Audit Logs: Track Every Action in Your Organization
Audit Logs
Section titled “Audit Logs”Every significant action in your Xplorr organization is recorded in the audit log. Logins, role changes, account connections, credential access — it’s all there. Audit logs help you answer “who did what, when, and from where.”
Accessing Audit Logs
Section titled “Accessing Audit Logs”Navigate to Audit in the left sidebar of your console. Audit logs are visible to users with the Admin role.
What Gets Logged
Section titled “What Gets Logged”Authentication Events
Section titled “Authentication Events”| Action | Description |
|---|---|
user.login | Successful password login |
user.login_2fa | Login completed with TOTP 2FA |
user.login_webauthn | Login via passkey/WebAuthn |
user.signed_up | New account created |
user.email_verified | Email address verified |
user.password_changed | Password updated |
user.password_reset_requested | Password reset email sent |
User Management Events
Section titled “User Management Events”| Action | Description |
|---|---|
user.invite_sent | Invitation email sent to new user |
user.joined | User accepted invitation and joined org |
user.updated | Profile updated |
user.role_changed | User role changed (e.g., member → admin) |
user.deactivated | User account deactivated |
user.access_granted | Cloud account access granted to user |
user.access_revoked | Cloud account access revoked |
user.2fa_reset | An admin reset a member’s second factor |
user.items_reassigned | A departing or demoted user’s owned items moved to someone else |
user.items_kept_admin_only | A departing or demoted user’s owned items were left admin only |
Security Events
Section titled “Security Events”| Action | Description |
|---|---|
user.2fa_enabled | Two-factor authentication enabled |
user.2fa_disabled | Two-factor authentication disabled |
user.webauthn_registered | Passkey/security key registered |
user.webauthn_removed | Passkey/security key removed |
user.webauthn_renamed | Passkey/security key renamed |
session.ip_change_revoked | Session revoked due to IP address change |
SSO Events
Section titled “SSO Events”| Action | Description |
|---|---|
sso.configured | SAML SSO configured for org |
sso.disabled | SAML SSO disabled |
org.sso_domain_verified | Domain ownership verified via DNS TXT record |
sso_login | User logged in via SSO |
Platform Events (Xplorr Staff Only)
Section titled “Platform Events (Xplorr Staff Only)”Xplorr staff are a separate account type from any organization’s roles, bound to one specific staff account, and every action below is logged the same way a customer action is.
| Action | Description |
|---|---|
platform.impersonate | Staff impersonated a user |
platform.org_deleted | Organization deleted |
platform.permissions_changed | A cell in the role permission table was edited |
platform.permissions_reset | The role permission table was reset to defaults |
platform.second_factor_reset | Staff reset a user’s second factor |
platform.staff_added | A new platform staff member added |
platform.staff_removed | A platform staff member removed |
Log Entry Details
Section titled “Log Entry Details”Each audit log entry contains:
| Field | Description |
|---|---|
| Timestamp | When the action occurred (UTC) |
| User Email | Who performed the action |
| Action | The event type (e.g., user.login) |
| Resource Type | Category of the affected resource |
| Resource Name | Name of the affected resource, or the resource type if it has none |
| IP Address | The client’s address, taken from the actual connecting IP rather than a hop in front of it |
| Country, city, region | The country is always recorded when available; city and region depend on your Cloudflare configuration |
| Device, browser, OS | Parsed from the request’s device |
| Source | Where the request came from: web console, API token, MCP server, Slack or Teams bot, or internal/scheduled job |
| Details | Additional context as JSON |
Latitude, longitude and postal code are never stored.
Sensitive Data
Section titled “Sensitive Data”Audit logs automatically redact sensitive values. Any field containing password, token, secret, key, credentials, authorization, or cookie is replaced with [REDACTED] in the details JSON.
Filtering
Section titled “Filtering”Use the filter controls at the top of the audit page:
| Filter | Description |
|---|---|
| Action | Select a specific event type from the dropdown (populated from your actual events) |
| User Email | Search by user email (supports partial match) |
| Date Range | Filter by start and end date |
| Resource Type | Narrow to one category of affected resource |
| Source | Narrow to one request source: web console, API token, MCP server, Slack/Teams bot, or internal/scheduled job |
Filters combine: setting several narrows to entries matching all of them, and the CSV export always respects whatever is currently set.
Pagination
Section titled “Pagination”Audit logs are paginated with configurable page size (default: 50 entries per page). Navigate between pages using the controls at the bottom.
Exporting to CSV
Section titled “Exporting to CSV”Click Export CSV to download audit logs matching your current filters. The export:
- Includes up to 50,000 rows
- Respects every active filter: date range, user, action, resource type and source
- Contains one column per field above, including device, location and source
- Sanitizes fields against CSV formula injection, so a value starting with
=,+,-or@is never treated as a formula when opened in a spreadsheet
Data Retention
Section titled “Data Retention”Audit logs are retained for 90 days. A nightly retention job automatically purges older entries.
To preserve audit logs beyond 90 days:
- Export a CSV from this page every week
- Store exports in your own archival system (S3, Google Cloud Storage, etc.)