> ## Documentation Index
> Fetch the complete documentation index at: https://woku.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Who did what in your company, when, and from where. Filters, pagination, and CSV export.

Every company in Woku has its own **audit log** that
captures every critical action executed by its users.

## Access the log

1. In **admin.woku.app**, go to **Company → Audit log**.
2. You will see a paginated table (25 entries per page) with the
   most recent actions at the top.

## Which events are recorded

| Category       | Recorded events                                                                                                                                                                                                  |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication | `auth.login`, `auth.logout`, `auth.lockout`, `auth.unlock`, `auth.session.revoke`, `auth.mfa.enroll.start`, `auth.mfa.enroll.confirm`, `auth.mfa.verify`, `auth.mfa.disable`, `auth.mfa.backup-codes.regenerate` |
| Company        | `company.create`, `company.update`, `company.add-admin`, `company.remove-member`                                                                                                                                 |
| User           | `user.create`, `user.update-name`, `user.update-email`, `user.password-recover`                                                                                                                                  |
| Woku           | `woku.create`, `woku.update`, `woku.delete`, `woku.close`                                                                                                                                                        |
| Form           | `form.create`, `form.update`, `form.delete`                                                                                                                                                                      |

Each entry includes:

* **Exact date/time** (ISO 8601 with milliseconds).
* **Action** (one of the codes above).
* **Affected resource** and its ID when applicable.
* **Actor**: email of the user who executed the action (when there is
  an authenticated session).
* **IP** of the request (extracted from `x-forwarded-for` or direct IP).

## Filter

The filter bar lets you combine:

* **Action** (exact text, for example `auth.login`).
* **Resource** (exact text, for example `user` or `woku`).
* **Actor email**.
* **Date range** (From / To, both optional).

Click **Apply** to refresh the table with the filters.
**Clear** returns to the unfiltered state.

## Export to CSV

The **Export CSV** button downloads every entry that matches
the current filters (pagination is ignored; it always exports the
full match). The file is named
`audit-log-YYYY-MM-DD.csv` and contains the columns:

```
timestamp,action,resource,resourceId,actorEmail,actorId,companyId,ip,userAgent
```

Quotes, commas, and line breaks are escaped per RFC 4180.

## Retention

* **Default**: 365 days. After that date, MongoDB removes the
  entries via a per-document TTL index (`expireAt`).
* **Configurable per company**: a pending improvement will expose the
  setting in the Settings UI. For now, retention can be
  customized by contacting support.

## Guarantees

* **Fire-and-forget audit**: recording an event NEVER blocks
  or reverts the audited action. If the audit database is down,
  the action proceeds and the failure is logged internally.
* **Per-company isolation**: the `companyId` filter is always applied
  in UI queries. There is no way to list actions from another
  company.
* **Immutable**: entries are not edited or deleted by hand. They only
  expire via TTL.