> ## Documentation Index
> Fetch the complete documentation index at: https://hellotars.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Search and export the audit log
> Filter audit events, read the event drawer, export CSV or JSON, and verify the tamper-evident chain.
export const img = {
activity: {
activityTimeline: "/docs/guides/activity/images/activity-timeline.png",
capturedVariablesPanel: "/docs/guides/activity/images/captured-variables-panel.png",
dataViewCards: "/docs/guides/activity/images/data-view-cards.png",
exportDataDialog: "/docs/guides/activity/images/export-data-dialog.png",
tasksPanelExportReady: "/docs/guides/activity/images/tasks-panel-export-ready.png"
},
analytics: {
analyticsOverview: "/docs/guides/analytics/images/analytics-overview.png",
exploreGallery: "/docs/guides/analytics/images/explore-gallery.png",
exploreTab: "/docs/guides/analytics/images/explore-tab.png",
goalForm: "/docs/guides/analytics/images/goal-form.png",
goalsTab: "/docs/guides/analytics/images/goals-tab.png",
improveDiagnostics: "/docs/guides/analytics/images/improve-diagnostics.png",
improveTab: "/docs/guides/analytics/images/improve-tab.png",
teamTab: "/docs/guides/analytics/images/team-tab.png"
},
billing: {
billingOverview: "/docs/guides/billing/images/billing-overview.png",
buyConversationsDialog: "/docs/guides/billing/images/buy-conversations-dialog.png",
buySeatsDialog: "/docs/guides/billing/images/buy-seats-dialog.png",
livechatSeatsTab: "/docs/guides/billing/images/livechat-seats-tab.png",
organizationDeletionLifecycle: "/docs/guides/billing/images/organization-deletion-lifecycle.svg",
organizationSwitcher: "/docs/guides/billing/images/organization-switcher.png",
rolesAndAccessMatrix: "/docs/guides/billing/images/roles-and-access-matrix.png"
},
building: {
agentBehaviorGuardrails: "/docs/guides/building/images/agent-behavior-guardrails.png",
agentCardMenu: "/docs/guides/building/images/agent-card-menu.png",
agentConfigure: "/docs/guides/building/images/agent-configure.png",
agentExitRoutesDialog: "/docs/guides/building/images/agent-exit-routes-dialog.png",
agentLibrary: "/docs/guides/building/images/agent-library.png",
agentModelParameters: "/docs/guides/building/images/agent-model-parameters.png",
aiAgentGambitLoop: "/docs/guides/building/images/ai-agent-gambit-loop.svg",
builderBasics: "/docs/guides/building/images/builder-basics.png",
builderConnectHandlePanel: "/docs/guides/building/images/builder-connect-handle-panel.png",
builtInToolsDialog: "/docs/guides/building/images/built-in-tools-dialog.png",
configureDebugTab: "/docs/guides/building/images/configure-debug-tab.png",
configureLanguage: "/docs/guides/building/images/configure-language.png",
configureNotifications: "/docs/guides/building/images/configure-notifications.png",
createAgentDialog: "/docs/guides/building/images/create-agent-dialog.png",
draftPublishRollbackPinning: "/docs/guides/building/images/draft-publish-rollback-pinning.svg",
draftSwitcherChip: "/docs/guides/building/images/draft-switcher-chip.png",
duplicateAgentDialog: "/docs/guides/building/images/duplicate-agent-dialog.png",
flowConditions: "/docs/guides/building/images/flow-conditions.png",
gambitPalette: "/docs/guides/building/images/gambit-palette.png",
gambits: {
gambitAiAgent: "/docs/guides/building/gambits/images/gambit-ai-agent.png",
gambitApiCall: "/docs/guides/building/gambits/images/gambit-api-call.png",
gambitAutoSuggestion: "/docs/guides/building/gambits/images/gambit-auto-suggestion.png",
gambitButton: "/docs/guides/building/gambits/images/gambit-button.png",
gambitCard: "/docs/guides/building/gambits/images/gambit-card.png",
gambitChannel: "/docs/guides/building/gambits/images/gambit-channel.png",
gambitCustomCode: "/docs/guides/building/gambits/images/gambit-custom-code.png",
gambitDateTime: "/docs/guides/building/gambits/images/gambit-date-time.png",
gambitGeoLocation: "/docs/guides/building/gambits/images/gambit-geo-location.png",
gambitLanguage: "/docs/guides/building/gambits/images/gambit-language.png",
