Check audit logs

About Audit Logs

The audit log records operations performed in the service. This includes important actions and changes executed within the system. Note that detailed change histories for data are not included in this log. The log tracks actions performed by users and the system, and it is used for security audits and compliance purposes. It records not only user actions but also system operations (such as automatic sync) and API calls. For operations performed on connected SaaS services, refer to the Integration Log in the Integrations menu.

How to Retrieve Audit Logs

You can retrieve audit logs in the following ways:

Settings menu > Audit Log tab
Export as a CSV file with specified conditions

Retrieve audit logs with the API

You can retrieve audit logs as a CSV file with the API. The export runs asynchronously, so follow these steps:

Run Export audit logs csv. The response returns a request ID (requestId).
Run Get requests by requestId with the request ID, and confirm that the export has finished.
Download the CSV file from the URL (downloadUrl) in the response after the export finishes.

You can specify the following parameters for the export:

Parameter	Description
`startDate` / `endDate`	The period to retrieve (required)
`category`	The category of the operation
`actorType`	The type of the actor that performed the operation (`user`, `system`, `api`)
`actorId`	The ID of the user who performed the operation. Required when you set `actorType` to `user`
`locale`	The language of the `description` column in the CSV (`ja`, `en`)

To check the number of logs in advance, run Count audit logs with the same parameters. For API rate limits, see IT Management API rate limits.

Log Retention Period

This audit log is recorded as an operation log for both customers and our company. Logs are retained for a period of three years.

Types of Audit Logs

The audit log primarily stores records of write operations. Read-only actions (such as viewing a page) are not included. Data exports are included. Audit logs are classified into the following categories:

Category	Example Operations
Device-related	Create, update, or delete devices Create, update, or delete device usage history Create, update, or delete device custom fields, etc.
Service-related	Create or delete service accounts Create, update, or delete workspaces Sync workspaces, etc.
Directory-related	Create, update, or delete directories Merge or separate accounts Create, update, or delete custom fields, etc.
Contract-related	Create, update, or delete service contracts Create, update, or delete reminders, etc.
Other	Manage file permissions Manage API keys Manage SAML settings Login history, etc.

A device or directory CSV import creates one audit log entry per import. The audit log does not record a separate entry for each device or ID that the import adds or updates.

Reading the Exported Data (CSV)

Standard Columns

Basic information included in all audit logs:

Field Name	Description
actorType	The type of actor that performed the action (user, system, api)
actorName	The name of the user who performed the action
description	The content of the action
actionTime (UTC)	The time the action was performed (UTC)
result	The result of the action (Success/Failure)
resultReason	The reason for failure, if applicable
category	The category of the action
activity	The specific action performed
ipAddress	The IP address from which the action originated
userAgent	The user agent from which the action originated

Additional Columns

Depending on the type of action, the following additional columns may appear:

For device-related actions
- device ID / device Name: information about the target device
- deviceHistory ID / deviceHistory Name: information about device usage history
- deviceCustomField ID / deviceCustomField Name: information about custom fields, etc.
For service-related actions
- service ID / service Name: information about the target service
- serviceAccount ID / serviceAccount Name: information about the service account
- workspace ID / workspace Name: information about the workspace, etc.
For directory-related actions
- identity ID / identity Name: information about the directory
- people ID / people Name: information about the account
- identityCustomField ID / identityCustomField Name: information about custom fields, etc.

And so on.

If a single action involves multiple targets, additional columns are added for each target.

When you export multiple categories or actions into a single file, additional columns are appended to the right.

Sample Data

The following is sample data:

Introduction

Guides by use case

Guides by feature

Admin settings

FAQ and troubleshooting

About Audit Logs

How to Retrieve Audit Logs

Retrieve audit logs with the API

Log Retention Period

Types of Audit Logs

Reading the Exported Data (CSV)

Standard Columns

Additional Columns

Sample Data

​About Audit Logs

​How to Retrieve Audit Logs

​Retrieve audit logs with the API

​Log Retention Period

​Types of Audit Logs

​Reading the Exported Data (CSV)

​Standard Columns

​Additional Columns

​Sample Data

About Audit Logs

How to Retrieve Audit Logs

Retrieve audit logs with the API

Log Retention Period

Types of Audit Logs

Reading the Exported Data (CSV)

Standard Columns

Additional Columns

Sample Data