Audit log
The audit log records every state-changing action against your organisation: monitor created, channel edited, member invited, plan changed, etc. It’s append-only — you cannot edit or delete entries.
Audit log viewing and export is included on the Business plan only. The events themselves are recorded on every plan — upgrading to Business opens the existing history retroactively. The list lives at Settings → Audit log.
What gets logged
| Resource | Events |
|---|---|
| Monitor | create, update, pause, resume, delete, bulk action |
| Alert channel | create, update, test, delete |
| Alert rule | create, update, delete, acknowledge |
| Incident | create, update status, resolve, link / unlink |
| Status page | create, update, delete, viewer added / removed |
| Maintenance window | create, update, delete |
| Runner | enrol, suspend, revoke, token rotate |
| API key | create, update scopes, revoke |
| Member | invite, accept, role change, remove |
| Security policy | enable, disable, update |
| Billing | plan change, add-on purchase, cancel |
| Org | settings change, delete scheduled |
Sign-in / sign-out, password reset, and 2FA enrolment are logged for every user regardless of plan.
Row shape
Each entry has:
- Timestamp — UTC ISO 8601, millisecond precision.
- Actor — user id + email of the human who acted, or
api-key:<prefix>for programmatic actions. - Action — verb (
create,update,delete,acknowledge, etc.). - Resource type —
monitor,alert_channel,member, etc. - Resource id — UUID of the affected resource.
- Changes — JSON diff of
beforeandaftervalues where applicable. Sensitive fields (secrets, passwords, tokens) are redacted. - IP address + User agent — client context when available.
Filtering
The UI filters by:
- Date range — from / to.
- Action — create / update / delete / etc.
- Resource type — narrow to one resource class.
- Actor type — user vs API key.
Filters compose; an empty filter returns the entire log.
Export
The Export button opens a dialog with the same filters plus a format toggle (CSV or JSON). Files are streamed — even multi- million-row exports complete without buffering the whole result in memory.
The same export endpoint is available via the REST API at
GET /api/v1/audit-log/export with the filters as query params.
See the API reference for auth detail. Programmatic
access requires the calling user (or the user who issued the API
key) to hold a role with audit_log:view permission — Owner and
Admin by default.
Retention
Audit log entries are retained for the lifetime of the org. They are NOT pruned by the regular result-retention sweep — compliance relies on the log staying available.
When an org is deleted, audit log goes with it after the grace period expires.
Tips
- Plug the export endpoint into your SIEM. A daily cron that pulls the previous day’s entries gets you SOC-2-friendly long-term retention outside PathWatch.
- Audit log is the right place to ask “did that monitor change at 3am yesterday?” rather than guessing from check results.
- The actor on every API-key action is the key prefix, not the user. Rotate frequently if you need per-user attribution; create one key per consumer.