gambitLiveChat: "/docs/guides/building/gambits/images/gambit-live-chat.png",
gambitMediaUpload: "/docs/guides/building/gambits/images/gambit-media-upload.png",
gambitNoInput: "/docs/guides/building/gambits/images/gambit-no-input.png",
gambitRedirect: "/docs/guides/building/gambits/images/gambit-redirect.png",
gambitStarRating: "/docs/guides/building/gambits/images/gambit-star-rating.png",
gambitStartAndEnd: "/docs/guides/building/gambits/images/gambit-start-and-end.png",
gambitText: "/docs/guides/building/gambits/images/gambit-text.png",
gambitTrigger: "/docs/guides/building/gambits/images/gambit-trigger.png"
},
languagesTranslateGambit: "/docs/guides/building/images/languages-translate-gambit.png",
languageSystemMessages: "/docs/guides/building/images/language-system-messages.png",
newDraftDialog: "/docs/guides/building/images/new-draft-dialog.png",
outputComponentsGrid: "/docs/guides/building/images/output-components-grid.png",
publishDialog: "/docs/guides/building/images/publish-dialog.png",
systemPromptDialog: "/docs/guides/building/images/system-prompt-dialog.png",
testModeEventLog: "/docs/guides/building/images/test-mode-event-log.png",
testModePanel: "/docs/guides/building/images/test-mode-panel.png",
validationProblemsPanel: "/docs/guides/building/images/validation-problems-panel.png",
variablePickerPanel: "/docs/guides/building/images/variable-picker-panel.png",
variablePillInserted: "/docs/guides/building/images/variable-pill-inserted.png",
versionsDraftsPanel: "/docs/guides/building/images/versions-drafts-panel.png"
},
campaigns: {
campaignFlavorsTriggers: "/docs/guides/campaigns/images/campaign-flavors-triggers.svg",
campaignReplyRouting: "/docs/guides/campaigns/images/campaign-reply-routing.svg",
campaignSendAnatomy: "/docs/guides/campaigns/images/campaign-send-anatomy.svg",
createACampaign: "/docs/guides/campaigns/images/create-a-campaign.png",
walletReserveSettleRefund: "/docs/guides/campaigns/images/wallet-reserve-settle-refund.svg",
webhookCampaignContractLocking: "/docs/guides/campaigns/images/webhook-campaign-contract-locking.svg",
webhookCampaignLifecycleStates: "/docs/guides/campaigns/images/webhook-campaign-lifecycle-states.svg",
webhookCampaignOneCallOneDelivery: "/docs/guides/campaigns/images/webhook-campaign-one-call-one-delivery.svg"
},
channels: {
distributeWhatsappConnect: "/docs/guides/channels/images/distribute-whatsapp-connect.png",
whatsappConnectDialogWaiting: "/docs/guides/channels/images/whatsapp-connect-dialog-waiting.png",
whatsappEmptyState: "/docs/guides/channels/images/whatsapp-empty-state.png"
},
deploy: {
bridgeEventGambitSection: "/docs/guides/deploy/images/bridge-event-gambit-section.png",
deploymentSurfacesAndChannels: "/docs/guides/deploy/images/deployment-surfaces-and-channels.svg",
designAgentTab: "/docs/guides/deploy/images/design-agent-tab.png",
designLauncherTab: "/docs/guides/deploy/images/design-launcher-tab.png",
embedIframeTab: "/docs/guides/deploy/images/embed-iframe-tab.png",
embedTheWidget: "/docs/guides/deploy/images/embed-the-widget.png",
mobileAppIntegration: "/docs/guides/deploy/images/mobile-app-integration.png",
onYourDomain: "/docs/guides/deploy/images/on-your-domain.png",
shareYourAgentLink: "/docs/guides/deploy/images/share-your-agent-link.png"
},
developer: {
api: {
channelSendTemplateVsMessage: "/docs/developer/api/images/channel-send-template-vs-message.svg",
endUsers: {
endUsersListCursorPagination: "/docs/developer/api/end-users/images/end-users-list-cursor-pagination.svg"
},
triggerCallConversationLifecycle: "/docs/developer/api/images/trigger-call-conversation-lifecycle.svg"
},
developerSurfacesMap: "/docs/developer/images/developer-surfaces-map.svg",
embed: {
embedConfigToWidgetContext: "/docs/developer/embed/images/embed-config-to-widget-context.svg",
hostPageBridgeFlow: "/docs/developer/embed/images/host-page-bridge-flow.svg",
identitySigningFlow: "/docs/developer/embed/images/identity-signing-flow.svg",
