Audit Log
The account audit log records every user action that changes the settings or the security of your account. Use it to review recent changes, to find unexpected activity, or to meet a compliance requirement.
Viewing the audit log
- Go to Settings → Audit Log (
/app/settings/account/audit-log). - The page lists the most recent entries first.
Each entry shows:
| Field | Description |
|---|---|
| Timestamp | The time of the action (UTC). |
| Action | A description of what happened. |
| Details | The key identifiers for the action, for example the webhook name. |
| IP address | The client IP address that made the action. |
Audited actions
Conduit records these actions:
| Action | Trigger |
|---|---|
| Password changed | A password change in the UI or through the API. |
| Account deleted | The start of an account deletion. |
| Two-factor auth enabled | A successful TOTP 2FA setup. |
| Two-factor auth disabled | A TOTP 2FA disable. |
| Backup codes regenerated | A new set of 2FA backup codes. |
| API token created | A new API token. |
| API token revoked | A revoked (deleted) API token. |
| Webhook created | A new webhook. |
| Webhook updated | A change to the webhook settings, an activation, or a deactivation. |
| Webhook deleted | A deleted webhook. |
| Webhook secret rotated | A rotation of the webhook signing secret. |
| Domain claimed | A new custom domain. |
| Domain verified | A completed DNS verification for a domain. |
| Domain deleted | A removed custom domain. |
| SMTP policy created | A new SMTP security policy. |
| SMTP policy updated | A change to an SMTP security policy. |
| SMTP policy deleted | A deleted SMTP security policy. |
Retrieving audit logs through the API
The audit log is also available through the REST API:
GET /api/v1/accounts/me/audit-log
The endpoint accepts an optional limit query parameter (1 to 200, default 50).
curl -H "Authorization: Bearer $TOKEN" \
"https://your-conduit.example.com/api/v1/accounts/me/audit-log?limit=100"
Each entry in the response has this shape:
{
"id": "al_01HX...",
"action": "webhook.created",
"metadata": { "id": "wh_01HX...", "name": "My Webhook" },
"ip": "203.0.113.42",
"created_at": "2025-01-15T10:30:00Z"
}
For the authentication details, see Using the API.
Daily summary to the operator
The person who runs this Conduit service can receive one email per day that summarizes the audit log of all accounts. The email holds your account email address, the action, the time, the client IP address, and the short metadata of each entry. It holds no email content, and no other account can see your entries.
The email lists at most 20 entries of each action, and then the number of entries that it leaves out. The count of each action is always the true count of the day.
The summary covers the accounts that exist when the email goes out. If you delete your account, Conduit deletes your audit log entries with it, and no later summary holds them. An email that went out before the deletion stays in the mailbox of the operator.
The summary covers the day before, from 00:00 to 24:00 UTC. A day without audit entries sends no email. The Privacy Policy covers this summary in section 2.
Retention
Conduit keeps audit log entries for 180 days and then deletes them automatically. The Privacy Policy covers what data Conduit stores and for how long.