The Audit Log: who did what, and when
A record of sign-ins, security and team changes, settings changes, the documents and records people create, change, send, archive and delete, payments and refunds, bank imports and matching, journal entries, billing events and support visits. Owners and admins can read it and download all of it.
The Audit Log is your workspace's diary. Todah writes a line whenever someone signs in, changes security settings, adds or removes a person, changes the workspace's settings (Business, Email, message templates, Books & Tax, sales taxes, expense categories, numbering, reminders and notifications), creates, changes, sends, cancels, archives or deletes an invoice, quote, credit note, recurring schedule, bill, client, vendor or product, records or removes a payment or refund, imports, matches or unmatches bank lines, posts a journal entry, records or deletes a partner draw, connects a bank, changes the plan, and more. The page itself says the same at the top: sign-ins, team changes, settings changes, and changes to invoices, quotes, credit notes, recurring schedules, bills, clients, vendors, products, payments, bank lines and journal entries. You cannot edit or delete its lines, so it is the record to show an accountant, an insurer or anyone asking "who changed this?"
Who can see it
Only the owner and admins. Audit Log is in their menu on the left; members do not see it.
Step by step: read it
- In the menu on the left, choose Audit Log.
- The newest lines are at the top, twenty to a page. Each line shows When, Who, Action and Detail.
- To find something, type in the "Search what happened" box, for example an invoice number or a person's email.
- To narrow the list, use the Who filter (Everyone, or one person), the Action filter (All actions, or one kind) and the date range on When.
Step by step: download all of it
- On the Audit Log page, choose Download CSV.
- A spreadsheet file downloads with every line ever recorded, oldest first, with the columns When (UTC), Who, Action, Record type, Record ID and Detail. It opens in Excel, Numbers or Google Sheets.
Good to know: The screen shows the most recent 500 lines. The download always has everything. Times are in UTC (world time), not your local time.
What the actions mean
| user.login / user.logout | Someone signed in or out. user.login_failed is a wrong password; its Detail says locked when the account was locked after too many tries. user.login_2fa_pending means the password was right and Todah asked for the code. user.login_recovery_code means someone signed in with a recovery code. |
|---|---|
| user.password_changed / user.password_reset | A password was changed in Settings, or reset from an emailed link. |
| user.2fa_enabled / user.2fa_disabled / user.2fa_recovery_regenerated | Two-step sign-in was turned on, turned off, or given new recovery codes. |
| user.added / user.updated / user.removed | A person was added to Team (with their role), had their name or role changed, or was removed. |
| user.invite_resent / user.ownership_transferred | Someone used Resend Invite, or the owner handed the workspace to an admin with Make Owner. |
| team.bookkeeper_seat | Todah support marked or unmarked a free bookkeeper seat. |
| platform.impersonate | Todah support opened your workspace to help you. Anything done during the visit shows Todah support (on behalf of the owner's email) in Who. |
| invoice.created / invoice.updated (and the same for quote, credit_note, bill, client, vendor, product and recurring) | A record was created, or a draft or record was changed. Detail names the number or the name. invoice.duplicated and quote.duplicated mean a copy was made with Duplicate. |
| invoice.status / quote.status / quote.converted | A status was set by hand (for example an invoice marked Sent or a quote marked Accepted), or a quote was converted to an invoice. Detail names the new status or the invoice number. |
| quote.accepted_online / quote.declined_online | The client accepted or declined a quote on its page. For an acceptance, Who shows the name they typed. |
| invoice.sent / quote.sent / statement.sent / credit_note.sent | A document was emailed to a client. |
| invoice.cancelled / invoice.reopened | An invoice was cancelled, or a cancelled invoice was reopened (it goes back to Sent). |
| invoice.deleted (and the same for quote, bill, client, vendor, payment, credit_note, journal and tax), category.deleted, bank_txn.deleted | A record was deleted for good. Detail names the number or the name. credit_note.voided means a credit note was voided, and credit_note.applied that it was applied to an invoice. |
| client.archived / client.restored, vendor.archived / vendor.restored, product.deleted / product.restored | A client or vendor was archived or restored, or a saved item was removed (product.deleted) or restored. |
| client.imported / client.contact_added / client.contact_updated / client.contact_removed / client.logo_updated / client.logo_removed | Clients were imported from a CSV file (Detail says how many), a person was added to, changed in or removed from Other People at This Client, or a client's own logo was uploaded or removed. |