scriptVsIframeEmbed: "/docs/developer/embed/images/script-vs-iframe-embed.svg"
},
mobile: {
bridgeMessageProtocol: "/docs/developer/mobile/images/bridge-message-protocol.svg",
webviewBridgeArchitecture: "/docs/developer/mobile/images/webview-bridge-architecture.svg"
}
},
endUsers: {
anonymousToIdentifiedProfile: "/docs/guides/end-users/images/anonymous-to-identified-profile.svg",
bulkActionBar: "/docs/guides/end-users/images/bulk-action-bar.png",
campaignConsentGate: "/docs/guides/end-users/images/campaign-consent-gate.svg",
consentPerChannelStates: "/docs/guides/end-users/images/consent-per-channel-states.svg",
dynamicVsStaticSegments: "/docs/guides/end-users/images/dynamic-vs-static-segments.svg",
endUserDirectory: "/docs/guides/end-users/images/end-user-directory.png",
endUserProfileAcrossChannels: "/docs/guides/end-users/images/end-user-profile-across-channels.svg",
endUserProfilePanes: "/docs/guides/end-users/images/end-user-profile-panes.png",
profileMergeAndTakeoverProtection: "/docs/guides/end-users/images/profile-merge-and-takeover-protection.svg",
segmentBuilder: "/docs/guides/end-users/images/segment-builder.png",
segmentsPage: "/docs/guides/end-users/images/segments-page.png"
},
getStarted: {
agentStates: "/docs/get-started/images/agent-states.svg",
buildToLivePath: "/docs/get-started/images/build-to-live-path.svg",
dashboardSidebarMap: "/docs/get-started/images/dashboard-sidebar-map.png",
organizationOwnershipAndRoles: "/docs/get-started/images/organization-ownership-and-roles.svg",
quickstart: {
step1CreateYourAccount: "/docs/get-started/images/quickstart/step-1-create-your-account.png",
step3ConnectTheAiAgent: "/docs/get-started/images/quickstart/step-3-connect-the-ai-agent.png",
step4TestMode: "/docs/get-started/images/quickstart/step-4-test-mode.png"
},
quickstartCanvas: "/docs/get-started/images/quickstart-canvas.png"
},
knowledge: {
addASource: "/docs/guides/knowledge/images/add-a-source.png",
addRetrieverPicker: "/docs/guides/knowledge/images/add-retriever-picker.png",
attachKnowledgeGambit: "/docs/guides/knowledge/images/attach-knowledge-gambit.png",
configureARetriever: "/docs/guides/knowledge/images/configure-a-retriever.png",
createKnowledgeBaseDialog: "/docs/guides/knowledge/images/create-knowledge-base-dialog.png",
customRetrieverDialog: "/docs/guides/knowledge/images/custom-retriever-dialog.png",
datasetTab: "/docs/guides/knowledge/images/dataset-tab.png",
documentChangeReindexLifecycle: "/docs/guides/knowledge/images/document-change-reindex-lifecycle.svg",
documentsTabPreview: "/docs/guides/knowledge/images/documents-tab-preview.png",
importAWebsite: "/docs/guides/knowledge/images/import-a-website.png",
kbList: "/docs/guides/knowledge/images/kb-list.png",
retrieverIndexStates: "/docs/guides/knowledge/images/retriever-index-states.svg",
retrieverQueryPipeline: "/docs/guides/knowledge/images/retriever-query-pipeline.svg",
standardVsParentChildChunking: "/docs/guides/knowledge/images/standard-vs-parent-child-chunking.svg",
syncManagement: "/docs/guides/knowledge/images/sync-management.png",
testRetriever: "/docs/guides/knowledge/images/test-retriever.png"
},
liveChat: {
agentWorkspace: "/docs/guides/live-chat/images/agent-workspace.png",
assignedAgentPicker: "/docs/guides/live-chat/images/assigned-agent-picker.png",
automaticAssignmentRouting: "/docs/guides/live-chat/images/automatic-assignment-routing.svg",
availabilityDropdown: "/docs/guides/live-chat/images/availability-dropdown.png",
cannedResponses: "/docs/guides/live-chat/images/canned-responses.png",
composerPreferences: "/docs/guides/live-chat/images/composer-preferences.png",
copilotPanel: "/docs/guides/live-chat/images/copilot-panel.png",
filterConversationsDialog: "/docs/guides/live-chat/images/filter-conversations-dialog.png",
inboxAnalyticsTab: "/docs/guides/live-chat/images/inbox-analytics-tab.png",
inboxAvailabilityTab: "/docs/guides/live-chat/images/inbox-availability-tab.png",
inboxesSettings: "/docs/guides/live-chat/images/inboxes-settings.png",
