Audit log and data export
The audit log records administrative actions in your workspace: who did it, what changed and when. Data Export downloads browser-intelligence data as files. Both leave a trail, and exports are listed in an export history.
What it is
Availability: Availability depends on your plan, role and the modules enabled for your organisation.
| Page | Path | Who can use it |
|---|---|---|
| Audit Log | Backoffice → Administration → Audit Log | Analyst, admin and superadmin roles. Viewers and billing users cannot open it. |
| Export buttons on the Audit Log | Audit Log → Export CSV, Export JSON | Admin role, with a step-up MFA check from the last 6 hours |
| Data Export | Backoffice → Administration → Exports (page title Data Export) | Admin role, with a step-up check |
| Export history | Data Export → History tab | Admin role. No step-up check for reading the list. |
The audit log is scoped to your workspace. A workspace admin never sees another workspace’s entries. When Noxtica platform staff read another workspace’s audit log, that read is itself audited.
The audit log supports your own review. It does not by itself certify that you meet a regulation or a standard.
Audit log fields
| Column | Content |
|---|---|
| Time | When the action was recorded. |
| User | The email of the person, or the user id if no email is stored, or System for an automated action. |
| Action | A label such as Login, MFA Disabled, API Key Created, Role Changed or Data Export, with a severity icon. An action without a label shows its raw name with underscores replaced by spaces. |
| Target | What the action touched, for example a user email, a domain or audit_log. |
| Details | Structured details for the entry. Click to expand when the details are long. |
Platform staff see an extra Tenant column. You do not.
Examples of what is recorded: sign-in, failed sign-in and sign-out, MFA setup, enable, disable and failed verification, user creation, disabling, enabling and role changes, password resets, API key creation and revoke, domain creation, update and site-key rotation, workspace setting changes, plan-change requests, workspace switches, membership changes, mobile attestation app registration and revoke, IP allowlist rule changes, SCIM token creation and revoke, package cancellation, and data exports. Automated billing warnings appear with the user System and the actor system:wallet-balance-watch in the details.
How long entries stay depends on your plan. Backoffice → Privacy & Legal → Data retention shows the window for the audit log as a read-only row. See Data retention, raw IP storage and data locations.
Prerequisites
- Analyst role or higher to read the audit log.
- Admin role to export.
- MFA enrolled on your account, so you can pass the step-up check for exports. See Sign-in, SSO, SCIM, MFA and IP allowlist.
- For API exports: a Server API key with the
read:exportscope. See Authentication.
Steps
1. Open the audit log
Go to Backoffice → Administration → Audit Log. The subtitle shows the entry count. The list is newest first, 50 entries to a page, with Previous and Next.
2. Filter the entries
| Control | What it does |
|---|---|
| Filter by action | A grouped list: Authentication, MFA, Users, Domains, API Keys, Tenants, Plan Changes, Data and others. |
| Filter by user | One person in your workspace. |
| Search by email | Matches the user email. Press Enter or click Search. |
| Search target or details | Matches text in the target and in the details. Use it for actions that are not in the action list. |
| From date, To date | An inclusive range. A date alone covers the whole day. |
| Reset filters | Clears every filter. |
Use the saved-views menu to keep a preset of the action, user, date range and detail filters.
3. Read one entry
Check the Action badge for severity, the User for who acted, and the Target for what was touched. Expand Details to see the recorded fields.
4. Export the audit log
- Set the Action and User filters you need.
- Click Export CSV or Export JSON.
- Complete the step-up prompt if Backoffice shows one.
The file is named audit_log_<date>.csv or audit_log_<date>.json. The JSON file is an array of entries. The export applies the Action and User filters. It does not apply the date range or the text searches.
An export returns up to 50,000 rows per request by default. Each user can export up to 100,000 rows per UTC day by default. The platform can change both limits. Every export writes a Data Export row to the audit log with the row count and the format.
5. Run a data export
Go to Backoffice → Administration → Exports and stay on the New export tab.
