> For the complete documentation index, see [llms.txt](https://docs.kiloiot.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kiloiot.io/reports/audit-trail.md).
# Audit Trail
Audit Trail in Kilo IoT Server — searchable log of org membership events: invites, accepts, permission changes.
The Audit Trail is a searchable log of organization membership events — who invited whom, who accepted, whose permissions changed, and who was removed. Use it to investigate the membership activity recorded for your organization. Confirm event coverage and retention before relying on it for a compliance review.
The audit trail currently covers membership events. Device operations, rule changes, dashboard edits, and other platform activity are not logged here.
## Where to Find It
Open the sidebar and navigate to **Records & Reports** > **Audit Trail**. The audit trail page opens at `/records/audit-trail`, scoped to your current organization — its title reads *{organization} / Audit Trail*.
## What Is Logged
The audit trail records four types of membership events:
| Event | What it captures |
| ----------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Invite sent** | Who sent the invitation, to which email, and with what permissions. |
| **Invite accepted** | Who accepted the invitation and which organization they joined. |
| **Permissions changed** | Who changed permissions, for which user, and the before-and-after difference showing exactly what changed. |
| **User removed** | Who removed the user and from which organization. |
Each event includes the **actor** (the person who performed the action), an optional **target** (the person affected), a timestamp, and a human-readable message summarizing what happened.
## The Audit Trail Table
Events are displayed in a table with three columns:
| Column | What it shows |
| --------- | --------------------------------------------------------------------------------------------------- |
| **Time** | The time the event occurred (HH:flag\_mm:ss format). |
| **Actor** | The email address of the user who performed the action. |
| **Event** | A human-readable summary of what happened — for example, *"Changed access rights for Jens Müller."* |
Events are grouped by date. The table shows 50 events per page, with pagination controls at the bottom.
## Filtering Events
Three filters are available above the table. All filters can be combined — they apply together using AND logic.
### Actor Email
Filter by who performed the action. Start typing an email address and choose from the autocomplete suggestions (which are drawn from the organization's current members). The filter supports both exact matches (select from the dropdown) and prefix matches (type a partial address).
### Event Types
A multi-select dropdown with checkboxes. Choose one or more event types to narrow the log:
* Invite sent
* Invite accepted
* Permissions changed
* User removed
When no types are selected, all events are shown. The placeholder reads *"All event types."*
### Date Range
A calendar picker that lets you select a start and end date. Quick-select shortcuts are available for common ranges. Click the date range button to open the picker, and use **Clear** to remove the filter.
## Access Permissions
The audit trail is read-only for every user, including the organization owner. All users with Audit Trail set to View can see the log. The Audit Trail page provides no editing or deletion controls. This does not mean records are kept forever: service housekeeping removes records according to the configured retention. Confirm the applicable retention for your deployment before relying on older records.
For details on how audit trail permissions work within the broader access model, see [Roles and Page Access](/account/roles-and-page-access.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.kiloiot.io/reports/audit-trail.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
