> For the complete documentation index, see [llms.txt](https://finext.gitbook.io/one-kyc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://finext.gitbook.io/one-kyc/admin/audit.md).

# Audit

The **Audit** section holds a chronological log of every action performed in the system by users and API keys. The log delivers operational transparency, supports internal-control compliance, and enables incident investigation.

## Record structure

Each audit log record contains:

| Field              | Description                                                    |
| ------------------ | -------------------------------------------------------------- |
| **Date and time**  | When the action happened                                       |
| **User / API key** | Identifier of the actor that performed the action              |
| **Action type**    | Category of the operation                                      |
| **Object**         | Identifier of the affected resource (session, key, user, etc.) |
| **Details**        | Additional information about the action                        |

## Event categories

The log records the following action categories:

### Authentication and access

* Sign-in (successful and failed).
* Sign-out.
* Password reset.

### Verification management

* Session create, pause, resume, and cancel.
* Sending a session to manual review.
* Approving or rejecting verification in the Review section.

### Configuration

* Create, edit, and publish flows.
* Create and revoke API keys.
* Create, change, and delete webhook endpoints.
* Create and revoke verification links.

### Team management

* Invite and remove members.
* Change user roles.

### Settings

* Change tenant parameters.
* Change user profile.

## Filtering

The following filters help work with the log:

* **By period** — pick a time range (start and end date).
* **By user** — show actions of a specific team member or API key.
* **By action type** — filter by operation category.

Filters are combined, which lets you build precise selections for analysis.

## Exporting data

Audit log data can be exported:

1. Set the required filters.
2. Click **"Export"**.
3. Pick a file format.

Exported data is used for reporting, transfer to regulators, and internal investigations.

## Full action list

The platform records more than 70 action types covering the lifecycle of every entity. Tracked entities include sessions, reviews, flows, API keys, webhooks, verification links, team, billing, tenant settings, BYOB storage, and others. The full list is available in the "Action" filter on the **Audit** page in the admin panel. Key actions are described in [Audit (Tenant API)](/one-kyc/api/audit.md).

## Additional Admin API endpoints

* **`GET /v1/audit/stats`** — aggregated statistics for records (count for a period, distribution by category).
* **`GET /v1/audit/{id}`** — fetch a single audit record by id with all `details` fields.

## Retention period

Audit record retention is determined by the tenant's billing plan (the `data_retention_days` field on the billing plan). When the retention window expires, records are deleted automatically.

{% hint style="info" %}
For long-term retention, periodically export records. The current `data_retention_days` value for your tenant is shown in **Settings → Billing and usage**.
{% endhint %}