Dark
Request a walkthrough
On this page
Developer overview

Audit log and data export

The audit log records administrative actions in your workspace: who did it, what changed and when. Data Export downloads browser-intelligence data as files. Both leave a trail, and exports are listed in an export history.

Key points

  1. Analysts can read the logAnalyst and above open the Audit Log. Exports need the admin role and a step-up check.
  2. The audit export keeps two filtersAudit exports apply the Action and User filters only, not the date range or text search.
  3. Exports are boundedData exports cover at most 366 days, and per-user daily row quotas return 429 when used up.
  4. Every export is recordedEach export writes a Data Export row and appears in export history. Files are not kept.
  1. What it is
  2. Prerequisites
  3. Steps
  4. Verify it works
  5. Troubleshooting
  6. Related
How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

PagePathWho can use it
Audit LogBackoffice → Administration → Audit LogAnalyst, admin and superadmin roles. Viewers and billing users cannot open it.
Export buttons on the Audit LogAudit Log → Export CSV, Export JSONAdmin role, with a step-up MFA check from the last 6 hours
Data ExportBackoffice → Administration → Exports (page title Data Export)Admin role, with a step-up check
Export historyData Export → History tabAdmin role. No step-up check for reading the list.

The audit log is scoped to your workspace. A workspace admin never sees another workspace’s entries. When Noxtica platform staff read another workspace’s audit log, that read is itself audited.

The audit log supports your own review. It does not by itself certify that you meet a regulation or a standard.

Audit log fields

ColumnContent
TimeWhen the action was recorded.
UserThe email of the person, or the user id if no email is stored, or System for an automated action.
ActionA label such as Login, MFA Disabled, API Key Created, Role Changed or Data Export, with a severity icon. An action without a label shows its raw name with underscores replaced by spaces.
TargetWhat the action touched, for example a user email, a domain or audit_log.
DetailsStructured details for the entry. Click to expand when the details are long.

Platform staff see an extra Tenant column. You do not.

Examples of what is recorded: sign-in, failed sign-in and sign-out, MFA setup, enable, disable and failed verification, user creation, disabling, enabling and role changes, password resets, API key creation and revoke, domain creation, update and site-key rotation, workspace setting changes, plan-change requests, workspace switches, membership changes, mobile attestation app registration and revoke, IP allowlist rule changes, SCIM token creation and revoke, package cancellation, and data exports. Automated billing warnings appear with the user System and the actor system:wallet-balance-watch in the details.

How long entries stay depends on your plan. Backoffice → Privacy & Legal → Data retention shows the window for the audit log as a read-only row. See Data retention, raw IP storage and data locations.

Prerequisites

  • Analyst role or higher to read the audit log.
  • Admin role to export.
  • MFA enrolled on your account, so you can pass the step-up check for exports. See Sign-in, SSO, SCIM, MFA and IP allowlist.
  • For API exports: a Server API key with the read:export scope. See Authentication.

Steps

1. Open the audit log

Go to Backoffice → Administration → Audit Log. The subtitle shows the entry count. The list is newest first, 50 entries to a page, with Previous and Next.

2. Filter the entries

ControlWhat it does
Filter by actionA grouped list: Authentication, MFA, Users, Domains, API Keys, Tenants, Plan Changes, Data and others.
Filter by userOne person in your workspace.
Search by emailMatches the user email. Press Enter or click Search.
Search target or detailsMatches text in the target and in the details. Use it for actions that are not in the action list.
From date, To dateAn inclusive range. A date alone covers the whole day.
Reset filtersClears every filter.

Use the saved-views menu to keep a preset of the action, user, date range and detail filters.

3. Read one entry

Check the Action badge for severity, the User for who acted, and the Target for what was touched. Expand Details to see the recorded fields.

4. Export the audit log

  1. Set the Action and User filters you need.
  2. Click Export CSV or Export JSON.
  3. Complete the step-up prompt if Backoffice shows one.

The file is named audit_log_<date>.csv or audit_log_<date>.json. The JSON file is an array of entries. The export applies the Action and User filters. It does not apply the date range or the text searches.

An export returns up to 50,000 rows per request by default. Each user can export up to 100,000 rows per UTC day by default. The platform can change both limits. Every export writes a Data Export row to the audit log with the row count and the format.

