# Audit log
URL: https://synquic.tech/docs/guides/audit-log.md

See who changed what in your workspace, from the dashboard, the CLI, the API, an AI agent or Synq itself. Filter the log, open an entry for the before and after, and choose how long entries are kept.

The audit log records every change made in a workspace: deploys, domain and certificate changes, members and
access, server operations, settings, sign-in security and what AI agents did. Each entry says who did it, when,
from where, and what changed.

## Open it

Choose **Audit log** at the bottom of the sidebar (under **Settings**), or go to `/audit` on your panel.

**Who can read it:** workspace **owners** and **admins**, and restricted members who were granted the **Audit log**
resource. Members don't see entries. See [Permissions and roles](/docs/security/permissions).

## Find an entry

- **Category tabs** across the top: **All**, **Deployments**, **Apps & services**, **Domains & SSL**, **Servers**,
  **Members & access**, **AI agents**, **Security**, **Billing** and **System**, each with its count. **Billing** is
  normally empty on your own server, since hosted billing is switched off in Synq.
- **Search** ("Search apps, servers, domains, people…") matches events, actors and resources.
- **Anyone** narrows the log to one person.
- **Period**: **All time**, **Today**, **Last 7 days**, **Last 30 days** or **Last 90 days**.
- **Source**: **Everything**, **Dashboard**, **AI assistant**, **CLI**, **API**, **Webhook** or **System**. With **AI
  assistant**, a second filter picks one agent (**Any agent**, or a connected client with its number of events).
- **Clear filters** resets everything. The filters live in the page address, so you can bookmark or share a view.

Entries are grouped by day (**Today**, **Yesterday**, then dates), and a line such as "Showing 1-50 of 320" tells
you where you are in the results.

## Read an entry

Open an entry to see:

| Field | What it shows |
| --- | --- |
| **Who**, **Email** | The person, or **System** for Synq's own jobs |
| **Came from** | Dashboard, CLI, API, webhook, AI assistant or system |
| **Agent** | The AI client, when an agent made the change |
| **When** | The exact time |
| **IP** | The address the request came from |
| **Resource** | What was changed |
| **Changes** | **Before** and **After** for every field that changed, and **Removed** values |
| **Technical details** | The **Event type** (for example `server.docker_cleanup`), the resource **Type** and **ID**, the **User ID** and the **User agent** |

A few events from running your server, as they appear in the log:

| Event | When |
| --- | --- |
| **Docker cleanup** | A cleanup removed images, containers, build cache or volumes (by hand or on schedule). The details list the items and bytes freed. |
| **Docker cleanup schedule changed** | The schedule, scope or servers of the scheduled cleanup changed. |
| **Panel backup settings changed** / **Panel backup started** | The panel backup settings changed, or someone pressed **Back up now**. |
| **Certificate contact email changed** | The Let's Encrypt contact email was set or cleared. |

To see what one AI agent did, open **Settings**, **MCP** and press **Activity** on that client: it opens the log
filtered to it.

## Choose what is kept

At the top of the page:

- **Record activity** turns recording on or off for the workspace. It is on by default. While it is off, nothing new
  is added and the page says so; existing entries stay.
- **Keep entries for**: 7, 30, 90, 180 or 365 days. The default is 90 days. The built-in job **Audit log prune**
  deletes older entries every day.

Only owners and admins can change these two settings ("Only owners and admins can change this.").

## From the API

| Call | What it does |
| --- | --- |
| `GET /api/audit` | List entries, with the same filters as the page |
| `GET /api/audit/facets` | The counts behind the tabs and filters |
| `GET /api/audit/settings` | Whether recording is on, and the retention |
| `PATCH /api/audit/settings` | Change them: `{ "enabled": true, "retentionDays": 180 }` |

Reading needs `audit:read`; changing the settings needs `audit:write`. See the [Audit API](/docs/api/audit).

## Related guides

<Cards>
  <Card title="Teams and members" href="/docs/guides/teams-members" description="Who can do what in a workspace." />
  <Card title="MCP" href="/docs/mcp" description="Connect AI agents, and see what they did." />
  <Card title="Two-factor authentication" href="/docs/guides/two-factor" description="Protect every login with a second step." />
</Cards>