# Audit Logs Source: https://docs.qualflare.com/docs/administration/audit-logs · Last updated: 2026-10-27 See who did what, when and in which project in a Qualflare workspace audit log, with its columns, actor types, filters and who can view it. This page lists every column, actor type and filter of the Qualflare workspace **Audit Logs** page, which records who did what, to which resource and when; workspace Maintainers and Owners on Scale, Enterprise and Open Source can open it. ## Audit logs at a glance | Fact | Detail | | ---------- | ----------------------------------------------------------- | | **Where** | **Workspace** sidebar > **Administration** > **Audit Logs** | | **Plan** | (available on Scale, Enterprise, Open Source) | | **Who** | (requires the Maintainer role or higher in the workspace) | | **Covers** | Every project in the workspace | | **Export** | None: the page has no export | > **Note:** Audit Logs are a workspace-level feature. They record actions across all projects in the workspace. ## Why audit logs matter An **audit log** is a chronological record of significant actions taken across a workspace — who did what, to which resource, and when. Where a defect or a launch tells you about your product's quality, an audit log tells you about your workspace's own activity: configuration changes, membership changes, and administrative actions. Audit logs exist for three main reasons: * **Compliance** — many regulated industries require a record of who changed what and when, independent of any single team member's memory or Slack history. * **Security investigations** — if something unexpected changes (a permission, an integration, a deleted resource), the audit log is the source of truth for tracing it back to an actor and a timestamp. * **Workspace history** — for any team, understanding how settings or membership evolved over months is otherwise easy to lose track of. ## Accessing audit logs Navigate to the workspace sidebar and click **Audit Logs**. *Figure: A badge marks actors that aren't users, such as an API token.* ## Plan and role requirements > **Warning:** Audit Logs are included on the Scale, Enterprise and Open Source plans. On other plans, the page shows an upgrade prompt. Only workspace Maintainers and Owners see **Audit Logs** in the sidebar and can open it. Other members who open the page see **Admin access required**. *Figure: On Starter and Core, Audit Logs shows an upgrade prompt.* *Figure: Members below Maintainer see Admin access required.* ## Log entry fields The log is a table with these columns: | Column | Description | | ------------ | ----------------------------------------------------------------------- | | **Date** | When the action happened. Hover to see how long ago. | | **Actor** | Who performed the action. A badge marks actors that aren't users. | | **Project** | The project the action belongs to. Workspace-level actions show a dash. | | **Event** | The action taken, such as created, updated or deleted | | **Type** | The kind of resource affected, such as Case, Suite or Defect | | **Resource** | The name of the affected resource. Hover to see its ID. | An actor is one of these types: | Actor type | Who it is | | ---------- | ---------------------------------------------------------------------------------------------------------------- | | User | A workspace member | | API Token | A project access token, such as one used by the `qf` CLI or an MCP client | | Admin | Qualflare staff | | System | An automated operation | | SCIM | Directory sync from your identity provider. It shows as a badge, but the **Actor Type** filter doesn't offer it. | ## What gets logged Each entry records the **actor** (a user, an [API token](https://docs.qualflare.com/docs/api/access-tokens), Qualflare staff, SCIM directory sync, or the system for automated operations), the **event** (such as created, updated or deleted), the **type** and **resource** affected, the **project** where there is one, and the **date**. You can filter entries by actor type, action, resource type, ID and date range, and search them. Audit logs are a workspace-level feature — they cover activity across every project in the workspace, not just one. * Opening the audit log is itself recorded, as a **viewed** event on the audit log. * Sign-ins aren't recorded in the workspace audit log. ## Filtering logs Filter the audit log by: * **Actor Type**: User, API Token, Admin or System * **Action**: an action, such as Create, Update or Delete * **Resource Type**: the kind of resource affected * **Actor ID**, **Project ID** and **Resource ID**: an exact ID * **From** and **To**: a date range * **Search**: text in the actor's name or the resource name **Actor Type**, **Action** and **Resource Type** each filter by one value. If you select more than one, only one of them is applied. You can sort by **Date** or **Resource**. In the default order (newest first), select **Load more** at the end of the list to see older entries. Other sort orders show only the first page. *Figure: Actor Type, Action and Resource Type each filter by one value.* ## Log retention Each entry stays in the audit log for 365 days, then Qualflare removes it from the log automatically. The period is the same on every plan, and you can't change it. ## Related * **Reference:** [Roles and permissions](https://docs.qualflare.com/docs/administration/roles-permissions) · [Plans and limits](https://docs.qualflare.com/docs/administration/plans#features-by-plan) · [Single Sign-On](https://docs.qualflare.com/docs/administration/sso) · [SCIM Provisioning](https://docs.qualflare.com/docs/administration/scim) * **Guides:** [Workspaces and Workspace Settings](https://docs.qualflare.com/docs/administration/workspaces) * **Security:** [Logging and monitoring controls](https://docs.qualflare.com/docs/security/control-ownership#logging-and-monitoring), and who owns each one