# Use audit logs to track changes

> The audit log is designed to help organizations track changes made by users and system automations across their customers.

Source: https://help.kustomer.com/en_us/use-audit-logs-S1Vj88QQN

Last updated: 2026-07-14T21:10:35.601Z

The audit log is designed to help organizations track changes made by users and system automations across their customers. The level of detail provided can help triage changes that may have happened, such as conversation assignment changes. The logs also store previous attribute data, so if something is mistakenly updated, you can see the previous data entry and reenter it.

The audit logs will help developers identify which workflows, business rules, or API requests made updates. They will also track when a user signs in and when one of those sign-ins might have failed. This helps identify suspicious activity that may prompt you to reset passwords.

The audit log also tracks any changes made to your Search or Shortcut settings, allowing you to troubleshoot sudden, unexpected behavior in either area. 

**Who can access this feature?**

**User types**

Admins can access full audit log features. Users can access Customer and Conversation logs.

  

### In this article

*   [Understand the audit log](#understand)
*   [What is tracked in the audit log?](#tracked)

### Understand the audit log

The audit log provides a way to track user activity within your organization and can be [accessed](https://help.kustomer.com/en_us/access-the-audit-log-H19ypU1Kw) in various ways.

![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/10f79dc7618f06179fe17b2519239f2a.png)

The audit log consists of the following columns:

*   **Performed By**  
    Shows the User or System Automation that took the action. System Automations include workflows, business rules, the queue router, or APIs.   
      
    
*   **Date**  
    The date and time the event took place.  
      
    
*   **Event**  
    The type of change tracked, such as Update, Create, or Login.  
      
    
*   **Section**  
    The standard object or setting that was updated.  
      
    
*   **Property**  
    The specific attribute that was changed. For example, this could be Assigned Users, Status, Name, Email Address, or Tags.  
      
    
*   **Before & After**  
    The specific attribute information that changed on an object. For example, these columns could indicate that a conversation status went from Open to Done.
    
    **Note:** You can see more details about what was changed in the criteria or action by hovering over the **Before** and **After** columns.
    
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/caa472e5869b8bb64aeefaf1790ec930.png)

### What is tracked in the audit log?

The audit log tracks various areas throughout Kustomer's platform. For more information on how long your data is stored, see [Audit log storage limits](https://help.kustomer.com/audit-log-storage-limits-ByGmsAcWd).

**Area**

**What is tracked**

Conversations

*   When a conversation is created or deleted.
*   Any updates made to the following attributes in an existing conversation:
    *   Name
    *   The reason a conversation was ended
    *   Tags
    *   Assigned Teams and Users
    *   Default Language
    *   Assistant
    *   Status, including Snooze
    *   Priority
    *   Any custom attributes
*   If a conversation was merged and includes the name of the conversation that it was merged into.
*   If a conversation's SLA is breached.

Customers

*   When a customer is created or deleted.
*   Any updates made to the following attributes in an existing customer:
    *   Name and user name
    *   Avatar
    *   Email addresses and phone numbers
    *   URLs
    *   Location and timezone
    *   Birthday and gender
    *   Tags
    *   Default language
    *   Company External ID
    *   When they signed up
    *   Social media and Facebook ID
    *   Any custom attributes

Companies

*   When a company is created.
*   Any updates made to the following attributes in an existing company:
    *   Org
    *   Name
    *   External ID
    *   Company avatar
    *   Emails, phone numbers, and social media
    *   URLs
    *   Location and domain
    *   Employee count
    *   Tags
    *   Deletions and imports
    *   Default Language
    *   Any custom attributes

Deletion rule

*   When a [data deletion rule](https://help.kustomer.com/manage-platform-usage-data-HJkfk28Kkx#recurring) is created

Kustomer Voice

*   If a voice recording was deleted
*   If a conversation contacts a voice recording

Messages

*   When a message is created or updated.
*   If and when a message is redacted.

Business rules

*   The name of the business rule
*   If a business rule is turned on or off.
*   Editing a business rule's name or description.
*   Changing the trigger or criteria.
*   Setting the actions a business rule takes.
*   When business rules are created or deleted.

Routing

*   When an agent goes offline/online.
*   The status an agent switches to.
*   If an agent switches to a status that allows them to get routed conversations.
*   An agent's remaining capacity.
*   When an item enters a queue.
*   Who accepted the conversation.
*   The user or team that's assigned a conversation.
*   The queue a conversation is in.
*   The queue rule was applied to that conversation.
*   If a conversation is a voice conversation (noted as IVR).

Satisfaction

*   When a survey was scheduled, offered, rated, and commented on.

Shortcuts

*   When a shortcut applies an action in a conversation
*   When a shortcut is used to create a new message in a conversation

Shortcut settings page

*   When a shortcut is created.
*   Edits made to a shortcut's name or message.
*   Changing its share access and any shared users or teams.
*   Setting any actions the shortcut takes on a conversation.
*   If a shortcut is deleted.

Saved Searches

*   Changes to its criteria.

Search settings page

*   Updates to a search's name.
*   Turning on a badge or changing its color.
*   Changing its icon.
*   Changes to the search's default, user, or team visibility.
*   Adding or removing a column.

Tasks

*   Records task activity such as task creation, updates, completion, and deletion.

Team Pulse

*   If an admin changes an agent's status in the Team Pulse chart.

User logins

*   If a user's log-in attempt was successful or failed.
*   If a user has been locked out of the platform.

Workflows

*   When a workflow is created.
*   Editing a workflow's name or description.
*   Changing its triggers or any variables it contains.
*   Turning a workflow on or off.

  

#### **Find tag changes in the audit log**

To find when a tag was deactivated and who performed the action:

1.  From the left navigation, click ****Settings****. The Settings page opens.
2.  In the ****Settings**** page, click ****Security****, then select ****Audit Log****.
3.  Use your browser's search function (Command+F on Mac, CTRL+F on Windows) and search for ****Tag**** to locate tag-related entries.
4.  Review the matching entries for the user who performed the action, the timestamp, and the details of the change.

#### **Query audit logs via API**

For advanced filtering, use the `/v1/audit-logs` API endpoint. You can filter by object type, event type, and date range.

Example request to find tag updates within a date range:

`GET https://api.kustomerapp.com/v1/audit-logs?filter[objectType]=tag&filter[eventType]=update&filter[start]=2026-01-01T00:00:00.000Z&filter[end]=2026-05-01T23:59:59.999Z`

The response includes the user who made the change, the timestamp, and the specific changes applied to the tag.