> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Track instrumented reconciliation configuration and operational changes with a filterable, tamper-evident record for troubleshooting.

The **Audit Logs** page in the Matcher UI provides a filterable record of instrumented changes made to reconciliation configuration and operations. Use it to investigate the actor, action, and recorded time for those workflows.

## Accessing the Audit Logs page

***

Navigate to **Matcher → Reporting → Audit Logs** in the left sidebar.

<Note>
  You need an administrator role or audit-log read access to open this page.
</Note>

## Verifying chain integrity

***

The **Tamper-evidence** panel sits above the filters. Click **Verify integrity** to re-verify the tenant audit hash chain. The check stays read-only (it never alters a record) and returns one of two verdicts:

| Verdict                               | Meaning                                                                                                                           |
| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Chain intact**                      | Every inspected record links to the previous one and matches its stored hash. The panel reports how many records were verified.   |
| **Chain TAMPERED — integrity broken** | The hash chain is broken at a reported position. The audit log can no longer be trusted as tamper-evident — escalate immediately. |

<Note>
  The chain can be longer than the inspection bound. The intact verdict then notes that the check inspected only the first records from the chain start. It also notes that the check skipped the most recent entries. A failed request shows an error with a **Retry** button. It is not a verdict.
</Note>

## Filters

***

Use the filter bar to narrow results. The **Actor** field accepts free text of up to 255 characters. The **Action** and **Entity type** fields accept free text of up to 50 characters each. None of them are dropdowns:

| Filter          | Description                                                                 |
| --------------- | --------------------------------------------------------------------------- |
| **Actor**       | The raw actor identifier recorded with the change (for example, `user-123`) |
| **Action**      | The operation performed (for example, `CREATE`, `UPDATE`, `DELETE`)         |
| **Entity type** | The type of resource that was changed (for example, `context`)              |
| **Date from**   | Start date for the time range                                               |
| **Date to**     | End date for the time range                                                 |

Click **Apply filters** to run the search. Applying filters resets pagination to the first page.

## Audit log table

***

<Frame caption="Figure 1. Audit Logs table.">
  <img src="https://mintcdn.com/lerian-49cb71fc/kb1KNsLI0JW1ssLF/en/products/matcher/ui/images/11-audit-logs.jpg?fit=max&auto=format&n=kb1KNsLI0JW1ssLF&q=85&s=e5cd497f35e380c3071bbf516eef86a4" alt="Matcher Audit Logs table listing recorded user and system actions" width="2000" height="1258" data-path="en/products/matcher/ui/images/11-audit-logs.jpg" />
</Frame>

Each row in the table displays the following columns:

| Column          | Description                                                                                                                            |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Entry**       | The audit log record ID, shown as a link to a dedicated detail page for that entry — useful for pasting into an incident ticket        |
| **Recorded**    | When the change was recorded                                                                                                           |
| **Action**      | The operation performed                                                                                                                |
| **Entity type** | The type of resource that was changed                                                                                                  |
| **Entity ID**   | Identifier of the affected resource                                                                                                    |
| **Actor**       | The raw actor identifier recorded with the change (for example, `user-123`), not a resolved person or system name                      |
| **Chain**       | The record's chain position (`#<sequence>`) and its record hash. Records written before the hash chain existed show **No chain proof** |
| **Changes**     | A **View** button that opens the recorded JSON audit payload. Rows with no JSON changes show a placeholder                             |

Use the **Previous** and **Next** buttons in the table footer to page through results. The footer also shows the current page number and the number of events on that page.

## Viewing change details

***

<Frame caption="Figure 2. Audit log changes panel showing the recorded JSON audit payload.">
  <img src="https://mintcdn.com/lerian-49cb71fc/kb1KNsLI0JW1ssLF/en/products/matcher/ui/images/12-audit-logs-expanded.jpg?fit=max&auto=format&n=kb1KNsLI0JW1ssLF&q=85&s=1e16b39b4f713d4e9e4d3c1b81790b2d" alt="Audit log entry showing the JSON audit payload recorded for the change" width="1556" height="862" data-path="en/products/matcher/ui/images/12-audit-logs-expanded.jpg" />
</Frame>

Click **View** in the Changes column to open the **Audit log changes** panel. The panel describes the recorded change (action, entity type, and entity ID), then shows the recorded JSON audit payload as a formatted block. Its fields depend on the operation. It does not guarantee a before-and-after schema.

You can also click the ID in the **Entry** column to open a dedicated detail page for that single entry.

<Note>
  If the original diff was larger than the audit payload cap, the row shows a **Diff truncated** marker. The panel explains that a marker envelope replaced the full change set. The complete diff is not recoverable from that record.
</Note>