> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apollodeploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Review customer actions, security context, resource changes, and related activity

The **Logs** page is an organization-wide customer audit trail.
It records meaningful actions and resource changes; it is not a raw list of every Email API request.

<Note>
  Audit logs are available to owner and administrator roles in the dashboard.
</Note>

## Find an event

Filter by free-text search, date, module, action, resource, or status.
Start with the smallest time window that contains the incident or change.

## Modules and actions

Customer-visible modules include email, webhook, API key, settings, notification, and export activity.
Actions include create, update, delete, deliver, trigger, retry, fail, and export.

## Event detail

Open a log entry to inspect:

* Actor identity and role context.
* Resource type and identifier.
* Timestamp and action status.
* Security and request context that Signal makes customer-visible.
* Change summary for updated resources.
* Related activity.
* Technical identifiers and raw customer-visible JSON when needed.

## Incident workflow

<Steps>
  <Step title="Anchor the time">
    Start from the deployment, support report, message event, or security alert timestamp.
  </Step>

  <Step title="Filter the resource">
    Use the key, endpoint, project, email, or settings resource identifier.
  </Step>

  <Step title="Identify the actor">
    Confirm whether the change came from a user, service, or automated system represented in the event.
  </Step>

  <Step title="Review related activity">
    Look for creation, update, retry, failure, and deletion events around the same resource.
  </Step>

  <Step title="Preserve evidence">
    Record the relevant IDs and export only what your incident or compliance process requires.
  </Step>
</Steps>

## Security handling

Audit output can contain customer and infrastructure context.
Restrict access, avoid copying raw JSON into public tickets, and redact addresses, identifiers, and request metadata when sharing an incident summary.

<Tip>
  For per-message delivery debugging, use **Emails** and its event timeline.
  For aggregate performance, use **Metrics**.
  Use **Logs** to answer who changed or triggered what.
</Tip>

## SDK example: message diagnostics

The public SDK does not expose the organization audit trail. Keep actor and resource-change review
in the dashboard. For a specific message, fetch its public event timeline with the SDK; this
timeline is delivery evidence, not an audit-log replacement.

<CodeGroup dropdown>
  ```typescript TypeScript theme={"dark"}
  const timeline = await signal.projects.getEmailTimeline(projectId, emailId, {
    headers: { Authorization: `Bearer ${process.env.SIGNAL_API_KEY}` },
  });
  ```

  ```python Python theme={"dark"}
  timeline = signal.projects.get_email_timeline(project_id, email_id)
  ```

  ```go Go theme={"dark"}
  timeline, err := client.Projects.GetEmailTimeline(ctx, projectID, emailID)
  if err != nil {
      panic(err)
  }
  ```

  ```ruby Ruby theme={"dark"}
  timeline = signal.projects.get_email_timeline(
    project_id: project_id,
    email_id: email_id
  )
  ```

  ```ruby Rails theme={"dark"}
  timeline = ApolloDeploySignalSdkRails.rails_client.projects.get_email_timeline(
    project_id: project_id,
    email_id: email_id
  )
  ```

  ```php PHP / Laravel theme={"dark"}
  $timeline = $signal->projects()->getEmailTimeline($projectId, $emailId);
  ```

  ```java Java theme={"dark"}
  var timeline = signal.projects().getEmailTimeline(projectId, emailId);
  ```

  ```kotlin Kotlin theme={"dark"}
  val timeline = signal.projects.getEmailTimeline(projectId, emailId)
  ```

  ```csharp .NET theme={"dark"}
  var timeline = await signal.Projects.GetEmailTimelineAsync(projectId, emailId);
  ```

  ```rust Rust theme={"dark"}
  let timeline = signal.projects.get_email_timeline(
      project_id.to_string(),
      email_id.to_string(),
  ).await?;
  ```

  ```elixir Elixir theme={"dark"}
  {:ok, timeline, _metadata} =
    ApolloSignal.Client.get_email_timeline(client, project_id, email_id)
  ```

  ```swift Swift theme={"dark"}
  let timeline = try await signal.projects.getEmailTimeline(
      projectId: projectId,
      emailId: emailId
  )
  ```

  ```zig Zig theme={"dark"}
  var projects = client.projects();
  var result = try projects.getEmailTimeline(project_id, email_id, .{});
  defer result.deinit();

  switch (result) {
      .success => |_| {},
      .api_error => return error.SignalApiError,
  }
  ```
</CodeGroup>