Audit subsystem

The Audit Subsystem page (route /audit-subsystem) records the API and configuration activity of your organisation: who modified what, when. It is the audit trail of changes made to the organisation itself.

Purpose

While the Authentication audit records sign-in events, the audit subsystem records changes to the organisation’s objects: creating or updating resources, changing users and metadata, revoking tokens, and so on. Each record answers the question who modified what, when. Use this screen to understand the changes made to your organisation, when those changes happened, and who made them.

The audit subsystem is the engine that collects and stores these events; see Audit and diagnostics.

Why use it

Review what changed in the organisation over a time window.
Find out who created, updated, or deleted a resource or user.
Trace when a change happened, for example to correlate with an incident.
Search by connector to see activity behind a specific connector.
Export the records for compliance or analysis.

When to use it

When investigating an unexpected change to a resource or user.
When you need an answer to who did what and when for a security review.
When correlating activity with the Authentication audit and Sessions.

Prerequisite: read permission for the audit subsystem. The page shows a no permissions message otherwise.

How to use it

Open Organisation > Audit Subsystem from the left navigation.
The screen loads the records for the past seven days by default.
To change the window, set Start Time and End Time with the date pickers.
Select VIEW AUDITS to reload the table.
Page through the results with the paginator.
Use the filter menu to narrow by Connector if you have connectors.
Select DOWNLOAD AUDITS to export the current results.

Fields and controls reference

Field or control	Purpose	Required	Default	Valid values	Notes
Start Time	Beginning of the audit window	Yes	Seven days ago	A date and time
End Time	End of the audit window	Yes	Now	A date and time
VIEW AUDITS	Loads the records for the chosen window	n/a	n/a	n/a
DOWNLOAD AUDITS	Exports the current results as CSV	n/a	n/a	n/a
Filter	Narrow the table by Connector	No	None	Connector names	Use the filter menu and type-ahead search

Table columns

Column	Meaning
Timestamp	When the change happened
Type	The kind of object that changed (for example `orgs`, `applicationservices`, `user``metadata`, `tokens`)
Resource	The name or identifier of the object
Action	What happened (for example Create, Update, Delete, Revoke, Introspect)
Email	The person (or service) who made the change

Dialogs and popups

There are no configuration dialogs on this screen. It is a search and review interface.

Configuration versus diagnostics versus confirmation

Configuration: none. This screen only reads audit records.
Diagnostics: the whole screen is diagnostic: a searchable, filterable, exportable change log.
Confirmation: none. There are no destructive actions.

Pagination and async behaviour

The table pages at 25 rows per page and fetches a window of pages at once, so the paginator shows several page numbers even when the current result set is small. Use the page numbers to move through the results.

Records load asynchronously after selecting VIEW AUDITS. When a page contains no further records (for example at the end of the data), the table shows that page empty; return to an earlier page to continue.

Troubleshooting

The table is empty: the default window is the past seven days. Widen the range with Start Time and reload.
A page shows no rows: you have reached the end of the available records; the paginator returns to the first page.
I cannot see changes made by an administrator in a sub-organisation: switch to that sub-organisation with the organisation switcher and review its own audit subsystem, or use the Sub-organisations overview.