-
Choose the Endpoint:
Endpoint Content Devices The latest fingerprint record per device: device ID, payload, risk score, risk level, flags, country, city and timestamps. Events Every fingerprint submission: device ID, domain, payload, risk score, flags, country and timestamp. Visits Visit events where collection was skipped: device ID, domain, country, metadata and timestamp. Scored events Per-event verdicts as a JSONL stream: event ID, device, domain, score, attestation tier, band, confidence, reason codes and timestamp. Reason codes are filled only when explainability is enabled for your organisation. -
Choose the Format: CSV or JSON. Scored events are always JSONL (NDJSON), one event per line.
-
Set From Date and To Date. Dates are read as UTC. The range can be up to 366 days and the end date cannot be in the future.
-
Optionally pick a Domain. Open Show advanced filters for Country (ISO-2), Language, Platform and a Score Min and Score Max from 0 to 100.
-
Click Download · and complete the step-up prompt if shown.
The whole file is prepared before it downloads. Large windows can take up to a minute. A success message reads Exported N records. Cancel export stops a running export and nothing is downloaded.
The payload column carries an allow-listed projection of the client payload. It is the same projection the Fingerprint detail page shows. The unprojected payload is not available to workspace admins.
Exports can contain personal data. Handle the files under your own policy. See Privacy.
6. Review export history
Open the History tab. Each row shows who ran the export, the tenant scope, the surface, the window, the format and the row count. Surfaces include Fingerprints export, Events export, Visits export, Scored events export, Audit log export, Client RUM errors export, Client RUM console logs export, KYC evidence manifest and Access review export.
Export files are not kept. Open with these filters returns you to the page that made the export with the same filters. The export does not run again until you download it there.
7. Pull exports from your backend
Your backend can read the same data over the Server API with a key that has the read:export scope:
GET /v1/exports/fingerprintsGET /v1/exports/eventsGET /v1/exports/visitsGET /v1/exports/scored-events
Parameters, paging, row caps and rate limits are in the generated reference. See API reference and Errors. The routes are rate limited for each key. Over the limit you get 429 with a Retry-After header.
Verify it works
- The audit log shows a Data Export row for your export, with you as the user and a record count in the details.
- The downloaded file opens, and the row count matches the success message.
- The History tab lists the export with your email, the window and the row count.
- A filtered audit log shows only the entries that match the filters, and Reset filters brings the full list back.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Audit Log is missing from the menu | Your role is viewer or billing. | Ask an admin for the analyst role. |
| No audit entries | No entries match the filters. | Click Reset filters. |
| Could not load audit log | The read failed. | Click Retry. |
| Verification cancelled — nothing was changed. | You closed the step-up prompt, or the last MFA verification is older than 6 hours. | Export again and verify when prompted. |
| Export buttons are missing or refused | Your role is analyst. Exports need the admin role. | Ask an admin to export. |
Export failed: Daily export row quota exceeded (429, code EXPORT_QUOTA_EXCEEDED) | The per-user daily row quota is used up. | Wait until the next UTC midnight. The Retry-After response header gives the seconds. |
| Date range is too large. Please select a range of 366 days or less. | The range is longer than 366 days. | Split the export into windows. |
| To date cannot be in the future. | The end date is after today. | Use today or an earlier date. |
| The export is smaller than expected | The per-request row cap was reached. | Narrow the window or the filters and export in parts. |
| An audit export ignores your date range | The audit export buttons apply only the Action and User filters. | Export, then filter the file. |
| The Scored events file has empty reason codes | Explainability is not enabled for your organisation. | Ask your account team. |
| History says no exports recorded | No server-side export has run for this workspace since history was recorded. | Run an export. |
Related
- Roles and permissions: who holds export and audit capabilities.
- Sign-in, SSO, SCIM, MFA and IP allowlist: changes to sign-in settings appear in the audit log.
- Data retention, raw IP storage and data locations: retention windows and data locations.
- API reference: the
/v1/exports/*routes. - Billing status, grace period and reminders: billing warnings that are written to the audit log.