Documentation

Audit Logs

LoginRadius records every meaningful action in your tenant — sign-ins, configuration changes, API calls, and access events — into searchable, exportable audit-log streams. Use them for forensics, compliance reports, and to feed your SIEM.

Access: Admin Console → Users → User Audit Logs for end-user activity, or Tenant Settings → Team Audit Logs for admin activity. If the feature is not enabled on your tenant, contact support@loginradius.com.

---

Audit log streams

LoginRadius produces two audit log streams, one for end-user activity and one for administrative activity. Both streams use the same column shape, so any filter, query, or export pattern works identically across them.

SelectedEnd-user activity

User Audit Logs

Sign-ins, registrations, profile changes, session and MFA events from your end customers.

Retention7 days

SelectedAdmin activity

Team Audit Logs

Changes made by your Team Members in the Admin Console — config, roles, deployments.

Retention90 days

Sample rows · User Audit LogsTeam Audit Logs

Time	UID	Actor Type	Event	Target	Status
2026-05-19 10:20:35	Anonymous	api_key	login	account	200
2026-05-19 10:20:24	Anonymous	domain	read	auth_template	200
2026-05-19 10:16:42	a4f9c1…7b2d09	api_key	login	account	401
2026-05-19 10:16:33	c08e22…91f3aa	api_key	register	account	201
2026-05-19 10:14:08	a4f9c1…7b2d09	api_key	mfa_verify	mfa	200

Time	UID	Actor Type	Event	Target	Status
2026-05-19 10:16:15	2b817d…60f4f6	dashboard	modify	optional_captcha.config	200
2026-05-19 10:15:58	2b817d…60f4f6	dashboard	modify	forms.registration	200
2026-05-19 09:54:11	2b817d…60f4f6	dashboard	login	console	200
2026-05-19 09:21:02	9c1f4a…d7e218	dashboard	create	webhook	201
2026-05-18 17:02:18	9c1f4a…d7e218	dashboard	delete	webhook	204

---

Column reference

Every row in the audit logs has four key columns. Pick a tab to learn what its values mean.

Actor Type

The channel an action came through.

dashboard

A Team Member performing an action from the Admin Console.

api_key_secret

Action authenticated with an API key + secret pair (server-to-server).

api_key

Action authenticated with only an API key (public-side calls).

api_secret

Action authenticated with only an API secret.

m2m

A machine-to-machine call from a registered client.

oidc_client

An OIDC client driving the action — typically a federated app.

domain

A request from a registered Hub Domain or Custom Domain (browser-side).

org_user

An organization-scoped user acting within their org.

Event

The action that was performed. A few sample values:

login

An actor was successfully authenticated. Covers credential, social, SSO, and passwordless sign-ins.

create

A new resource was created — for example a webhook, a role, or an application.

modify

An existing resource was updated. The diff of what changed is included in the SIEM payload.

delete

An existing resource was removed.

read

A resource was fetched — commonly emitted for template loads and config lookups.

Target

The resource the event acted on. A few sample values:

account

An end-user account record.

forms.registration

The registration form configuration — fields, validation rules, ordering.

captcha

CAPTCHA configuration on auth forms.

webhook

A webhook endpoint subscription.

Status Code

The standard HTTP status code returned by the underlying API call.

2xx

Success — the request was processed.

3xx

Redirect — typical in OAuth and SSO flows.

4xx

Rejected — bad input, auth failure, or rate-limited.

5xx

Server-side failure — open a ticket with the request_id.

---

Filtering & searching

Both views share the same toolbar above the table. Pick a tab to see how each control works.

Filters

Combine any column with an operator (contains, equal, not equals) and a value. Click the + to add another rule — rules are combined with AND.

Click Filters in the toolbar to open the rule builder.

Search by UID

Exact-match the actor's UID. Useful when you already know whose activity you are looking for.

A single text input — paste the UID and press the magnifier icon.

Date Range

Pick any window within the retention period — 7 days for User Audit Logs, 90 days for Team Audit Logs.

Two date-time inputs separated by an arrow. Click either to open the picker.

Examples

Find every failed sign-in for one user

1. Open the User Audit Logs view.
2. Click Search by UID and paste the actor's UID — e.g. a4f9c1…7b2d09.
3. Add filter: Event · equal · login.
4. Add filter: Status Code · equal · 401.
5. Apply. The table now lists only failed sign-ins for that user.

See what an admin changed yesterday

1. Open the Team Audit Logs view.
2. Set the Date range to yesterday's window.
3. Add filter: Actor Type · equal · dashboard.
4. Add filter: Event · equal · modify.
5. Apply. The table now shows every Admin Console change made yesterday.

---

Exporting logs

Click the Export button at the top right of the table to download the filtered result as a CSV — up to 10,000 rows per export. The file reflects the active filters and date range, so what you see is what you get.

The Export button sits at the top right of the audit logs table.

Need more than 10,000 rows? Use the SIEM integration for full-fidelity streaming — no row cap, plus long-term retention.

---

SIEM integration

Forward both streams to your SIEM for long-term retention, correlation, and alerting.

Access: Admin Console → Integration → Audit Log Integration. Pick one provider to centralize all your audit logs. If the feature is not enabled on your tenant, contact support@loginradius.com.

Supported providers

Pick one provider to centralize all your audit logs. Each line below shows the ingestion method we use to deliver records.

Logstash

Elastic-compatible pipeline — real-time log transformation and enrichment.

Splunk

HTTP Event Collector (HEC) — anomaly detection and forensic investigations.

Devo

Real-time data analytics with scalable log retention.

Sumo Logic

HTTP Source endpoint — AI-driven threat detection and compliance insights.

Grafana

Loki log ingestion — dashboards, alerting, and correlation across your infra.

Sample SIEM log

A single record as delivered to your sink. Sensitive identifiers have been redacted.

{
"timestamp": "2026-05-20T11:02:29Z",
"request_id": "4aa1ac8e-8438-4b6d-a2ab-11de147268bb",
"app_name": "test-app",
"actor_type": "dashboard",
"uid": "7e2d54a1-9b3c-4f08-b6e7-2c14ab8d31f9",
"event": "create",
"target": "account",
"metadata": {},
"request": {
  "method": "POST",
  "path": "/api/register",
  "content_type": "application/json",
  "body": {
    "firstname": "Alex",
    "emailid": "alex@test-app.com",
    "password": "***",
    "phoneid": "+14155551234"
  }
},
"response": {
  "status_code": 201,
  "content_type": "application/json"
},
"user_agent": "axios/1.16.1"
}

Related Resources

Audit Log IntegrationPlatform AnalyticsUser Analytics