Skip to content

Audit Logs

The Audit page is your workspace's record of operational events — what happened on your targets and errors, when, and who (or what) did it. That includes the full error workflow (analysis completed, fix approved, applied, rollback), target automation toggles, pairing / token issue and revoke, and protection-mode changes.

It is the place to go when you need to answer questions like "who approved that fix?", "when did this target enter protection mode?", or "when was auto-apply turned on?".

Where to find it

In the dashboard sidebar, open Audit. You will see a filterable, searchable table with one row per event. Click any row for the full event detail.

Who can view: workspace administrators always have access. On plans with team seats, a tenant member needs the View audit logs permission (can_view_audit) assigned in Profile → Team & security. Without it, the Audit page and API return access denied.

What you see

Each row shows, at a minimum:

  • Timestamp — when the event happened (in your profile timezone and date format).
  • Event — a friendly label such as Fix Approved, Analysis Complete, Auto Apply Toggled, Token Issued. Hover for the underlying technical name when you need it.
  • Category — broad grouping (Error Workflow, Security, User Action, System).
  • Actor — who triggered the event: a user's name or email when available (otherwise User · <id>), or a system actor such as Connector, System, or Patcherly Support for platform actions. Raw user ids are not shown when a display name can be resolved.
  • Object type and Object ID — the resource the event applied to (for example a target or an error).
  • Details — open the row to see the metadata stored with the event, plus (where recorded) the IP address and user agent of the request. For Analysis Complete, the Summary column notes Not patchable when analysis finished without a draft patch.

Optional columns you can switch on from the Columns picker include the audit row's own ID, Target, Error, and the raw App action code (useful when you are matching events with API logs).

The filter bar starts collapsed — expand Filters to change them. Controls include:

  • Date range — From / To dates for the server fetch.
  • Category presets — quick toggles for Error workflow, Security, or All categories under the overview cards (outside the filter bar).
  • Event type — multi-select; matches the Event column. Leave everything selected for "no filter".
  • Event category — multi-select grouping (Error Workflow, Security, User Action, …).
  • Target and Error ID — narrow to a specific website/app (target) or a specific error.
  • Search — live-filters the rows already loaded, including audit IDs, error IDs, actor, event labels, and the metadata blob. It does not re-fetch from the server, so combine it with a smaller date range if you need a wider net.

Click Refresh at any time to reload from the server with your current filters.

Exporting your audit trail

Use the Export menu in the toolbar to download the filtered view as a CSV file. The export includes the timestamp, event type, category, actor, object type / ID, target, error ID, IP address, user agent, and the raw metadata for each row — handy for compliance reviews or sharing with your team.

For a workspace-wide data export (not just audit), see Data export and account deletion.

How long is it kept?

Audit data is pruned daily once it falls outside your plan's Audit Data Retention window. The aggregated Metrics numbers for the same period are kept permanently and stay correct even after raw audit rows are pruned. When you manually delete allowed errors from the Errors page (never-applied or noise rows — not successfully patched or post-apply history), the per-error rows go away, the audit trail keeps the deletion entry, and your headline metric numbers stay correct.

For per-plan windows, the 30-day grace after a downgrade, and what is and is not affected by pruning or deletion, see Data retention on your workspace.

What kinds of events are recorded?

Workspace Audit shows ops / workspace events only. A non-exhaustive list:

  • Error workflow — error detected, analysis started / completed / failed (including Not patchable summaries), fix approved / patch rejected / applied / failed, mark fixed, manual review, rollback, apply dispatch / retry, target flagged / unflagged.
  • Target automation — auto-analysis, auto-apply, and App restart toggles; protection mode entered / released.
  • Connector security (workspace) — OAuth pairing started / approved, token issued / revoked for a target.
  • System — connector-initiated actions and other automated platform events tied to your targets.

Not shown on workspace Audit (platform / account security stays with Patcherly operators): interactive logins, MFA enrollment changes, password changes, billing webhooks, and similar account-level app audit. If you need login history for an investigation, contact support.

Names you see in the dashboard match what you find in the Event column and in the CSV export.

If you use the WordPress connector, the Recent audit events table on the plugin Home screen uses the same event labels and category/event color tones as the dashboard Audit page (generated from a shared configuration).

Tips

  • Investigating a specific error? Filter by Error ID to see every event tied to that error — analysis, approvals, apply, rollback, and any restart events.
  • Checking automation changes? Filter by event types such as Auto Apply Toggled or Protection Mode Entered.
  • Looking for the result, not the events? Use Business Metrics for time saved, money saved, and fix outcomes (including Not patchable counts). For AI spend, use Usage Analytics. Audit answers "what happened", not "how much value did it deliver" or "how much did the AI cost".