Audit log
The audit log is your tenant's own record of what people did in go flow: who signed in, who changed what, who moved money and, once you switch it on, who looked at client data. Your tenant is your group of organisations, or your single organisation if you have only one. The log lists the actions of every organisation in the tenant, newest first, and you can search it and narrow it by user, category, organisation and date.
The log tells you what happened and who did it. It never holds the data itself: a change is listed by the names of the fields it touched, not by their values. To see the old and new values of a record, and to put it back, use its record history.
Use it, for example, to find out who changed a session or a price, who refunded a payment, whether a colleague's sign-in failed or was locked, or what the automatic booking processes did overnight.
Opening the audit log
Choose Analytics > Audit log in the menu. The entry, and the page behind it, appear only for users who hold the Audit log right on your tenant; the entry shows under Analytics even for a user who has no other analytics right. The page shows the log as described below. (The separate review of client reads is not offered at present.)
Who can see it
Grant the right in the user's rights: Audit log, set to View. It is a view-only right, so there is no Manage level. It sits under Group level when your tenant has several organisations and under Organisation level when it has just one. The administrator of a newly created organisation receives it; existing users keep the rights they have, so grant it to them yourself.
Reading the list
Each row is one action. The columns are:
- Date — when it happened, in your local time.
- User — who did it (see Who is shown as the user).
- Organisation — the organisation the action belongs to, when it belongs to one.
- Category — one of the five categories below.
- Action — what happened, in words, for example Client changed or Signed in. Hover over it to see the action's key, for example
client.update. - Record — the record the action touched, shown by its name where it has one.
- Changes — the fields a change touched, by the names the app uses for them.
Click a column heading to sort by it (every column except Changes); the list starts newest first, 50 rows to a page.
Grouped rows
When one save writes several records of the same kind, for example twenty sessions generated at once, the log shows them as one row with a count chip such as 20 events. Open the row to list each record with its date and changes, and a History button where the record has one. Up to 200 are listed; for a larger group the list says "Showing 200 of N events."
The row detail
Open the arrow at the start of a row for the detail:
- Changes — every changed field as a chip.
- Details — facts about the action, such as an amount, a count or the reason an action was refused. Never personal data.
- Record — the record's type, with a History button when the record's type has a history and its organisation keeps record history (see Record history and restore).
- Source — where the action came from:
sync(an edit saved from the dashboard),endpoint(a direct action such as a refund),auth(signing in or out),booking(your online booking page) orworker(an automatic background process). - IP address and Device — where the request came from.
- Session — a short code that groups one session's actions. It is never the session itself.
- Sync batch — groups the rows that one save wrote together.
If nothing matches, the list reads "No audit entries match." If loading fails, a red banner explains why and offers Retry.
Filters
One row of controls sits above the list. Every change takes you back to the first page.
| Control | What it does |
|---|---|
| Search | Free text. Finds entries whose action key contains it (for example signin, client.update or denied), whose record type contains it (for example client), whose user has it in their first name, last name or email, or whose client actor has it in their email. Case does not matter. It does not match the words shown in the Action column: hover over an action to see its key. The list updates a moment after you stop typing. |
| Users | One or more dashboard users who have entries in your tenant's log, by name with their email beneath, former members included. go flow support is offered as one choice when support has entries. Clients and automatic processes are not listed; find a client's actions by searching for their email. |
| Category | One or more of the five categories. |
| Organisation | One organisation. Shown only when you work with more than one organisation. |
| From and to | Whole calendar days in your tenant's time zone, both days included. |
| Refresh | The circular arrow at the end of the row (tooltip Refresh) loads the list again with the same filters. |
Categories
| Category | What it records |
|---|---|
| Sign-in | Signing in and out, wrong passwords and codes, lockouts, password, two-factor and contact changes, answered invitations, and the same for your clients on the online booking page. |
| Data | Creating, changing, deleting and cancelling records: the record, the verb and the names of the changed fields, never the values. Also restoring a record from its history, erasing a client, marking feedback handled, emails sent from the dashboard, places held for a client, and tags or internal notes changed. |
| Money | Manual wallet adjustments, refunds, payments set at the desk, vouchers issued or changed, and online bookings paid or completed. |
| Administration | Changes to your subscription and tenant, and to the audit settings. Verdicts on client reads given while the review view was shown also sit here, as Access reviewed (audit.review), see Read logging. |
| Access | Reads of client data: a client opened, protected fields loaded, client data delivered to a device, an export built. Only while Log who reads client data is on, except exports and the loading of fields set to Always logged, which are always recorded. |
Entries you will meet
The Action column shows the words in the first column; the key is what you see when you hover and what Search finds.
