Audit log

arcodash keeps an append-only audit log of administrative and security-relevant actions in your organization. Reading it requires admin access.

What’s recorded

Every event carries:

Field	Meaning
action	What happened, e.g. user.disabled, group.role_attached (full list below).
user_id	Who did it. null for system-driven events, or a failed login where the account could not be identified.
object_type / object_id	What it happened to, e.g. "group" / 42. null only for a failed login, which has no identified target.
additional_properties	Action-specific detail as JSON, for example, group.member_added records the user_id that was added.
created_at	When it happened.

Actions recorded today (the log is broader than administration):

• Users: user.invited, user.invitation_resent, user.invitation_revoked, user.updated, user.disabled, user.api_key_regenerated, user.api_keys_revoked, user.password_changed, user.groups_synced
• Sign-in: user.login, user.login_failed, user.logout
• Groups: group.created, group.updated, group.deleted, group.member_added, group.member_removed, group.data_source_assigned, group.data_source_removed, group.data_source_access_restricted_set, group.role_attached, group.role_detached
• Roles and permissions: role.created, role.updated, role.deleted, permission.granted, permission.revoked, object.visibility_changed
• Connectors: data_source.created, data_source.updated, data_source.deleted, data_source.paused, data_source.resumed
• Dashboards: dashboard.created, dashboard.updated, dashboard.layout_saved, dashboard.published, dashboard.unpublished, dashboard.discarded, dashboard.archived, dashboard.share_token_minted, dashboard.link_rotated, dashboard.link_revoked
• Queries and visualizations: query.created, query.updated, query.published, query.unpublished, query.discarded, query.reverted, query.restored, query.forked, query.deleted, query.result_downloaded, query.executed, query.execution_failed, query.execution_cancelled, visualization.created, visualization.updated, visualization.deleted, widget.created, widget.updated, widget.deleted
• Monitors: monitor.created, monitor.updated, monitor.deleted, monitor.muted, monitor.unmuted, monitor.snoozed, monitor.snooze_cleared, monitor.acknowledged, monitor.state_changed, monitor.escalated
• Notifications: destination.created, destination.updated, destination.deleted, destination.tested, notification.delivery_failed
• Schedules and runs: schedule.created, schedule.updated, schedule.deleted, run.triggered, run.result_downloaded
• Embeds and public links: embed.created, embed.revoked, embed.public_paused, embed.public_resumed
• Organization and AI settings: organization.updated, plus ai_settings.* events for provider keys, model, budget, and feature toggles

What’s not recorded

The audit log is not a complete history of everything. Read-only activity such as viewing a dashboard or browsing a query is not recorded, and neither is accepting an invitation or creating an organization.

For a query’s own version history, see Versions, drafts, and publishing; that is per-query, not a searchable organization-wide log.

Filtering

The audit log is paginated (page, page_size, capped at 250 per page, 25 by default) and can be filtered by any combination of:

• user_id: everything one person did.
• action: every occurrence of a specific action, e.g. all group.role_attached events.
• object_type: every event against a given kind of object, e.g. all "data_source" events.

Combine filters to narrow further; user_id + object_type answers “what did this admin do to connectors,” for example.

Where to go next

• System status, the operational counterpart to the audit log, for what’s happening right now rather than what already happened.
• Data handling & privacy, what arcodash stores, caches, and encrypts, including what an audit entry does and doesn’t contain.