Audit logs

An append-only record of logins, record access, changes, exports and admin activity.

The audit log records who did what, and when, across your organisation. It's append-only: entries can't be edited or deleted. Open it from Settings → Logs.

What's recorded#

Sign-ins, including trusted-device sign-ins.
Record access — every time records are listed or opened, recorded with actions such as records.listed.
Changes, down to the field: Changed Premium 18,000 → 18,400.
Exports — who exported what, and how many records.
Admin activity — membership, role and settings changes.
Denied attempts — for example, an API token trying to read a hidden Commission field.

Each entry shows when it happened, the actor (a person, a workflow or an API token), the action and the resource.

Finding what you need#

Filter the log by category, action, user and status (success or denied), and narrow it to a date and time range. Use Export CSV to take a filtered view into a compliance workflow or a spreadsheet.

Entries are retained for 45 days.

Question	How to answer it
Who exported customer data last week?	Filter the action to exports and set the date range
Why did this premium change?	Open the record's Activity tab, or filter the log by resource
Is anyone probing hidden fields?	Filter the status to denied

Through the API#

Audit logs live under /docs/api/audit-logs:

GET /audit-logs lists entries, paged with limit and cursor;
GET /audit-logs/facets returns the values you can filter by;
GET /audit-logs/config reads the retention settings;
PUT /audit-logs/config updates them.

Reading needs audit_logs:view; changing the configuration needs audit_logs:export.

bash

curl "https://api.klerc.co/api/v1/audit-logs?limit=100" \  -H "Authorization: Bearer $KLERC_TOKEN"

The reference doesn't document filter parameters beyond limit and cursor; use the facets endpoint to see what's available.