| Action | Key | Category | Recorded when |
|---|---|---|---|
| Signed in, Sign-in failed, Two-factor check failed, Account locked | auth.signin, auth.signin.failed, auth.mfa.failed, auth.lockout | Sign-in | A user signs in, enters a wrong password or a wrong code, or is locked out after too many failed attempts. Details give the number of attempts, or the minutes of the lockout. See Login. |
| Signed out, Signed out on all devices | auth.signout, auth.signout.all | Sign-in | A user signs out of this device or of all devices. |
| Password changed, Password reset, Two-factor authentication reset | auth.password.changed, auth.password.reset, auth.mfa.reset | Sign-in | A user changes their password in Settings, completes a password reset, or confirms a reset of the authenticator app. |
| Invitation accepted, Invitation declined | auth.invitation.accepted, auth.invitation.declined | Sign-in | An invited user answers the invitation. |
| Switched tenant | auth.tenant.switched | Sign-in | A user enters your tenant. This is also how go flow support entering your tenant shows. |
| Client created, Client changed, Resource deleted, Appointment cancelled, … | client.create, client.update, resource.delete, appointment.cancel, … | Data | A record of that kind is created, changed, deleted or cancelled. The key is the kind of record and the verb: create, update, delete or cancel. |
| Earlier version restored | entity.restore | Data | A record was restored to an earlier version. Details give the version. |
| Client data erased | client.erase | Data | A client was erased on request. Details give counts only. See Erase a client. |
| Feedback handled | feedback.handle | Data | A feedback response was marked handled. Details say whether a note was written, never the note itself. |
| Email sent, Places held for a client, Metadata changed | email.send, participant.hold, metadata.update | Data | An email is sent from the dashboard, places are held for a client, or the tags or internal notes of an order, payment, wallet entry or voucher change. |
| Wallet adjusted, Payment refunded, Participant payment recorded | wallet.adjust, payment.refund, participant.payment | Money | A manual wallet credit or debit, a refund, a payment set at the desk. |
| Voucher created, Voucher changed, Voucher status changed | voucher.create, voucher.update, voucher.status | Money | Vouchers are issued, one is saved, or the status of several is changed at once. |
| Client signed in, Places reserved online, Participant cancelled, Online booking completed | client.signin, reservation.create, participant.cancel, checkout.complete | Sign-in, Data, Data, Money | A client signs in, reserves places, cancels or completes a booking on the online booking page. Participant cancelled is also used when staff cancel one participant. |
| Audit settings changed | audit.settings.changed | Administration | One of the four audit settings changed. Changes shows which. |
| Client record opened, Protected client fields viewed, Data synchronised to a device, Client data exported, Own activity viewed | client.read, client.read.sensitive, sync.deliver, client.export, user.activity.read | Access | See Read logging and Data subject export. |
Money entries carry their amounts in Details. A refund made as part of a cancellation is recorded on the cancellation, not as a separate refund.
Refused actions
When the system refuses an attempt to change data, the log keeps the action and marks it refused, for example Client changed – refused, with the key client.update.denied; search for denied to list them. Details gives the reason:
noRights— the user had no right on that organisation or resource.foreignRecord— the request named a record of another organisation or tenant.duplicateId— the same record appeared twice in one save.tampered— the request carried a value that cannot occur.
A refused entry belongs to the tenant but names no organisation and no record, since both come from the refused request.
Who is shown as the user
- A dashboard user appears by name, or by email when there is no name.
- A client acting on the online booking page appears as Client followed by their email.
- An automatic process appears by what it did, for example System (reservation expired), System (cancellation processed), System (no-show), System (promoted from the waitlist), System (post-visit follow-up), System (reminder scheduled), System (order activated), System (payment reconciled), System (refund reconciled) or System (retention period ended). Online booking is the booking site acting without a signed-in client. Older entries may show System (booking automation), and a plain System appears while a name is loading or when none is known.
- go flow support appears as a highlighted label, see below.
The lines that show who created and last changed a record (in its edit dialog and in the optional audit columns of a list) name people the same way, with two differences: go flow staff appear there as go flow admin, and a client as (client).
go flow support
When go flow support works inside your tenant, for example to help with a problem, what they do appears in your log with the user shown only as a highlighted go flow support label. Their name, email, IP address, device and session are never shown, the same label stands in for them in a record's history, and searching for their name finds nothing. Their entries sit in the same categories as everyone else's, so a change they make is listed like any other, and entering your tenant is itself an entry. To list only their actions, choose go flow support in Users.
What is kept, and for how long
- Entries cannot be edited or deleted through the app. Old ones are removed automatically when their period ends.
- Sign-in, Data, Money and Administration entries are kept for 13 months.
- Access entries are kept for the period you choose in your audit settings: 12 to 120 months, 24 by default, and 120 under the health care profile.
- Account events that belong to no tenant yet, such as a failed sign-in by a person who belongs to several tenants before one is chosen, are not part of a tenant's log. The person sees them in their own My activity.
My activity
My activity shows what you yourself did, whether or not you hold the Audit log right. Choose Account > My activity in the menu. The page reads "Your own actions in every tenant you work in, newest first." and uses the same list as the audit log, without the User column and without the Users and Organisation filters: Search, Category, From and to work as described above. It includes your sign-in events that belong to no tenant. Organisation and record names appear only for organisations of the tenant you are working in or on which you hold rights. When you have no entries yet it reads "No activity recorded yet."
Opening My activity is itself recorded as Own activity viewed (user.activity.read) in the Access category while your tenant logs reads.