Operate
Audit Logs
The Logs tab (sometimes called Trail Log internally) is the per-application audit trail. Every sign-in, role change, MFA reset, API key rotation, OAuth-provider edit — anything that affects state — lands here. It's the page you open during a security investigation and the page you ship to compliance auditors.
┌──────────┬───────────────────────────────────────────────┬───────┬──────────┐
│ Time │ Event │ Actor │ Result │
├──────────┼───────────────────────────────────────────────┼───────┼──────────┤
│ 10:42:18 │ POST /oauth2/token (refresh_token) │ alice │ 200 OK │
│ 10:39:01 │ POST /api/v1/users/{id}/mfa/reset │ admin │ 200 OK │
│ 10:38:55 │ POST /oauth2/token (authorization_code) │ alice │ 200 OK │
│ 10:38:49 │ GET /oauth2/authorize (PKCE, S256) │ — │ 302 │
│ 10:36:11 │ POST /auth/password/login (failed) │ alice │ 401 │
└──────────┴───────────────────────────────────────────────┴───────┴──────────┘
The page is a three-pane layout: filters on the left, an event table in the middle, a detail panel on the right when you select a row.
Where it lives#
Dashboard → Application → Logs. The header shows the total event count, a search box, a Live toggle (5-second polling for tail-the-stream usage), and a Refresh button.
Filters#
The left sidebar has: