Audit Logs

https://docs.evohub.io/mcp

claude mcp add --transport http evohub-docs https://docs.evohub.io/mcp

{
  "mcpServers": {
    "evohub-docs": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://docs.evohub.io/mcp"
      ]
    }
  }
}

{
  "mcpServers": {
    "evohub-docs": {
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

{
  "servers": {
    "evohub-docs": {
      "type": "http",
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

Audit Logs is your organization's trail: who did what, when, in every EvoHub product, in one list. It lives in EvoTrail, under Trail in its left-hand navigation. This page explains how to read it, filter it and export it, and who can see which rows.

#Open Audit Logs

• Open EvoTrail from the Services menu and choose Audit Logs.
• Or add the Audit Logs shortcut to the home page's Quick actions.

The old Organization → Audit Logs address opens this page.

#What a row shows

Each row has the action in words, for example Alert acknowledged, Role assigned to team or Two-factor sign-in turned on, the product it happened in, who did it and when. The newest rows come first, 50 to a page; use Older and Newer to page.

Who did it is the person's name, or:

• API key and the key's id, for an action taken with an API key,
• Automation, for something EvoHub did on its own, such as an integration resolving an alert,
• EvoHub support, for an action taken by EvoHub's support team.

Click a row to see what changed: Before, After and Details.

#Filter

• Product: Everything, or click one or more products. Each shows how many rows it has.
• From and To: the days to look at.
• Who: Anyone, or one person, with their number of rows.
• Action: type an action code, such as alert.acknowledged, or end it with * to match a group, such as alert.*. The suggestions list the actions found, in words and as codes.
• Team: Any team, or the rows about one team's things.
• Kind: Everything, Changes (kept 365 days) or Activity (kept 90 days). Changes are things such as editing a schedule or revoking a key; activity is day-to-day work such as moving a card.
• More filters: Request id, IP address, Resource type and Resource id.

Clear filters puts everything back. The filters are part of the page's address, so a filtered view can be bookmarked or shared; the people you share it with see only the rows they may read. Numbers in EvoTrail's Usage tab link here with the matching filters already set.

#Export

Export CSV downloads every row that matches the current filters, not just the page on screen, up to 100,000 rows. If more rows match, narrow the date range or filters and export again.

#Who sees what

Opening Audit Logs needs evotrail:audit:read. Owner, Admin and Member hold it by default; Viewer does not.

On top of that, each row needs its product's audit permission. A row you may not read is simply not listed.

By default, Members hold the audit permissions of Organization, On-Call, Uptime, Status Pages, Retro and Support. The Board, Docs and Changelog trails are an administrator's; give them to others with a custom role. A person whose own role is Owner or Admin sees every row.

#How long rows are kept

• Changes: 365 days.
• Activity: 90 days.
• IP addresses and browser details on a row: 90 days, after which the row stays without them.

These periods are the same for every organization and cannot be changed. To keep rows longer, export them regularly, or pull them with the EvoTrail API.

#Related

• EvoTrail overview
• EvoTrail API
• Security
• Roles and permissions