The activity log records every privileged operator action against your organization: workflow template edits, webhook changes, API key issuance, and other configuration mutations. Each row is an append-only audit event with the actor, the action, and the resource it touched.

## Open the activity log

Open **Activity** while the right organization is active in the top-right switcher. The feed shows the most recent 50 events, newest first.

The activity log is restricted to **Owner** and **Admin**. Other roles see a notice and the feed is hidden. See [Manage access](/guides/organizations/manage-access) for the role matrix.

## What appears in the log

Each row shows the event timestamp in your local time zone, the teammate who performed the action (name and email when the actor is still a member), the canonical action name (for example, `kyc.template.created`), the affected resource with a link where one exists, and a collapsible disclosure with the action metadata.

Action families currently surfaced:

- **Workflow templates** — `kyc.template.*` (created, AI-generated, preview token issued).
- **Webhook subscriptions** — `kyc.webhook.*` (created, updated, deleted, secret rotated).
- **Applicant verifications**: `kyc.session.*` (created, canceled, note added, resend, refresh link, manual review, PDF exported, applicant PII viewed).
- **API keys** — `kyc.api_key.created`, `kyc.api_key.revoked`.
- **Organization configuration** — branding updates and related settings changes.

Applicant-driven events appear with the `system` actor badge. The applicant's identifier is never rendered.

## Drill into an event

Click a row to expand it. The disclosure shows the structured metadata recorded with the event: a workflow template ID and change snapshot for an edit; a key prefix and the role that minted it for an API key issuance. Personal data is redacted at the source.

When the action targets a resource with its own console page, the row includes a link to it.

## Filter by actor, action, or date

Use the filter dropdown to scope by action family. Choose **All** to clear the filter. The URL reflects the active filter so you can share a filtered view.

Pagination is cursor-based. Use **Next page →** to walk back through history and **← Previous page** to step forward; both links preserve the current filter.

## Export the log

For exports, audits, or long-window analysis, use the public API with a key scoped to the right organization and mode. See [API keys](/developers/api-keys) and [Modes and regions](/developers/modes-and-regions).

## Retention

Audit events are retained for the full data-retention window configured for your organization. Rows are append-only — they cannot be edited or deleted, and applicant identifiers are scrubbed when an applicant exercises their right to erasure. The retention window is configured under [Compliance](/guides/organizations/compliance).

## Related

- [Staff actions](/guides/activity/staff-actions): Checktiv staff actions on your data
- [Manage access](/guides/organizations/manage-access) — who can read the activity log
- [Email log](/developers/email-log) — outbound transactional emails (separate from the audit log)
- [Glossary](/glossary)