inboxRoutingTab: "/docs/guides/live-chat/images/inbox-routing-tab.png",
labelsSettings: "/docs/guides/live-chat/images/labels-settings.png",
newAttributeDialog: "/docs/guides/live-chat/images/new-attribute-dialog.png",
newCannedResponseDialog: "/docs/guides/live-chat/images/new-canned-response-dialog.png",
notificationPreferences: "/docs/guides/live-chat/images/notification-preferences.png",
notificationsPage: "/docs/guides/live-chat/images/notifications-page.png",
pickupTargetCard: "/docs/guides/live-chat/images/pickup-target-card.png",
resolveMenu: "/docs/guides/live-chat/images/resolve-menu.png",
searchDialog: "/docs/guides/live-chat/images/search-dialog.png",
seatGateConversation: "/docs/guides/live-chat/images/seat-gate-conversation.png",
seatsSettings: "/docs/guides/live-chat/images/seats-settings.png",
workTheInbox: "/docs/guides/live-chat/images/work-the-inbox.png"
},
security: {
addOpenRouterKeyDialog: "/docs/guides/security/images/add-open-router-key-dialog.png",
auditChainVerified: "/docs/guides/security/images/audit-chain-verified.png",
auditEventDrawer: "/docs/guides/security/images/audit-event-drawer.png",
auditExportDialog: "/docs/guides/security/images/audit-export-dialog.png",
auditLogViewer: "/docs/guides/security/images/audit-log-viewer.png",
auditRecordLifecycle: "/docs/guides/security/images/audit-record-lifecycle.svg",
logPrivacyRedactionEnabled: "/docs/guides/security/images/log-privacy-redaction-enabled.png",
modelProviderEmptyState: "/docs/guides/security/images/model-provider-empty-state.png",
privacySettings: "/docs/guides/security/images/privacy-settings.png",
siemConnectWizard: "/docs/guides/security/images/siem-connect-wizard.png",
supportActorMasking: "/docs/guides/security/images/support-actor-masking.svg"
},
tools: {
addToolModal: "/docs/guides/tools/images/add-tool-modal.png",
addToolsPanel: "/docs/guides/tools/images/add-tools-panel.png",
codekitActionEditor: "/docs/guides/tools/images/codekit-action-editor.png",
codekitConnectToolkitsDialog: "/docs/guides/tools/images/codekit-connect-toolkits-dialog.png",
codekitSchemaDialog: "/docs/guides/tools/images/codekit-schema-dialog.png",
codekitToolkit: "/docs/guides/tools/images/codekit-toolkit.png",
codekitToolkitAnatomy: "/docs/guides/tools/images/codekit-toolkit-anatomy.svg",
createActionDialog: "/docs/guides/tools/images/create-action-dialog.png",
createCodekitDialog: "/docs/guides/tools/images/create-codekit-dialog.png",
responseFilteringDialog: "/docs/guides/tools/images/response-filtering-dialog.png",
toolGambitEditorAgentMode: "/docs/guides/tools/images/tool-gambit-editor-agent-mode.png",
toolGambitEditorWorkflowMode: "/docs/guides/tools/images/tool-gambit-editor-workflow-mode.png",
toolkitDetail: "/docs/guides/tools/images/toolkit-detail.png",
toolsConnected: "/docs/guides/tools/images/tools-connected.png",
toolsDirectory: "/docs/guides/tools/images/tools-directory.png",
viewActionsModal: "/docs/guides/tools/images/view-actions-modal.png",
workflowModeResponse: "/docs/guides/tools/images/workflow-mode-response.png"
}
};
export const urls = {
app: "https://dashboard.hellotars.com",
site: "https://hellotars.com",
support: "mailto:support@hellotars.com",
status: "https://status.hellotars.com"
};
By the end of this page, you can find any audited action in your organization and read its full record. You can also export the evidence and confirm that the log is intact.
## Before you start
Before you start, sign in to the dashboard and select the organization you want to work in.
* You need the Admin or Auditor role. Other roles do not see **Audit log** in Settings.
* Exports and chain verification use the same permission, so both roles can run them.
## Open the audit log
Open **Settings**, then select **Audit log** under the **Workspace** heading. The page opens on the **Log** tab.
The **SIEM streaming** tab appears only for Admin members on the Enterprise plan. See [Stream audit events to your SIEM](/docs/guides/security/siem-streaming).
