Audit log
The audit log records every privileged action that mutates state in CraftBot — for compliance, forensics, and access-review. It is append-only and viewable by admins and super-admins from the Audit Trail entry in the sidebar.
What’s recorded
| Category | Examples |
|---|---|
| Authentication | Login success / failure, password reset, MFA enrolment, lockout. |
| User management | User created / updated / deactivated / role changed. |
| Channel | Channel config created / edited / deleted, secret rotated. |
| Recipe | Draft created / saved / published / unpublished / rolled back. |
| Conversation | Reassigned, closed, reopened, exported, hard-deleted (PDPL erasure). |
| Settings | Business hours / KB / CSAT / Team / Skill changes. |
| Token | API token issued / revoked. |
What each entry contains
- Timestamp (UTC, ISO-8601).
- Actor (user id, role, IP, user agent).
- Target entity (type + id).
- Before / after diff (where applicable).
- Result (success / failure + error code).
Searching
The audit-log viewer supports:
- From / To — datetime range. Defaults to the last 24 hours; pick any window via the datetime-local pickers.
- Category — filter by event category (Auth, Admin Config, Channel, Recipe, Conversation, Token, etc.).
- Outcome — narrow by HTTP outcome class: Success (2xx), Redirect (3xx), Client error (4xx), Server error (5xx).
- Search — free-text match across actor email, resource type, and action name.
Each row shows the timestamp (UTC), category pill, action, resource (type + id prefix), outcome status code, and source IP. Click any row to open the detail drawer with the full request payload and before/after diff.
Retention
PDPL requires audit retention for at least 7 years for healthcare-adjacent platforms. CraftBot retains audit records for 7 years by default, with cold-storage rollover after 90 days for cost.
Export
Bulk export is available as CSV or JSON for compliance review. Exports themselves generate an audit entry.
Tamper resistance
Audit records are append-only. There is no UI to edit or delete entries — even super_admin. At the database layer, the table is restricted to INSERT only by application role; deletes require direct DBA access (which is itself logged at the infrastructure layer).