#Audit log

Backend B4.8 is built by Pair 1 (2026-10-09). V8 requirement The organization Audit log and Account → Activity log (B3.12) are two views using one shared table component. Server and application activity stays in their OSS-backed panels.

#Organization Audit log (`/audit-log`)

Opens from the main sidebar for the current organization. Requires view on organization.activity; Owner passes permission checks, Admin has view, and custom roles need the grant. Do not limit the page to Owner and Admin.

i18n namespaces: org.activity.*, org.errors.*, shared common.*. Send Accept-Language; descriptions, type/action labels and filter labels are already translated by the backend.

#Table and filters

Columns: time, actor, translated description, type, action, IP, browser and platform. Make by_admin visible when support acted on someone's behalf.
Newest first. Default 10 rows per page; per_page supports 1–50.
Filters: type and action. Build options from filters.types and filters.actions; they cover the whole organization's history, not just the current filtered page.
Actor name is the snapshot from the time of the action. Keep showing it when actor.id is null; do not replace a deleted person with “System”.
An unavailable IP is blank; browser/platform can be “Unknown”. No raw user-agent parsing.
Built events: organization create/update; invitation send/resend/cancel/accept (including invite-linked sign-up); member update/remove/leave; custom-role create/update/delete.
Provider connect/update actions are now built on Pair1; edit records safe name/credential-change flags, never key values. Failed, conflicted and no-op edits have no entry.
Provider checks record status-change events only on real transitions, with safe from/to statuses and actor. Same-status checks, transient/unreadable failures and conflicts add no history row.
Provider disconnect now records safe actor/account/provider metadata; prior organization history stays. Repeat/refused deletes add no entry; the missing server-usage guard remains a Phase8 dependency.
Failed operations produce no entry. This is a history of completed actions, not an error monitor.
Transfer start, acceptance and cancellation are now recorded (transfers, actions create/update/delete). B4.7 is now marked built, including its deletion-safety extension. Sharing events wait for B4.6.
Deleting an organization removes its organization history. The explicit deletion remains in the owner's Account → Activity log instead.

#Published API

GET /api/v1/organizations/{organization}/activity?page=&per_page=&type=&action= with a login access token. Returns data, paginator links/meta, and filters. Each row has id, actor, type, type_label, action, action_label, event, description, ip, browser, platform, by_admin, created_at.

Source: Pair 1's published api-reference.md, §38. Pair 2 has now synced this build note and reports the Phase4 activity/transfer code pulled through a43e3f6 (2026-10-10).

#Screen states and errors

Loading; populated table; empty history; no matching results (clear filters); retryable request failure.
401: return to Login. 403: no permission/banned account, show the refusal without a table. 404: missing organization or no membership, refresh organization context and leave this view. 422: show query validation. 429: back off rather than tight-retry.
Switching organizations resets pagination and filter selections and loads that organization's history; never leave the previous organization's rows visible as the new one's.

#What is not promised

The old proposal for actor/date/status filters, text search, resource links, expandable before/after details and CSV export is not the published B4.8 contract. Do not build those against invented fields or endpoints. No retention guarantee on screen.

#Done when

Owner/Admin and a custom role with activity-view can load only the selected organization's entries; denied/non-member states are covered; pagination and filters work; snapshot names remain readable after actor deletion; failed actions do not appear; organization deletion appears in the owner's account history. All new screen labels use dictionary keys.

See FE: Organization & Members, Account screens and Roles & permissions.

B6.2 billing update (Pair2 local/not pushed): safe account activity records the update without personal billing values. Do not display billing email/address/tax numbers in the activity row; the editable identity belongs on Billing settings only.

B17.4 admin activity backend built (Pair1): separate admin-only feed GET /api/v1/admin/activity, admin-activity view. Newestfirst/default10max50,actor+target snapshots,translateddescription,IP/browser/platform and type/action/admin/target/dates/name filters. Staff-role events shown here, not shared account/org feed; those feeds unchanged. No invented export/detail/retention controls. Exact screen.