Audit Logs

The Logs tab (sometimes called Trail Log internally) is the per-application audit trail. Every sign-in, role change, MFA reset, API key rotation, OAuth-provider edit — anything that affects state — lands here. It's the page you open during a security investigation and the page you ship to compliance auditors.

┌──────────┬───────────────────────────────────────────────┬───────┬──────────┐
│ Time     │ Event                                         │ Actor │ Result   │
├──────────┼───────────────────────────────────────────────┼───────┼──────────┤
│ 10:42:18 │ POST /oauth2/token (refresh_token)            │ alice │ 200 OK   │
│ 10:39:01 │ POST /api/v1/users/{id}/mfa/reset             │ admin │ 200 OK   │
│ 10:38:55 │ POST /oauth2/token (authorization_code)       │ alice │ 200 OK   │
│ 10:38:49 │ GET  /oauth2/authorize  (PKCE, S256)          │ —     │ 302      │
│ 10:36:11 │ POST /auth/password/login  (failed)           │ alice │ 401      │
└──────────┴───────────────────────────────────────────────┴───────┴──────────┘

The page is a three-pane layout: filters on the left, an event table in the middle, a detail panel on the right when you select a row.

Where it lives#

Dashboard → Application → Logs. The header shows the total event count, a search box, a Live toggle (5-second polling for tail-the-stream usage), and a Refresh button.

Filters#

The left sidebar has:

Time range#