| client.auto_email_off / client.auto_email_on / client.unsubscribed | No Automatic Emails was ticked or unticked on a client, or the client used the unsubscribe link in an email (Who shows client). |
| client.portal_opened / client.portal_sent / client.portal_revoked | A client's portal link was made for the first time, emailed to them, or revoked. |
| attachment.added / attachment.deleted | A file was attached to an invoice, quote or bill, or removed. |
| payment.added / payment.deleted | A payment was recorded against an invoice, or removed. Detail is the amount. |
| invoice.refund_recorded / invoice.refund_removed | A refund of a cash, cheque or e-transfer payment was recorded, or removed. |
| bill.paid / bill.unpaid / bill.payment_added / bill.payment_deleted / bill.scanned | A bill was marked Paid or Unpaid, a part payment was recorded on it or removed, or a bill or receipt was read by scanning (whether or not it was then saved). |
| invoice.paid_online / invoice.refunded / invoice.created_dispute / invoice.closed_dispute | A client paid by card, a card payment was refunded, or a client disputed a card payment with their bank and the dispute was opened or closed. Who shows stripe for events that came from Stripe. |
| invoice.card_payment / pay.link_revoked / quote.link_revoked | Card payment was turned on or off for one invoice, or an invoice's payment link or a quote's accept link was revoked. |
| bank_feed.connected / bank_feed.disconnected | A bank was connected or disconnected. |
| bank.imported / bank.line_added | A statement was imported (Detail names it and says how many lines came in and how many were skipped as already there), or a bank line was added by hand. |
| bank.matched / bank.unmatched / bank.auto_matched / bank.split_matched / bank.transfer_matched / bank.categorised / bank.bill_created / bank.income_recorded | A bank line was matched to an invoice or bill (Detail is the amount and the document), unmatched, matched by Auto-match, split across several documents, or as a transfer between your accounts, given a category, turned into a bill, or recorded as income. bank.reconciled and bank.ignored mean a line was marked Reconciled or ignored; bank.matched and bank.unmatched also appear when Undo Reconciled or Un-ignore puts a line back. |
| journal.created / journal.updated / journal.reversed | A journal entry was made (including opening balances), changed or reversed. |
| settings.updated / settings.logo_updated / settings.logo_removed | Something in Settings → Business, or in Settings → Email, was saved, including a message template. Detail names what changed, by its label on the screen (for example Display Name, Phone, From Email, Invoice Email Subject), not the new wording. The logo lines mean the business logo was uploaded or removed. |
| numbering.changed / books.settings_updated / notifications.schedule / notifications.settings | Invoice and quote numbering, the fiscal year or GST/HST number, the reminder schedule, or which workspace emails are on (Detail lists each one switched on or off) was changed. |
| tax.created / tax.updated / category.created / category.updated | A sales tax was added or edited (Detail is its name and rate), or an expense category was added or edited (Detail is its name and COGS or OpEx). |
| recurring.paused / recurring.resumed / recurring.deleted / recurring.generated / recurring.run | A recurring schedule was paused, resumed or deleted, made an invoice, or Run Due Now was used. |
| partner.created / partner.updated / partner.deleted / partner.draw_recorded / partner.draw_deleted / finance.settings_updated | A partner was added, changed or deleted, a draw, reimbursement or contribution was recorded or deleted, or the partner finance settings were changed. |
| account.created / account.updated / account.deleted | An account in the chart of accounts was added, changed or deleted. |
| billing.subscribed / billing.subscription_updated / billing.subscription_ended / billing.payment_failed | Your Todah plan started, changed, ended (the workspace went back to Free), or a subscription payment failed. |
| account.exported | Someone used Export All Data. |
| connect_app / create_token / revoke_token | Someone connected an AI app, made an API token, or an app or token was disconnected. |
Good to know: Personal preferences are not listed: your own theme, your own choices in My Notifications (Settings → Notifications) and product news. They change only what you see, not the workspace. The Workspace Notifications and Reminders & Receipts switches are workspace settings, so changing them is listed (notifications.settings).
Good to know: Each save is one line: changing three lines on a draft invoice and choosing Save once writes one invoice.updated line. The Detail column names the record, and the record itself shows what it says now.
See also
Was this helpful?
Still stuck? Write to us or email support@todah.ca — a person reads every message and replies by email. The FAQ covers plans, prices and the questions people ask before they sign up.