Find an audit event and export its evidence
Filter recorded organization actions, inspect actor and metadata, and export exactly the verified page you are reviewing.
Before you start
- Select the organization whose actions you are investigating.
- An online, MFA-verified session with access to audit records.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Load a fresh audit snapshot
Open Admin → Audit Log and choose Refresh newest events. Check the retrieved time and matching-event count. The page uses a snapshot cutoff so paging through results is consistent; new events do not automatically move into that snapshot. Refresh again when you need events recorded after the cutoff.
Narrow the event set
Use Action and Resource type suggestions for the event you need, enter a full Resource ID to isolate a specific object, and set From (UTC) and To (UTC, inclusive) dates. For example, use api_key.created when checking key issuance. A filter change starts from the first page. Clear unnecessary filters if the event you expect is absent.
| Field or control | What to do |
|---|---|
| Action | The recorded action identifier, with suggestions showing its readable label. |
| Resource ID | Use the complete identifier, not the shortened ID displayed in a table row. |
| UTC date range | The end date includes that UTC day; take account of your local timezone when investigating an incident around midnight. |
Inspect the event and its metadata
Read the event timestamp, actor, action, and resource together. Open view in the metadata column to inspect the recorded operational fields. Follow a resource link when present to inspect its current state. If actor names cannot load, the recorded user IDs remain visible; use Retry actor names to resolve them without discarding the event evidence.
Page through the full matching result
Use Previous and Next to examine other pages while retaining the filter/cutoff. Distinguish the current page’s rows from the total matching events. A missing row on page one does not mean the action was never recorded. Use the resource ID or narrower dates to locate the relevant action instead of interpreting a sampled page as the entire audit history.
Export the page you reviewed
Choose Export this page. The console re-verifies that page before downloading a CSV; it does not export every matching page. The file includes event IDs, timestamp, user ID, action/resource, metadata, selected filters, cutoff, retrieval time, page number, and matching count. Inspect the browser download. Refresh before exporting a snapshot older than five minutes or after a verification error.
What you should see: The CSV’s scope fields explain exactly which page and filter state its rows represent.
If something doesn’t work
No file was downloaded after export verification failed.
Refresh newest events, reapply/check the filters and page, and export the current verified snapshot again. The UI deliberately does not download an unverified result.
Actor names are unavailable.
Use the recorded user IDs and Retry actor names. A directory lookup failure does not remove the recorded audit event.
The CSV contains fewer rows than the matching total.
Export this page downloads only the displayed page. The total is included as context, not a promise that every matching row is in that file.