Audit logs

Open in

View as Markdown

Open in ChatGPT Open in Claude

Conversa Labs

Last updated on Sep 7, 2026

Overview

Audit logs record the relevant actions taken in the account: configuration changes, agent and team management, permission changes and other administrative actions. They answer the question “who did what and when”, which is essential for security, compliance and incident investigation.

The list offers search by person, filters by event type and date range, and sorting. That is how you narrow thousands of events down to the handful that matter before investigating.

Prerequisites

The Administrator role to access the logs.
Audit logs is a premium/optional feature and may not be enabled on your account. If the area doesn't appear, talk to the account owner or support.

Step by step

In Settings, open Audit Logs in the sidebar.
View the chronological list of events: actor (who), action (what), target and date/time.
Use the available filters to narrow the scope (by period, by action type, etc.).
Use the search box in the header to find a person's actions by name or email. It kicks in from 3 characters onwards.
Pick an event type from the grouped list (Access, Agents & teams, Configuration, Conversations) or keep All events.
Set the date range in the date selector and the sort order (newest or oldest first).
Use Clear filters to go back to the full list.
Read the event row: it already carries the full description of the action, the time and the source IP address. The row is the whole record — there is no detail screen behind it.
For external analysis, read the same history through the API at GET /api/v1/accounts/{account_id}/audit_logs, which accepts exactly the filters of the screen (q, types, since, until, sort and page).

Settings & options

Chronological view: events from newest to oldest.
Filters: help locate a specific action among many records.
Search by person: the search box looks for an agent name or email. It starts from 3 characters and waits for a short typing pause before querying, so it doesn't fire on every keystroke.

Event type filter, organized into four groups:

Group	Available types
Access	Sign in / sign out
Agents & teams	Agents · Teams · Team members · Inbox collaborators
Configuration	Account settings · Inboxes · Webhooks · Automation rules · Macros
Conversations	Conversation deletions

Date range filter: the platform's standard date selector. The chosen range is applied from the start of the first day to the end of the last one.
Sorting: Newest first (default) or Oldest first.
Counter: the header shows the total number of events matching the current filters.
Clear filters: the button appears as soon as a search term, event type, date range or sort order is active.
State in the URL: search, type, period, sort order and page live in the page address. You can reload, use the browser's back/forward buttons and share the already-filtered link with another administrator.
Pagination: 25 events per page.
Columns: the activity described in plain text (who did what), the time and the source IP address.
Export: the screen does not export CSV. To take the events elsewhere, use the API named in step 9.
Retention: history is available according to your plan's policy. The platform does not prune these entries on its own and the screen has no retention field — the trail with a configurable window is the native one described below.
Native trail (Governance & LGPD): besides the premium logs, the account can enable the native audit trail, read from the Audit trail tab of Settings → Governance & LGPD — sign-ins, settings changes, role/routing template applies, agent and inbox changes, contact deletions and data subject requests, with admin-configurable retention. That trail has its own filters (Action, From and Until) and does not offer free-text search.

Use cases

Investigate when and by whom a setting was changed.
Confirm an agent's permission changes after a complaint.
Meet your company's compliance and security requirements.
Reconstruct an agent's day: search by their email and sort from oldest to newest.
Isolate configuration changes in a suspicious window: filter by Configuration and by the incident's period.
Check deletions: filter by Conversations → Conversation deletions.

Tips, limits & best practices

Combine audit with well-defined roles: less broad access means fewer surprises in the log.
Review logs periodically, not only after incidents.
Logs are read-only — they record history and should not be edited.
Search covers who performed the action (name or email), not the text of the event description. To answer “what changed”, combine event type + date range.
Filter before sharing: an already-filtered link saves the other person from repeating the whole investigation.
An unknown event type or sort order in the address is simply ignored, and the date range is only applied when both start and end are present.

Troubleshooting

I can't see the audit area: the premium feature is not enabled for the account.
I can't find a specific action: adjust the filters (period/type) and confirm the action is one that's recorded in audit.
Search returns nothing: it needs at least 3 characters and looks for a user's name or email — a fragment of the action description will not find the record.
The list says “There are no items matching this query”: active filters matched no event. Use Clear filters to start over.
I pasted a link and got fewer filters than expected: unsupported values are discarded when the address is read.
I want to export to a spreadsheet: the screen has no export button. Use the API from step 9 and convert the result.
I need more history: retention depends on the plan — talk to the account owner.