> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ontime.hosai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# The audit log

> The per-employee record of who changed what and when, with facets, period filters and CSV export.

export const PermissionNote = ({perm}) => <Info>
    Requires the <code>{perm}</code> permission. Ask your administrator if an
    action described here is missing from your screen — see
    [Roles & permissions](/help/concepts/roles-and-permissions).
  </Info>;

<PermissionNote perm="audit:read" />

The audit trail is per employee, on the **Audit** tab of their record. It answers "who did this to this person's file, and when".

## What is recorded

Every mutating administrative action. An entry carries who acted, when, what resource, what action, and — for updates — the before and after values.

### Actions

`Create` · `Update` · `Delete` · `Approve` · `Reject` · `SignOut`

### Categories

| Category       | Covers                                                        |
| -------------- | ------------------------------------------------------------- |
| `Profile`      | Employee record edits.                                        |
| `Compensation` | Salary revisions.                                             |
| `Attendance`   | Manual punches, day overrides, bulk range applications.       |
| `Leave`        | Leave decisions, on-behalf filings, leave type configuration. |
| `Documents`    | Uploads, verifications, deletions.                            |
| `Devices`      | Device and session revocations.                               |
| `Permissions`  | Role changes.                                                 |
| `Login`        | Authentication events.                                        |
| `Payroll`      | Cycle stage transitions, component changes, line overrides.   |
| `Compliance`   | Filing generation, amount overrides, marking as filed.        |
| `Other`        | Everything else.                                              |

### Resources

Entries name what was touched — employee, role, punch, day record, leave request, regularization, overtime, swap, document, device, session, organization, roster, shift, salary component, payroll cycle, compliance filing, leave type, salary revision, payroll line override, report, integration, API key, webhook, device, terminal user mapping.

## Reading it

<AccordionGroup>
  <Accordion title="Facets" icon="filter">
    Counts per category, so you can jump straight to the payroll changes or the attendance overrides without scrolling.
  </Accordion>

  <Accordion title="Period filters" icon="calendar">
    Day, week and month windows, with counts.
  </Accordion>

  <Accordion title="Load more" icon="chevron-down">
    Paginated rather than infinite — a long-serving employee's trail is large.
  </Accordion>
</AccordionGroup>

## Export

CSV of the current view.

## Where approvals appear

Approvals are audited **unconditionally**, on both outcomes — an approval and a rejection both produce an entry, and the entry is written whether or not the notification succeeded. So the audit trail is the authoritative record of a decision, not the notification.

## What the audit log is good for

<CardGroup cols={2}>
  <Card title="Explaining a payslip" icon="indian-rupee">
    An attendance override or a compensation revision in the relevant month usually explains a surprising number, and names who made it.
  </Card>

  <Card title="Access review" icon="shield">
    Permission-category entries show when someone's role changed and who changed it.
  </Card>

  <Card title="Dispute resolution" icon="scale">
    An approval entry records who decided, when, and what the request said.
  </Card>

  <Card title="Statutory inspection" icon="file-text">
    Manual attendance entries carry the reason that was given at the time.
  </Card>
</CardGroup>

## Limits

<Note>
  **The audit view is per employee.** There is no organization-wide audit browser — you look up a person, not a time window across everyone. If you need cross-employee analysis, export from several records or use the public API.

  There is also no retention policy or archival: entries accumulate indefinitely.
</Note>