# Audit trail

> A record of who changed what and when — for compliance, incident review and settling disputes.

> For the complete documentation index, see [llms.txt](https://helpdesk.orangescrum.com/llms.txt).

Source: https://helpdesk.orangescrum.com/guide/cloud/admin/audit-trail

---
> **Premium Unlimited**
>
> The audit trail and activity logs are Premium features.

The audit trail records actions across the workspace: who did it, what changed,
and when. It is the record you need when something is queried months later and
nobody's memory is reliable.

## What it covers

| Area | Recorded |
| --- | --- |
| **Access** | Sign-ins, role changes, project membership |
| **Data** | Task, project and field changes |
| **Time** | Timesheet submissions, approvals, corrections |
| **Admin** | Settings, subscription, feature toggles |
| **API** | Every [Developer API](https://helpdesk.orangescrum.com/guide/api/introduction) and [MCP](https://helpdesk.orangescrum.com/guide/mcp/introduction) request, with status code and response time |

Individual tasks also carry their own activity history — see
[Task details](https://helpdesk.orangescrum.com/guide/cloud/tasks/task-details#activity-history). The audit
trail is the workspace-wide view.

## What it's actually for

- **Compliance evidence**: Demonstrating access control and change history to an auditor.

- **Incident review**: What changed just before things went wrong.

- **Billing disputes**: When a client queries an invoice, the trail shows when time was logged, submitted, approved and amended.

- **Offboarding checks**: Confirming access was actually removed.

## Using it well

**Know how to search it before you need to**

    Nobody learns a new tool well during an incident. Run a query now.

**Narrow by time first**

    Then by person or object. Starting broad returns more than you can read.

**Establish the sequence**

    The order of events usually tells you more than any single entry.

**Export what matters**

    For a formal investigation or audit, export the relevant window rather than
    relying on it staying queryable.

## API and MCP activity

Every API request is logged with its status code and response time — including
[MCP](https://helpdesk.orangescrum.com/guide/mcp/introduction) tool calls from an AI assistant.

This is the authoritative record of what an assistant actually did, as opposed
to what it reported doing. If you have connected a read-write key, this log is
how you verify the workflows before widening trust.

> **Tip**
>
> One API key per integration makes this log far more useful — you can tell
> which system made each call.

## What it is not

> **Not a backup, and not a productivity monitor**
>
> The audit trail records that a change happened; it does not let you restore
> the previous state. And using it to monitor individual activity is both a poor
> measure and a fast way to lose the team's trust — it exists for security and
> compliance.

## Related records

- [Task activity](https://helpdesk.orangescrum.com/guide/cloud/tasks/task-details): Per-task history, visible to everyone on the project.

- [Timesheet history](https://helpdesk.orangescrum.com/guide/cloud/time/timesheets-and-approvals): Submissions, approvals and corrections.

- [Security](https://helpdesk.orangescrum.com/guide/cloud/admin/security): The controls the trail records.

- [Users and roles](https://helpdesk.orangescrum.com/guide/cloud/admin/users-and-roles): Access changes that appear here.