Platform Audit Log
The Platform Audit Log records platform-level administrative activity across your Ascent instance — actions taken by platform operators, not the day-to-day work inside individual organizations.
Overview
The Platform Audit Log lets you:
- Review platform-level events such as operator logins, user and role changes, organization lifecycle actions, billing/plan changes, SSO configuration changes, and view-as-org sessions.
- Search and filter entries by action, user, entity type, and date range.
- Open any entry to see full details, including the captured metadata, reason, and IP address.
This log shows platform-only events — those without organization context. Organization-level activity (ticket changes, client management, and similar) is recorded separately in each organization's own audit log and does not appear here.
Navigate to the Platform Audit Log
In the platform admin shell, select Audit Log in the sidebar (/platform/audit).
Access requires a platform role of Platform Admin (PLATFORM_ADMIN) or
Platform Support (PLATFORM_SUPPORT). Users without one of these roles see an
Access Denied message. This page is part of the platform admin surface and is not
visible to organization admins.
Filtering entries
The filter bar above the table offers:
| Filter | Description |
|---|---|
| Search | Free-text match against the action, entity type, reason, or ticket number. |
| Action | Dropdown of known platform actions (see below), or All Actions. |
| User | Dropdown of platform users, or All Users. |
| Entity type | Dropdown of PlatformUser, PlatformOAuthProvider, Organization, or User, or All Entities. |
| From / To | Date pickers that bound the time range. A single-day range covers the full day. |
When any filter is active, a Clear filters button appears to reset them all. Results are paginated, 50 entries per page, newest first.
Action types
The Action dropdown is populated with the known platform actions. Each is shown in
the dropdown as a readable label (for example, PLATFORM_LOGIN appears as Platform
Login). The underlying action values are:
| Category | Actions |
|---|---|
| Authentication | PLATFORM_LOGIN, PLATFORM_LOGOUT, PLATFORM_LOGIN_FAILED |
| View as org | VIEW_AS_ORG_START, VIEW_AS_ORG_END |
| Account security | PASSWORD_RESET, MFA_RESET |
| Organizations | ORG_CREATE, ORG_UPDATE, ORG_ACTIVATE, ORG_SUSPEND, ORG_DELETE, ORG_PURGE, ORG_RESTORE |
| Platform users | PLATFORM_USER_CREATE, PLATFORM_USER_UPDATE, PLATFORM_USER_DELETE, PLATFORM_USER_ROLE_CHANGE, PLATFORM_USER_DEACTIVATE, PLATFORM_USER_REACTIVATE, PLATFORM_USER_SESSION_TERMINATE |
| Billing | BILLING_UPDATE, PLAN_CHANGE |
| SSO | SSO_CONFIG_CREATE, SSO_CONFIG_UPDATE, SSO_CONFIG_DELETE |
| Settings | PLATFORM_SETTINGS_UPDATE |
Action names are shown in the table as readable badges (for example, PLATFORM_USER_ROLE_CHANGE
is displayed as Platform User Role Change).
Reading the log table
Each row in the Audit Logs table shows:
| Column | Description |
|---|---|
| Timestamp | Date and time the event was recorded. |
| User | The platform user who performed the action. Shows System when no user is attached (for example, automated or IdP-driven entries). |
| Action | The action badge. |
| Entity | The affected entity type and its resolved display name (and the related organization name, when applicable). |
| IP Address | The IP address the request came from, if captured. |
| Details | A View button that opens the detail dialog. |
Entry details
Click View on any row to open the Audit Log Details dialog. Depending on the event, it can show:
- Action — the action badge.
- Entity — the entity name, type, and ID.
- User — the actor's name and email (or System).
- IP Address — the originating IP address.
- Organization — the related organization name and slug, when the event references one.
- Ticket — the ticket number associated with the action, when present (used by view-as-org and similar sensitive actions).
- Reason — the justification recorded for the action, when present.
- Details — the raw metadata captured at the time of the event, shown as JSON. If no metadata was recorded, the dialog notes that no additional details are available.
Tips
- Use the Reason field on view-as-org entries to confirm why an operator accessed an organization's data and which ticket it was tied to.
- Filter by Action =
PLATFORM_LOGIN_FAILEDto spot repeated failed sign-in attempts. - Combine the User filter with a From/To range to review everything a specific operator did during an incident window.