Audit log entries

Each entry in the audit log records one thing that happened.

What an entry contains

Field	Meaning
When	The time it happened
Who	The person who did it
Organisation	Which organisation it happened in — empty for account-level events
Action	What was done
Resource	What kind of thing it was done to
Resource id	Which particular one

There is no fixed list of events

The action and resource are recorded as the application names them, rather than chosen from a closed set. New actions appear as the product gains them, without anything needing to be registered first.

So there is no catalogue of event types to check an entry against. The entry describes itself, and an action you have not seen before is not a sign of anything unusual.

This is worth saying plainly, because the natural question — "what are all the things that get logged?" — does not have a fixed answer.

Entries with no organisation

Signing in, changing a password, registering: these happen to a person, not inside an organisation, so they are recorded without one.

The consequence when reading: filtering by organisation hides them. If you are looking for a sign-in and cannot find it, that is why.

The resource id

Identifies the specific record affected. Most are Yessort's own identifiers; some are external references, where the entry concerns something in a connected system.

Entries cannot be removed

There is no delete, from any screen and from the application itself. The log only grows.

A record the recorded parties could edit would not be evidence — see the audit log.

Where other history lives

The audit log records deliberate actions. Several areas keep their own, closer to the work:

• Failed posts, holds and reconciliation exceptions — accounting
• A channel's sync activity — push failures and events from a store
• Routing exceptions — where a channel's choice and your rules disagreed