Audit log
See who changed what in your helpdesk and when, from sign-in settings and API keys to rules, macros, tags and tickets, and export the entries.
On this page
Settings > Audit log is the record of who changed what in your helpdesk, newest first. Only admins can read it.
It holds two kinds of entry:
Account changes: sign-in and security settings, invites, roles, API keys, mailbox connections and helpdesk settings.
Helpdesk activity: tickets, customers, rules, macros, tags, fields, AI agent skills and the other things your team works with.
Entries name the person and the object by its number, such as Rule 100057 or Tag 10167. They never copy message text or customer details. To see who opened or read customer information, use the data access log instead.
Read an entry#
| Column | What it shows |
|---|---|
| When | Date and time, in the helpdesk's time zone. |
| Who | The person who did it. API key means a script using a key; System means the helpdesk itself, such as a scheduled job. Haylee, the AI agent, appears under her own name. |
| What | What happened, such as Rule created or Changed a member's role, with a badge saying Account or Helpdesk. |
| Details | Which object, and where it helps, the setting, the new role, the fields that changed or the rule that made the change. |
Find an entry#
The filters above the table narrow the list:
| Filter | Use it to |
|---|---|
| Source | Show Everything, only Account changes or only Helpdesk activity. |
| Agent | Show what one person did, or Anyone. |
| Action starts with | Match the start of the action's code, such as ticket, invite, rule or mfa for two-factor changes. |
| From and To | Limit the dates. |
The page loads the newest entries first. Select Show older entries at the bottom to go further back.
Export it#
Export shown entries downloads the entries currently on screen, with your filters applied, as a CSV file named audit-log.csv. It has the time, source, action, object type and number, the person and their id, how the change was made (app or API key) and the details. Load older entries first if you need them in the file.
What gets recorded#
| Area | Examples |
|---|---|
| Sign-in and security | Signed in, linked a Google account, turned two-factor on or off, made new recovery codes, required or relaxed two-factor for the organization |
| People | Sent, withdrew or accepted an invite, changed a member's role, removed a member, left the organization, user added, changed or deactivated, status changed |
| Keys and connections | Created or revoked an API key, connected, reconnected, changed or disconnected a mailbox, HTTP integration test sent |
| Helpdesk setup | Changed a helpdesk setting or the helpdesk's details; rules, macros, tags, ticket fields and views created, changed, archived or deleted; AI agent skills created; AI agent account linked |
| Tickets and customers | Ticket created, updated, assigned, closed or reopened; message added; tags added or removed; customer created or updated; rule ran; macro applied; survey answered; AI agent draft created or discarded |
| Growth Dept access | Growth Dept admin viewed the helpdesk, each time Growth Dept staff open your helpdesk to help |
Entries stay readable after a user is deactivated. When a helpdesk is deleted, its audit entries are kept, because they hold no customer data.
Related articles
- Data access logCheck who read customers' details, tickets and messages, through the app or the REST API, from which network address, for the past year.
- Manage usersInvite people, change their role, deactivate someone who has left and hand the owner role to someone else.
- The REST API and API keysFind your API address, create and revoke keys, and connect your own scripts and tools to the helpdesk, including tools written for Gorgias.
- Customer data and privacyErase a customer's data when they ask, what happens to card numbers and other sensitive details in messages, and how long the helpdesk keeps what.
Still stuck?
Write to the Growth Dept team and a person answers. Say which helpdesk you work in and what you were trying to do.