Platform ( Audit ) logs

Introduction

Platform Logs give you a centralised, chronological view of all activity across your Patchworks account - from user logins and settings changes to role management and error events. Use them to monitor what's happening, investigate incidents, and maintain a full audit trail.

Requires admin access. Only users with an admin role can view Platform Logs.

Where to find Platform Logs

Platform Logs live inside the Settings section of the main navigation. You'll see it listed as the fourth option on the Settings landing page.

1. Click the Settings icon in the left-hand navigation bar.

2. On the Settings landing page, select Platform Logs - labelled"View platform-wide activity logs".

3. The logs list loads automatically, defaulting to the All tab, ordered newest-first.

Settings landing page - Platform Logs is the fourth item

Viewing logs across multiple companies

If your account manages multiple child companies, you can use the Viewing company dropdown to scope logs to any combination of companies - or select All companies to see everything in one feed.

1. Open Platform Logs from Settings.

2. Click the Viewing company dropdown - it defaults to your current active company.

3. Select All companies to see every company's logs together, or use the search box within the dropdown to find and tick individual child companies.

4. Click Apply to reload the list with your selection

Each log entry displays a company chip (e.g. Test Dev Account) so you can always tell which company an event belongs to when viewing across multiple companies.

Filtering Logs

Use the filter bar at the top of the page to narrow down the log entries displayed. Filters are applied together when you click Apply.

Filter	Description
Viewing company	Select which company's logs to display. Switch between all managed companies from this dropdown.
Search logs	Free-text search across log event names and actor names (e.g. search Conor or Role Created).
From date	Filter to logs recorded on or after this date. Accepts dd/mm/yyyy format.
To date	Filter to logs recorded on or before this date. Use together with From date to define a precise range.
Order	Sort results by Newest first or Oldest first.

Click Clear to reset all filters back to their defaults without leaving the page.

Log tabs

Tab	What it contains
All	Every log entry across all categories - the default view.
Audit	Read-only activity: logins, logouts, password resets, session events.
Changes	Mutative events: entity creations, updates, and deletions.
Errors	Failed operations and system-level error events. A count of 0 is the healthy baseline.

Colour reference

Each log entry has a coloured dot that lets you instantly identify its category and sub-type without reading the event name. Here is the full reference:

Dot	Colour / shade	Category	Event types
🟢	Green	Creations & reactivations	created, user_reactivated
🟠	Orange — darker	Assignments	tier_assigned, subscription_assigned
	Orange — lighter	Updates	updated, user_updated, mapping_created
🔴	Red-700 (darkest)	Force deletions	company_force_deleted
	Red-500	Deletions	deleted, user_deleted, company_deleted
	Red-400 (lightest)	Soft removals	deduped_data_bulk_deleted, tier_removed, subscription_removed
	Red-600	Errors (level = error)	Any entry where the log level field is error. These appear in the Errors tab.
🟣	Purple — bold	Auth & account management	login, two_factor_enabled, two_factor_confirmed, password_updated, password_reset, oidc_assignment_created
	Purple — mid	Auth & account management	logout, two_factor_disabled, password_reset_requested, oidc_assignment_deleted, user_invite_sent
	Purple — faint	Auth failures	password_update_failed, password_reset_failed
🔵	Blue	Data operations	marketplace_app_installed, deduped_data_imported
	Blue — lighter	Data exports	deduped_data_exported, mapping_exported
🟡	Yellow	Flow canvas	flow_step_connected, flow_step_disconnected
⚫	Grey	Unrecognised	Any event type not matched by the above - may be a newer event type not yet assigned a colour.

Use the colour dots as a quick visual triage tool when reviewing the All tab - a dense cluster of red or faint-purple dots is a signal worth investigating even before reading the event names.

Log retention period

By default, Platform Logs are retained for 90 days. Submit a request to increase this up to a maximum of 180 days from the Company Admin page. Logs older than the configured retention period are automatically purged.

1. Navigate to Company Admin (accessible from the main navigation or your account menu).

2. Scroll to the Log settings section at the bottom of the page.

3. Here, a Patchworks admin can adjust the Log retention period (days) field - the default is90, and the maximum is 180.

Retention is per-company. If you manage multiple child companies, each company has its own independent retention setting. Navigate to each company's Company Admin page to adjust them individually.

Reducing the retention period will immediately schedule older logs for deletion. Logs outside the new window cannot be recovered once purged. Export any logs you need before reducing this value

Setting up Alerts

Alerts let you get notified automatically when specific log events occur - without having to manually check the Platform Logs page. For example, you can receive an alert whenever a login fails, or when a critical API error is recorded.

Alerts are managed separately at Settings → Alerts.

1. Go to Settings in the left-hand navigation.

2. Select Alerts from the Settings menu.

3. Click the + Create Alert button in the top-right corner.

4. Enter a Name for your alert (e.g. Error Alert, Login Failed Monitor).

5. Choose an Alert Type: currently Error is supported, with audit and change types coming soon.

6. Select the specific Event to trigger on - for Error type, options include Api Server Error, Failed Save, and Login Failed.

7. Click Save. The alert will appear in your alerts list and trigger whenever that event is logged.

Available alert events

Alert Type	Event	When it fires
Error	Api Server Error	An API call to an external service returns an unexpected server-side error.
	Failed Save	A data-save operation fails - e.g. a connector or mapping could not persist changes.
	Login Failed	A user authentication attempt fails (bad credentials, locked account, etc.).

Combine alerts with Notification Groups (Settings → Notification Groups) to route alert notifications to specific team members or channels like Slack or email.