Audit Logs
See who did what, when and in which project in a Qualflare workspace audit log, with its columns, actor types, filters and who can view it.
Reviewed by Qualflare Team on
Last updated
This page lists every column, actor type and filter of the Qualflare workspace Audit Logs page, which records who did what, to which resource and when; workspace Maintainers and Owners on Scale, Enterprise and Open Source can open it.
Audit logs at a glance
| Fact | Detail |
|---|---|
| Where | Workspace sidebar > Administration > Audit Logs |
| Plan | Scale and above (available on Scale, Enterprise, Open Source) |
| Who | Maintainer+ · workspace (requires the Maintainer role or higher in the workspace) |
| Covers | Every project in the workspace |
| Export | None: the page has no export |
Audit Logs are a workspace-level feature. They record actions across all projects in the workspace.
Why audit logs matter
An audit log is a chronological record of significant actions taken across a workspace — who did what, to which resource, and when. Where a defect or a launch tells you about your product's quality, an audit log tells you about your workspace's own activity: configuration changes, membership changes, and administrative actions.
Audit logs exist for three main reasons:
- Compliance — many regulated industries require a record of who changed what and when, independent of any single team member's memory or Slack history.
- Security investigations — if something unexpected changes (a permission, an integration, a deleted resource), the audit log is the source of truth for tracing it back to an actor and a timestamp.
- Workspace history — for any team, understanding how settings or membership evolved over months is otherwise easy to lose track of.
Accessing audit logs
Navigate to the workspace sidebar and click Audit Logs.
Plan and role requirements
Audit Logs are included on the Scale, Enterprise and Open Source plans. On other plans, the page shows an upgrade prompt.
Only workspace Maintainers and Owners see Audit Logs in the sidebar and can open it. Other members who open the page see Admin access required.
Log entry fields
The log is a table with these columns:
| Column | Description |
|---|---|
| Date | When the action happened. Hover to see how long ago. |
| Actor | Who performed the action. A badge marks actors that aren't users. |
| Project | The project the action belongs to. Workspace-level actions show a dash. |
| Event | The action taken, such as created, updated or deleted |
| Type | The kind of resource affected, such as Case, Suite or Defect |
| Resource | The name of the affected resource. Hover to see its ID. |
An actor is one of these types:
| Actor type | Who it is |
|---|---|
| User | A workspace member |
| API Token | A project access token, such as one used by the qf CLI or an MCP client |
| Admin | Qualflare staff |
| System | An automated operation |
| SCIM | Directory sync from your identity provider. It shows as a badge, but the Actor Type filter doesn't offer it. |
What gets logged
Each entry records the actor (a user, an API token, Qualflare staff, SCIM directory sync, or the system for automated operations), the event (such as created, updated or deleted), the type and resource affected, the project where there is one, and the date. You can filter entries by actor type, action, resource type, ID and date range, and search them.
Audit logs are a workspace-level feature — they cover activity across every project in the workspace, not just one.
- Opening the audit log is itself recorded, as a viewed event on the audit log.
- Sign-ins aren't recorded in the workspace audit log.
Filtering logs
Filter the audit log by:
- Actor Type: User, API Token, Admin or System
- Action: an action, such as Create, Update or Delete
- Resource Type: the kind of resource affected
- Actor ID, Project ID and Resource ID: an exact ID
- From and To: a date range
- Search: text in the actor's name or the resource name
Actor Type, Action and Resource Type each filter by one value. If you select more than one, only one of them is applied.
You can sort by Date or Resource. In the default order (newest first), select Load more at the end of the list to see older entries. Other sort orders show only the first page.
Log retention
Each entry stays in the audit log for 365 days, then Qualflare removes it from the log automatically. The period is the same on every plan, and you can't change it.
Related
- Reference: Roles and permissions · Plans and limits · Single Sign-On · SCIM Provisioning
- Guides: Workspaces and Workspace Settings
- Security: Logging and monitoring controls, and who owns each one
SCIM Provisioning
Let your identity provider add, update and remove Qualflare workspace members over SCIM 2.0, with a one-time token and your SSO role rules.
Plans and limits
What each Qualflare plan includes, from project, member and launch limits to AI allowances and features, plus the free trial and how to change plans.