> ## Documentation Index
> Fetch the complete documentation index at: https://docs.niro.cx/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

> Review every state-changing action taken by users, the API, and cluster agents in your organization.

## Overview

The **Audit log** records every action that changes state in your Niro organization — deployments applied, secrets created, remediations approved, members invited, and more. Use it to answer "who did what and when" across your fleet.

## What is logged

The audit log covers three categories of actor:

| Actor type | Examples                                                                                      |
| ---------- | --------------------------------------------------------------------------------------------- |
| **User**   | Applied a deployment, approved a remediation, invited a team member, changed cluster settings |
| **Agent**  | Applied manifests on merge, ran a remediation after approval, updated its own version         |
| **API**    | Automated integrations that use a token to make changes                                       |

Every entry records:

* **When** — timestamp of the action
* **Who** — the email or identifier of the actor
* **What** — the action taken (e.g. `deployment.apply`, `remediation.approve`)
* **Target** — the resource type and ID affected
* **Cluster** — which cluster the action affected (if applicable)
* **Result** — success or failure

## Accessing the audit log

Go to **Audit** in the sidebar. The log loads the most recent entries first.

## Filtering entries

Use the filter fields at the top of the page to narrow entries:

| Filter            | Description                                     |
| ----------------- | ----------------------------------------------- |
| **Actor**         | Filter by email address or actor ID             |
| **Action**        | Filter by action type (e.g. `deployment.apply`) |
| **Resource type** | Filter by the type of resource affected         |
| **Cluster**       | Filter by cluster ID                            |

The log refreshes automatically every 30 seconds.

## Using the audit log

**Incident review** — after a production incident, use the audit log to see what changed in the minutes before it started: which deployments were applied, which configs were modified, and by whom.

**Remediation tracking** — every approved or rejected remediation appears in the audit log, showing who made the decision and whether the action succeeded.

**Access review** — track member invitations and role changes to maintain visibility over who has access to your clusters.

## Related

<CardGroup cols={2}>
  <Card title="Remediations" icon="heart-rate-monitor" href="/features/remediations">
    Approval-gated fixes — all logged in the audit trail.
  </Card>

  <Card title="Manage Secrets and ConfigMaps" icon="key" href="/guides/secrets-configmaps">
    Config changes that appear in the audit log.
  </Card>

  <Card title="Multi-tenancy" icon="building" href="/features/multi-tenancy">
    Member management and org settings.
  </Card>

  <Card title="Deploy an App" icon="rocket" href="/guides/deploy-app">
    Deployment applies are recorded in the audit log.
  </Card>
</CardGroup>