← All articles

Security Audit Logs

Security audit logs show sign-in, account security, important database changes, and agent actions for your institution so administrators can investigate access issues and support compliance reviews.

Overview

Open Settings → Logs. The panel is titled Audit activity and is available to institution administrators.

These logs cover authentication, account-security events, important changes to sites, contracts, placements, schedules, classrooms, and compliance records, plus Agents proposals that were applied, rolled back, or dismissed. They are not a full history of every read or academic edit in the product.

What you’ll see

Each row typically includes:

  • When the event occurred
  • Who acted (name and email when available)
  • Event type (for example Signed in, Contract updated, Role changed, Agent action applied)
  • Details (for example email/password vs SSO, invite target, changed contract expiration date, or the proposal explanation and each change that was applied or rolled back)
  • IP address when it is available (agent actions do not record an IP)

Filter by recent window (Last 7, 30, or 90 days) and by event group:

  • All events
  • Signed in / out
  • MFA
  • Invites & passwords
  • Account changes
  • API keys
  • Agent actions
  • Data changes

Event types

Common events include:

  • Signed in / Signed out — including whether login used email/password or SSO
  • MFA verified, enrolled, or failed
  • Invite sent, password reset requested, password set
  • Email changed, role changed, user archived or restored
  • API key created, updated, or revoked
  • Data changes — important site, contract, classroom, placement, schedule, and compliance record changes, including field-level before-and-after values when available
  • Agent action applied, rolled back, or dismissed — who approved or declined an Agents proposal, plus what changed (for example which student was assigned, which template was updated, or which competency was mapped)

Use these signals together with Settings → Security (MFA and SSO), Settings → REST API key management, and Agents approval cards.

You can also ask Agents who did what in this feed (for example who signed in, who failed MFA, or who applied an agent action and what changed). Answers use the same Logs history as this page.

Typical compliance use

Institutions often use Logs to:

  • Show access-control evidence during security or accreditation-related reviews
  • Investigate suspicious sign-ins or repeated MFA failures
  • Confirm who changed roles or archived accounts
  • Track API key lifecycle for integration audits
  • Review who changed a contract expiration date, placement, schedule, or compliance record
  • Show who applied or rolled back agent actions

Export or screenshot practices should follow your institution’s evidence policies; retain copies outside the 90-day UI window when longer retention is required.

Tips

  1. Check Logs after SSO cutovers or MFA rollouts to confirm expected sign-in methods.
  2. Filter to API keys when rotating integration credentials.
  3. Pair role-change events with the Users page when auditing privileged access.
  4. Filter to Agent actions after an Agents run to confirm who approved placements, compliance, or curriculum mapping changes and what those proposals actually changed.
  5. Filter to Data changes when investigating a site, contract, placement, schedule, classroom, or compliance update.
  6. Limit Logs access to institution admins who need security oversight.

Troubleshooting

Logs tab missing
Confirm you are signed in as an institution administrator. Not every admin-role user has this tab.

No rows for a date range
Widen the window or clear the event filter. Quiet periods are normal for small teams.

IP shows blank
Some clients do not report a usable IP; agent actions never include an IP. The event can still be valid without it.

Need older than 90 days
The UI focuses on recent windows. Contact support if you need help with longer-term compliance evidence processes.

Related features

  • Settings: Security (MFA/SSO), REST API keys, and Logs
  • Enterprise-SSO: SSO sign-in and directory provisioning
  • Users: Role and account changes reflected in Logs
  • REST-API: API key creation and revocation events
  • Agents: Proposals that appear here after apply, rollback, or dismiss

Support

For security log or compliance questions: support@healthtasks.ai