Audit trail: evidence for your auditors

Use the Audit trail tab to see who did what and when across your company, filter the record and export it for your auditors or reviewers.

The Audit trail is your company's record of who did what in Loopfour, and when. Use it to answer a reviewer's questions, such as who changed a workflow before month end, or who approved a request from Studio. Use it alongside the runs themselves, which hold the detail of each piece of work.

Before you start

What it records

The audit trail records actions taken by people in Studio, and through the API, across these areas:

Workflows: created, changed, saved, deployed, paused, archived, restored and deleted.
Runs: runs started from Studio or through the API, and runs stopped from Studio or through the API.
Approvals: approvals and rejections made in Studio, including owner or admin overrides.
Tables: tables and folders created, changed, moved and deleted, and rows added, changed and deleted.
Files: files uploaded, replaced, downloaded and deleted.
Connections: systems connected, checked, refreshed, renamed, set as default and disconnected, and connect links created and used.
Secrets: workflow secrets added, changed and deleted. The secret values are not recorded.
Team: people invited, roles changed and people removed, and the MCP setting switched on or off.

Each entry has the time, the person (or "System"), the action and the item it applies to.

What to pull from elsewhere

Some evidence lives on the run, not in the audit trail:

Each run's steps, inputs and results. Open the run. See Read a run step by step.
Runs that start on their own, such as on a schedule or from an email. Find them on Runs, filtered by Trigger.
Run outcomes, such as completed or failed. Use the run's status on Runs. The Run Completed and Run Failed filters exist on the audit trail, but these entries are not recorded today, so they return no rows.
Decisions made from an email or Slack. These are stored on the approval and shown on the run's approval step as Decided by and Asked by. They do not add an audit trail entry.

Find entries

Open the Audit trail tab

Select Runs in the sidebar, then the Audit trail tab. It is not shown when you are looking at one workflow's runs, because the record covers the whole company.

In Studio: Runs > Audit trail. The Audit trail tab sits after the run tabs.

Filter the record

Narrow the list with:

Search actions..., which matches the action or the item name. For example, search "approval" to find decisions made in Studio.
The action filter, such as Created, Updated, Run Started or Row Updated.
The item type filter: Workflow, Table, Connection, File or User.
A from date and a to date. Dates are whole days in UTC.

Select Clear to remove the filters.

Open an entry

Select an entry to see more: the action, the item ID, the IP address and browser of the person, the source, and for changes, the values Before and After.

The list shows the 50 most recent entries that match your filters. To review a longer period, narrow the dates or export.

Export for your auditors

Set the filters

Choose the action, item type and dates you need. The search box narrows the list on screen only. The export uses the action, item type and date filters.

Select Export CSV

Select Export CSV. Your browser downloads a spreadsheet file named with today's date. The button is unavailable when the list is empty.

Check the file

The file has one row per entry, newest first, with these columns: entry ID, action, item type, item ID, item name, user ID, user name, user email, source, IP address and time. Times are in UTC.

Large exports

One export holds up to 10,000 entries, the newest first. For a busy period, export one month or one week at a time. The export does not include the before-and-after detail; open the entry in Studio for that.

No entries appear: clear the filters, or widen the dates. Remember the dates are UTC days.
The export did not download: the button shows a spinner while it works. If no file arrives, try again with a shorter date range.
A decision is missing: it may have been made from an email or Slack. Check the run's approval step.