## Read the event table
Each row is one audit event. Select a row to open its drawer.
| Column | What it shows |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Time** | When the action happened, to the second. |
| **Description** | A sentence such as "Alex Morgan changed the role of Jordan Lee to admin". A typed reason, when there is one, follows the sentence. Highlighted names are links that filter the table to that target. |
| **Actor** | The member, or **System** for automated actions. Tars staff acting under a support grant carry a **Support** badge. |
| **Category** | One of the display categories, such as **Security**, **Access**, **Members & org**, **Billing**, **Product**, or **Data access**. |
| **Outcome** | `success`, or a red pill for `failure` or `denied`. |
| **Seq** | The event's position in the hash chain. Numbers never repeat and never skip. |
The table loads 25 events at a time and shows a **loaded** count above it. Scroll to load more. When no event matches, the table says **No audit events match your filters**.
Opening the page is itself audited. The event **audit.accessed** records who viewed the log and with which filters.
## Find an event
Search matches words in the event description. Type `role` to see every role change.
Open the combined filter and pick from four dimensions:
* **Event** lists exact event names, each labelled with its area. It offers only the events your organization has recorded, so the list grows as your organization does more.
* **Category** lists the display categories.
* **Member** lists your organization's members by name or email.
* **Outcome** offers Success, Failure, or Denied.
The date range picker on the right defaults to the last 30 days. Presets such as **Today** and **Last 7 days** fit inside your plan's searchable window. **All retained logs** clears the range. Older dates are disabled.
Select a linked name in a description to filter by that target. A **Target** chip appears above the table. Select the chip's **X** to clear it.
## Read the event drawer
Select a row and a drawer opens on the right. The header repeats the description, the time, the exact event name, the outcome, and the sequence number. Use the up and down arrows, or the arrow keys, to step through the loaded events without closing the drawer.
The drawer shows these sections. Sections with no data are hidden.
| Section | Contents |
| --------------- | ----------------------------------------------------------------------------------- |
| **Actor** | Name, role, and the source IP with a country flag and city when known. |
| **Target** | The affected item, for example the agent or member the action touched. |
| **Reason** | The reason the actor typed, when the action asked for one. |
| **Changes** | Each changed field with the old value struck through and the new value beside it. |
| **Integrity** | The sequence number marked **verified**, the row hash, and the previous row's hash. |
| **Raw payload** | The full stored record as JSON. |
## Export audit data
The export contains only the events that match your current filters.
The **Export audit log** dialog opens. Switch between **CSV** and **JSON** at the top of the dialog. Set the **Export date range** in the dialog. That range applies only to the export and does not change the table.
The dialog omits the next step's option when your organization has no archived events.
If your organization has archived events, the dialog offers **Include archived logs (may take longer)**. It is on by default. Turn it off for a faster export of recent events only.
The dialog closes and a toast confirms that the export started. The export runs in the background.
When the export is ready, the browser starts the download if the tab is visible. Otherwise, open the **Tasks** panel from the tracker at the foot of the sidebar. Select **Download** on the **Audit log export** row.
Every export is recorded as **audit.exported**, so reviewers can see who exported which records and when.
The exported file contains one line per event. Columns include the sequence number, time, action, description, category, outcome, actor, target, source IP, changes, payload, and both hashes.
## Verify chain integrity
Each audit record carries a hash that chains it to the record before it. A changed, inserted, or removed record breaks the chain. You can check the chain yourself, without contacting Tars.
Select **Verify chain integrity** above the table. While the check runs, the button changes to a counter such as **Verifying… 336 events checked**. The result replaces the button:
* A green **Chains verified · 336 events** banner means every record matches its hash and the sequence has no gaps.
* A red **Integrity issue · tenant seq 812 (prevHash)** banner names the first record that fails, and the kind of break. The kind is `gap`, `prevHash`, `rowHash`, or `head`.
* **No hash-chained events yet** appears in a new organization with no events.
* **Verification failed to run** appears above the button when the check itself fails. Run it again.
The count in the banner covers every chained record, so it is larger than the **loaded** count beside it, which counts only the rows fetched so far.
If the check cannot run, the page shows **Verification failed to run** and offers the button again.
## How far back the log reaches
The searchable window depends on your plan. The info icon beside the date range picker states the window in days, and that older archived logs are available through **Export**. Archived events are not searchable in the table, but exports can include them. See [Data retention](/docs/guides/security/data-retention) for the windows on each plan.
## Verify
Set the date range to **Today**, select **Export**, keep **CSV**, and select **Generate export**. The file downloads or appears in the **Tasks** panel. Refresh the table and the newest row reads that you exported the audit log.
## Related pages
* [Data retention](/docs/guides/security/data-retention)
* [Stream audit events to your SIEM](/docs/guides/security/siem-streaming)
* [How Tars support accesses your organization](/docs/guides/security/how-tars-support-accesses-your-org)
* [Roles and permissions](/docs/guides/billing/roles-and-permissions)