, .updated, .deleted), shortcuts and retention (helpdesk.shortcuts.updated, helpdesk.retention.updated, helpdesk.ticket.auto_closed, .anonymised, .deleted_by_retention, .legal_hold_set, .legal_hold_cleared), the customer portal (helpdesk.portal.updated, .contact_blocked, .contact_unblocked, .signin), imports (helpdesk.import.started, .completed, .cancelled), recurring tickets (helpdesk.recurring.created, .updated, .deleted, .run), time tracking (helpdesk.time.logged, .edited, .deleted, .exported, helpdesk.team.time_setting_changed), and what people do through the Claude connector (helpdesk.request.created, .request.replied, .note.added, .ticket.updated, .reply_draft.created, each with via: "mcp", and helpdesk.reply_draft.used, .discarded). From 1.19.2 it also holds major incidents (helpdesk.incident.*), team status services (helpdesk.team_status.*), skills and languages (helpdesk.skills.*, helpdesk.ticket.language_changed), checklists (helpdesk.checklist_template.*, helpdesk.checklist.*), canned responses (helpdesk.canned.*), portal ratings (helpdesk.portal.csat, shown as Customer portal), import checks (helpdesk.import.check_started, .check_stopped) and Saw what’s new in the desk (helpdesk.whats_new.seen). From 1.19.3 it also holds assets: the Snipe-IT settings (helpdesk.assets.settings_changed, .disconnected, .synced), assets linked to and unlinked from tickets (helpdesk.asset.linked, .unlinked) and maintenance records logged on a solve (helpdesk.asset.maintenance_logged, .maintenance_failed). From 1.19.4 it also holds chat apps (helpdesk.chat.*), API tokens and webhooks (helpdesk.api_token.created, .revoked, every API call as helpdesk.api.call, helpdesk.reply.added and helpdesk.webhook.*; successful API reads at most once a minute per token and route), the help centre (helpdesk.portal.help_centre_updated), Intune (helpdesk.assets.intune_on, .intune_off, .intune_synced, .intune_source_changed), the desk’s appearance (helpdesk.appearance.*), sharing and printing tickets (helpdesk.ticket.shared, .printed) and the recycle bin (helpdesk.ticket.binned, .restored, .purged, .bulk_binned, .bulk_restored, .bulk_purged, .purged_by_sweep; retention’s helpdesk.ticket.deleted_by_retention now reads Moved old helpdesk tickets to the recycle bin). From 1.20.0 it also holds Claude in the desk: every question as Asked Claude in the desk (helpdesk.claude.chat, with the ticket number, model, token counts, tools used and estimated cost, never the question or the answer), every Apply or Skip on a suggestion as Decided on a suggestion from Claude (helpdesk.claude.card), and changes and checklists applied from a suggestion as helpdesk.ticket.updated and helpdesk.checklist.added with via: "claude_desk" (via Claude in the desk). A person’s data export is Exported a person’s data (user.personal_data_exported).
Email templates (from 1.19.0): Created, Edited, Deleted and Reset email template part (email_template.part_created, .part_updated, .part_deleted, .part_reset), Changed default email template part (email_template.default_changed), Changed email template parts (email_template.composition_updated, an email’s choice of parts) and Removed team email template (email_template.composition_removed).
Notification policy (from 1.19.0): Changed the notification policy (notification.policy_updated), with the events changed.
Backups — creating, deleting, and restoring backups.

What’s not recorded

Reads. Viewing or searching documents isn’t logged, to keep the log focused on changes rather than noise.
Secrets. API keys, connection strings, and passwords are never written to the log — only the fact that they were set or changed.

Using it

The log is newest-first and paginated. Use the category filter to narrow to a single area (auth, user, document, settings, backup, …), the From/To date pickers to scope a window (dates are UTC days), and Refresh to pull the latest events. Entries are retained for the life of the database and are included in backups, so restoring a backup restores its audit history too.

Exporting (Enterprise)

With an enterprise license, the audit screen gains Export CSV and JSON buttons that download the log with whatever category and date filters are active. Exports stream in batches, so even years of history download without straining the server — and each export is itself recorded in the log (audit.export, including the filters used).

The same export is scriptable for compliance pipelines via GET /api/admin/audit/export (admin session required):

format — csv (RFC 4180-quoted) or json (a single array).
category — optional; the part before the first dot (e.g. auth, user).
from / to — optional ISO dates or timestamps; date-only values cover the whole UTC day.

Without an enterprise license the endpoint answers 402, and the buttons show as unavailable.

CompassDocs service status