5. Run a data export

Go to Backoffice → Administration → Exports and stay on the New export tab.

  1. Choose the Endpoint:

    EndpointContent
    DevicesThe latest fingerprint record per device: device ID, payload, risk score, risk level, flags, country, city and timestamps.
    EventsEvery fingerprint submission: device ID, domain, payload, risk score, flags, country and timestamp.
    VisitsVisit events where collection was skipped: device ID, domain, country, metadata and timestamp.
    Scored eventsPer-event verdicts as a JSONL stream: event ID, device, domain, score, attestation tier, band, confidence, reason codes and timestamp. Reason codes are filled only when explainability is enabled for your organisation.

  2. Choose the Format: CSV or JSON. Scored events are always JSONL (NDJSON), one event per line.

  3. Set From Date and To Date. Dates are read as UTC. The range can be up to 366 days and the end date cannot be in the future.

  4. Optionally pick a Domain. Open Show advanced filters for Country (ISO-2), Language, Platform and a Score Min and Score Max from 0 to 100.

  5. Click Download · and complete the step-up prompt if shown.

The whole file is prepared before it downloads. Large windows can take up to a minute. A success message reads Exported N records. Cancel export stops a running export and nothing is downloaded.

The payload column carries an allow-listed projection of the client payload. It is the same projection the Fingerprint detail page shows. The unprojected payload is not available to workspace admins.

Exports can contain personal data. Handle the files under your own policy. See Privacy.

6. Review export history

Open the History tab. Each row shows who ran the export, the tenant scope, the surface, the window, the format and the row count. Surfaces include Fingerprints export, Events export, Visits export, Scored events export, Audit log export, Client RUM errors export, Client RUM console logs export, KYC evidence manifest and Access review export.

Export files are not kept. Open with these filters returns you to the page that made the export with the same filters. The export does not run again until you download it there.

7. Pull exports from your backend

Your backend can read the same data over the Server API with a key that has the read:export scope:

  • GET /v1/exports/fingerprints
  • GET /v1/exports/events
  • GET /v1/exports/visits
  • GET /v1/exports/scored-events

Parameters, paging, row caps and rate limits are in the generated reference. See API reference and Errors. The routes are rate limited for each key. Over the limit you get 429 with a Retry-After header.

  1. Open the audit log

    Go to Administration, Audit Log.

  2. Filter

    Use action, user, email search, target or detail search and a date range.

  3. Export the log

    Click Export CSV or Export JSON and complete the step-up prompt.

  4. Run a data export

    Choose endpoint, format and dates up to 366 days, then download.

  5. Review history

    Open the History tab for who exported what and with which filters.

Reading, filtering and exporting

Verify it works

  • The audit log shows a Data Export row for your export, with you as the user and a record count in the details.
  • The downloaded file opens, and the row count matches the success message.
  • The History tab lists the export with your email, the window and the row count.
  • A filtered audit log shows only the entries that match the filters, and Reset filters brings the full list back.

Troubleshooting

SymptomCauseFix
Audit Log is missing from the menuYour role is viewer or billing.Ask an admin for the analyst role.
No audit entriesNo entries match the filters.Click Reset filters.
Could not load audit logThe read failed.Click Retry.
Verification cancelled — nothing was changed.You closed the step-up prompt, or the last MFA verification is older than 6 hours.Export again and verify when prompted.
Export buttons are missing or refusedYour role is analyst. Exports need the admin role.Ask an admin to export.
Export failed: Daily export row quota exceeded (429, code EXPORT_QUOTA_EXCEEDED)The per-user daily row quota is used up.Wait until the next UTC midnight. The Retry-After response header gives the seconds.
Date range is too large. Please select a range of 366 days or less.The range is longer than 366 days.Split the export into windows.
To date cannot be in the future.The end date is after today.Use today or an earlier date.
The export is smaller than expectedThe per-request row cap was reached.Narrow the window or the filters and export in parts.
An audit export ignores your date rangeThe audit export buttons apply only the Action and User filters.Export, then filter the file.
The Scored events file has empty reason codesExplainability is not enabled for your organisation.Ask your account team.
History says no exports recordedNo server-side export has run for this workspace since history was recorded.Run an export.