> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Track who did what and when across your Layer workspace with a tenant-scoped, immutable audit log retained for six years to satisfy SOC 2 and HIPAA review.

The audit log records every significant action in your Layer workspace — integration connections, asset changes, user role updates, data exports, and more. Every entry is scoped to your organization and immutable once written, so you have a tamper-proof trail for security investigations, compliance audits, and internal reviews.

## What gets logged

Layer automatically records events across these categories:

| Category         | Example events                                                                       |
| ---------------- | ------------------------------------------------------------------------------------ |
| **Integrations** | Connected, disconnected, sync started, sync completed, sync failed, re-auth required |
| **Assets**       | Created, updated, deleted                                                            |
| **Users**        | Invited, role changed, removed                                                       |
| **Contracts**    | Uploaded                                                                             |
| **Exports**      | CSV generated                                                                        |
| **Workspace**    | Settings changed                                                                     |

Each event captures:

* **Who** — the user (or system process) that performed the action, including their email and IP address.
* **What** — the event type, category, action, and whether it succeeded or failed.
* **What it affected** — the resource type, identifier, and a human-readable path.
* **When** — a UTC timestamp.
* **Context** — free-form metadata such as old and new values, affected scopes, or error details.

## View the audit log

Go to **Settings → Audit log** in your Layer dashboard. The log displays the most recent events first and includes columns for time, action, resource, actor, and details.

You can filter events by:

* **Action** — narrow to a specific event type (e.g. `integration.connected`).
* **Search** — free-text search across action names, resource types, and resource identifiers.

## Event types

The following event types are currently tracked. New event types are added as Layer features expand.

<AccordionGroup>
  <Accordion title="Integration events">
    | Event type                    | Description                           |
    | ----------------------------- | ------------------------------------- |
    | `integration.connected`       | A new integration was connected       |
    | `integration.disconnected`    | An integration was removed            |
    | `integration.sync_started`    | A sync cycle began                    |
    | `integration.sync_completed`  | A sync cycle finished successfully    |
    | `integration.sync_failed`     | A sync cycle failed                   |
    | `integration.reauth_required` | An integration needs re-authorization |
  </Accordion>

  <Accordion title="Asset events">
    | Event type      | Description                             |
    | --------------- | --------------------------------------- |
    | `asset.created` | A new asset was added to the inventory  |
    | `asset.updated` | An asset record was modified            |
    | `asset.deleted` | An asset was removed from the inventory |
  </Accordion>

  <Accordion title="User events">
    | Event type          | Description                             |
    | ------------------- | --------------------------------------- |
    | `user.invited`      | A new user was invited to the workspace |
    | `user.role_changed` | A user's role was changed               |
    | `user.removed`      | A user was removed from the workspace   |
  </Accordion>

  <Accordion title="Other events">
    | Event type                   | Description                      |
    | ---------------------------- | -------------------------------- |
    | `contract.uploaded`          | A contract document was uploaded |
    | `export.csv_generated`       | A CSV export was generated       |
    | `workspace.settings_changed` | Workspace settings were modified |
  </Accordion>
</AccordionGroup>

## Data retention

Audit log entries are retained for six years in accordance with HIPAA requirements. Entries cannot be edited or deleted by any user — only automated retention processes remove records after the retention period expires.

## Permissions

All members of your organization can view the audit log. Only the application layer (running with elevated privileges) can write new events. No user can insert, update, or delete audit log entries directly.

<Note>
  The audit log is designed for compliance and investigations. If you need to export audit data for a specific review, use the CSV export on the **Settings → Audit log** page or contact [support@axiomancer.io](mailto:support@axiomancer.io) for bulk export assistance.
</Note>