Skip to content

Audit

The Audit page shows who changed what, when, and from where. Filter the log and export it as CSV. Open Audit in the sidebar.

Who can use it

Owners and admins can open the page. What you see depends on your role scope:

  • A role that covers the whole organization sees every event.
  • A site or group role sees only events tagged with that site or group.

Other roles see an error.

Read the log

The newest events come first, up to 1,000 rows per query.

Column Shows
When Time of the event, in your local time.
Actor Who did it: user <id>, device <id>, or system.
Action The event name, such as user.invite.
Target The kind and id of what changed, or "—".
Source The IP address of the request, or "—".

Actors and targets show ids, not names. A user's id appears as the Target of their user.invite event. An Edge's id is in its portal address, /edges/<id>. If nothing matches, the page shows "No audit events."

Filter events

  1. Fill in any of these fields:

    Field Matches
    Actor id The exact id of the actor.
    Target An exact target id, or a target kind such as user.
    Action An exact action name, such as role_binding.create.
    Two date and time fields The start and the end of the period. Both ends are included.

  2. Select Apply filters.

Filters take effect only when you select Apply filters. If more than 1,000 events match, narrow the time range.

Export to CSV

  1. Set and apply your filters.
  2. Select Export CSV.

The browser saves audit.csv with the columns at, actor_kind, actor_id, action, target_kind, target_id, and source_ip. The export uses the same filters and the same 1,000-row limit. Cells that start with =, +, -, or @ get a leading ' so spreadsheets do not run them as formulas.

You can also export with an API token that has the audit.view scope. See Settings and API tokens.

curl -s -H "Authorization: Bearer $WT_TOKEN" \
  "https://watchtower.example.com/api/v1/audit?action=user.invite&format=csv" \
  -o audit.csv

What is recorded

Sign-in and sign-out are not recorded.

Area Actions
Account security user.setup, user.password_change, user.password_reset
Users and roles user.create_owner, user.invite, user.disable, user.reset_mfa, role_binding.create, role_binding.delete, approval.update, auth.api_token.create
Sites and groups site.create, site.update, site.delete, group.create, group.update, group.delete, device.move
Configuration template.create, template.update, template.version, template.publish, template.archive, config_layer.upsert, secret.create, secret.rotate
Rollouts rollout.create, rollout.pause, rollout.resume, rollout.abort, rollout.skip_wait, rollout.revert
Edges device.enroll_request, device.enroll, device.enroll_approve, device.enroll_reject, device.deactivate, device.replace, certificate.revoke, command.enqueue
Operators and App access operator.create, operator.invite, operator.disable, access.grant, access.revoke, access.retry
Install licence.extend, hostname.add, support.grant, support.revoke

Next steps