Platform Admin — Audit Log

Navigate to: Platform Admin → Audit Log (Super Admin only)

What it shows: A tamper-evident record of every platform-level operation — organization creation, plan changes, suspension actions, and admin impersonation events. Distinct from the per-organization Audit Export (section 12.12), this log covers super admin actions across all organizations.

Step-by-step:

1. Navigate to Platform Admin → Audit Log.
2. Use the Action Type filter to narrow results:
   • tenant_created — new organization added
   • plan_changed — organization’s plan was modified
   • tenant_suspended / tenant_activated — suspension state changes
   • impersonation — super admin logged in as another user
   • admin_transfer — admin role transferred
3. Use the Date Range picker to set the window.
4. Use the Actor filter to show only actions performed by a specific super admin.
5. Click Export to download the log as CSV for compliance review.

Log record fields:

Field	Description
timestamp	UTC timestamp of the action
action	Event type (see Action Type above)
actor.email	Email of the super admin who took the action
target.name	Name of the affected organization
changes	Before/after values for changed fields
ip_address	IP address of the admin at the time of the action

How to test: Create a new organization using Platform Admin → Tenants. Reload the Audit Log — a tenant_created event should appear with your super admin email as the actor and the new organization as the target.

API endpoint: GET /platform/tenants/:id/audit-logs

---

---