> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> Audit logs in Authlete provide a detailed record of security-related events and system activities performed by users and system actors.

# Audit Logs User Guide

Audit logs in Authlete provide a detailed record of security-related events and system activities.\
They help administrators understand what happened, who performed it, and when and where it occurred.

***

## Overview

Authlete audit logs capture operations such as creating or deleting organizations, services, clients, tokens, and other key events.\
All actions — whether performed directly by a **user** or automatically by a **system actor (service principal)** — are recorded in a single, unified audit trail.

***

## User Types

Each audit log entry identifies the user responsible for the action.

| User Type             | Description                                                                                                                                                                                                  |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **User**              | A human user performing actions through the Authlete Console or APIs.                                                                                                                                        |
| **Service Principal** | A system-level or non-human actor that performs automated or background operations on behalf of the platform. Service principals represent trusted internal services such as migration or cleanup processes. |

Audit logs clearly distinguish between user and service principal activities, ensuring visibility into both human and automated operations.

***

## Viewing Audit Logs

Audit logs can be viewed in the Authlete Management Console or accessed via the Authlete API.

### How to View Audit Logs in the Management Console

1. Log in to the [Authlete Management Console](https://console.authlete.com/)
2. Choose your Organization name.
3. Navigate to **Organization Settings > Audit Logs**

Once you reach the logs page, you can view the following information:

| Log Information | Description                                                  |
| --------------- | ------------------------------------------------------------ |
| Event Type      | The category of the recorded event                           |
| Status          | Indicates whether the event completed successfully or failed |
| Date            | Timestamp of the event                                       |
| User            | The user or service principal that performed the action      |

***

## Log Filtering

Audit logs can be filtered to help you locate specific entries quickly.

* **Event Type Filter:** Show only a specific category of events (e.g., `Security Login`, `User Delete`, `Client Update`).
* **Status Filter:** Display only completed or failed events.
* **Date Range Filter:** View logs within a selected time period.
* **Free-text Search:** Find logs containing specific terms or identifiers.

![Audit logs filters](https://storage.googleapis.com/authlete-website/resources/kb/audit-logs/3.png)

*Audit Logs Filters*

***

## Understanding Log Entries

When you select an event, the log entry is displayed in JSON format showing key information about the recorded activity.

![Audit logs entry example](https://storage.googleapis.com/authlete-website/resources/kb/audit-logs/2.png)

*Audit Log Entry Example*

Each audit log entry may include the following fields:

| Log Field       | Type   | Description                                                                                                 |
| --------------- | ------ | ----------------------------------------------------------------------------------------------------------- |
| Event           | String | The type of event recorded                                                                                  |
| Status          | String | Status of completion (`success` or `fail`)                                                                  |
| Timestamp       | String | Time of the event                                                                                           |
| Cluster         | String | The environment or server group targeted (e.g., `us.authlete.com`, `jp.authlete.com`, `login.authlete.com`) |
| Path            | String | The API endpoint or system path involved                                                                    |
| Remote Address  | String | IP address of the user performing the action                                                                |
| User Agent      | String | The web browser or system client used to perform the action                                                 |
| User Type       | String | Indicates whether the actor is a `user` or `service_principal`                                              |
| User Identifier | String | The unique identifier of the actor (e.g., user email or service principal ID)                               |
| Details         | Object | Additional context such as Organization ID, Service ID, or other relevant metadata                          |

***

## User Event Types

User event types describe activities performed directly by human users through the Authlete Console or APIs.

| Event Name                | Description                                                                  |
| ------------------------- | ---------------------------------------------------------------------------- |
| Organization Create       | An organization was created                                                  |
| Organization Delete       | An organization was deleted                                                  |
| Organization Token Create | A new organization token was created                                         |
| Organization Token Rotate | An organization token was replaced                                           |
| Organization Token Delete | An organization token was deleted                                            |
| Service Token Create      | A service token was successfully created                                     |
| Service Token Rotate      | A service token was replaced with a new token                                |
| Service Token Delete      | A service token was deleted                                                  |
| Service Create            | A new service was created                                                    |
| Service Delete            | A service was deleted                                                        |
| Service Update            | Service settings were updated                                                |
| Client Create             | A client was created                                                         |
| Client Delete             | A client was deleted                                                         |
| Client Update             | Client settings were updated                                                 |
| Security Login            | A user logged in through OIDC authentication                                 |
| Security Logout           | A user logged out                                                            |
| Security Register         | A user registered a new account                                              |
| Security Verify Email     | A user verified their email address                                          |
| Security Login Mfa        | A user logged in using Multi-Factor Authentication                           |
| Security Login Oidc       | A user logged in using Single Sign-On (SSO) or external identity             |
| Security Mfa Create       | A user enabled Multi-Factor Authentication                                   |
| Security Mfa Delete       | A user removed Multi-Factor Authentication                                   |
| Security Password Update  | A user updated their password                                                |
| User Create               | A user account was created                                                   |
| User Delete               | A user account was deleted                                                   |
| User Invite               | A user was invited to an organization                                        |
| User Invite Accepted      | A user accepted an invitation                                                |
| User Invite Decline       | A user declined an invitation                                                |
| User Invite Revoke        | A user invitation was revoked                                                |
| User Admin Set            | A user was assigned the System Administrator role                            |
| User Admin Unset          | The System Administrator role was removed from a user                        |
| Permission Change         | User access permissions were updated for an Organization, Service, or Client |

***

## Service Principals in Audit Logs

Some audit entries are generated automatically by internal Authlete services or background processes.\
These system-level actors are called **Service Principals**.

Service principals represent trusted services that perform operational or maintenance tasks on behalf of Authlete.\
Their actions appear in audit logs the same way user actions do, but with:

* **User Type:** a Service Principal
* **User Identifier:** The assigned ID or alias of the system actor (for example, `migration-service@system.authlete.com`)

This ensures full visibility of both human and automated activities within a single, consistent audit view.

***

## Service Principal Event Types

Service principal event types record automated actions performed by system-level or background processes.\
These events reflect non-human activity such as maintenance or data migration tasks performed by trusted Authlete services.

| Event Name            | Description                                                                                                    |
| --------------------- | -------------------------------------------------------------------------------------------------------------- |
| Migration Service     | Automated background service that processes or transfers data between systems as part of migration operations. |
| Batch Cleanup Service | Internal background service that performs scheduled maintenance or cleanup of expired tokens and resources.    |

These event types appear alongside user events within the same audit log interface.\
Each entry lists its **User Type** as a Service Principal to indicate that the operation was automated.

***

## Summary

Authlete audit logs provide a unified record of all activity — whether performed by users or by automated system actors.\
By distinguishing between **user** and **service principal** events, Authlete ensures complete transparency, accountability, and traceability across the platform.

***