> ## Documentation Index
> Fetch the complete documentation index at: https://developers.essal.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

> How Essal Guard captures, stores, and surfaces audit trail data for all platform activity.

Every action taken across the Essal platform — whether via the dashboard, API, or a connected integration — is recorded in the **Guard audit log**. The audit log is immutable, tamper-evident, and central to security and compliance investigations.

## What Gets Logged

The audit log captures:

* All API requests (successful and failed)
* Authentication events (logins, logouts, MFA verifications, failed attempts)
* Permission changes (role updates, policy activations, SSO changes)
* Data modifications (create, update, delete on any entity)
* Administrative actions (workspace settings changes, user provisioning)

## Log Entry Format

```json theme={null}
{
  "id": "evt_01HXYZEVT9",
  "timestamp": "2026-07-10T15:23:44Z",
  "actor": {
    "type": "user",
    "id": "usr_01HXYZ1234",
    "email": "jane.doe@example.com",
    "ip_address": "203.0.113.45"
  },
  "action": "guard.policy.updated",
  "resource": { "type": "guard.policy", "id": "pol_01HXYZPOL1" },
  "outcome": "success",
  "changes": {
    "before": { "status": "inactive" },
    "after": { "status": "active" }
  }
}
```

## Accessing Audit Logs

Query audit logs via the Guard API or the Essal dashboard. See [View Audit Trail](/guides/guard/view-audit-trail) for filter options and export instructions.

```bash theme={null}
GET /v1/guard/audit-logs?action=guard.policy.updated&outcome=success
```

## Retention

| Plan       | Default Retention            |
| ---------- | ---------------------------- |
| Standard   | 90 days                      |
| Business   | 1 year                       |
| Enterprise | Configurable (up to 7 years) |

Configure retention in **Guard → Settings → Retention**.

## Tamper Evidence

Audit log entries are signed with a per-entry hash chain. Any modification to an existing entry would invalidate all subsequent hashes, making tampering detectable. Essal's internal compliance monitoring scans for hash chain breaks on a continuous basis.

## SIEM Integration

Export audit logs to your SIEM in real time by subscribing to Guard events via webhooks or using the streaming export endpoint in `ndjson` format.