Understand the audit log

Audit is the last entry in the sidebar and the answer to "who changed this, and when?". It is an append-only record: rows are written by the system as you work and nothing in the interface can edit or delete them. It is scoped to your agency, so you see your own team's actions and nobody else's.

The header counts the whole history — "N recorded actions · times in Europe/Rome." — and the table below shows 50 rows per page, newest first.

The four columns

• When — date and time of the action, always in Europe/Rome, down to the second.
• User — the email of the person who did it. Automatic entries are recorded under system, and a row without a known user shows —.
• Action — a short machine-readable name in a badge, in family.object.verb form: agent.prompt.save, client.update, team.member.role. The name is stable, which makes it easy to scan (or search with your browser's find) for one kind of change.
• Resource — what the action touched, as type/id (for example agent/…, client/…). Actions without a single object show —.

Who can see it

Audit is one of the eight permission areas. Owner and admin always see it. A collaborator sees the page only if an admin gave them at least Viewer on Audit; otherwise the page renders the "this area is not enabled for you" panel and the entry does not appear in their sidebar.

There is no editor-level behaviour to speak of here: nobody writes to the log by hand — the system writes every row. See Invite your team for how the areas are assigned.

What gets recorded

Configuration changes, connections and team management — the actions that change how the platform behaves:

• client.* — client.create, client.update, and client.sync when sub-accounts are imported from GoHighLevel.
• agent.* — agent.create, agent.prompt.save, agent.prompt.rollback, agent.settings.save, agent.identity.save, agent.call_policy.save, agent.numbers.save, agent.fieldmappings.save, agent.integrations.sync.
• connection.* — connection.retell.connect, connection.twilio.connect, connection.ghl.connect. The row proves that a provider was connected; the credential itself is never part of it.
• webhook.secret.rotate — the owner regenerated the GoHighLevel webhook secret of the agency or of an agent (the payload says which); the secret itself is never stored.
• number.retell.register — a phone number registered on Retell so the AI can use it.
• setting.update and setting.delete — changes on the Settings page (concurrency, calling window, recording, strict mode, CRM tag names).
• lead.block and lead.unblock — a lead put on, or taken off, your do-not-call list; see Do-Not-Call: blocking and unblocking.
• team.* — team.invite.create, team.invite.resend, team.invite.revoke, team.invite.accept, team.member.role, team.member.permissions, team.member.remove.
• alert.fired — written under the user system the first time an operational alert fires in its window. It is the durable trace behind the dashboard's "Attention required" banner: Read your dashboard.

Each row also carries a small, curated payload — a few relevant fields, never the whole form and never a secret. Invite tokens, API keys and passwords are not stored here.

What is not recorded

• Reads. Opening a page, filtering a list or listening to a recording leaves no row. The log records changes, not browsing.
• Call activity. Calls, outcomes, transcripts and recordings live in Calls and Leads — that is the operational history, and duplicating it here would bury the configuration changes.
• Buying a phone number. Only its Retell registration is logged (number.retell.register); the purchase itself is visible on the Numbers page.
• Test calls from the in-browser agent tester.

One more nuance: audit writing is failure-safe by design. If the log write itself fails, the action it records still goes through — that trade-off keeps a logging hiccup from breaking your work, at the price of an extremely rare missing row.

Paging through the history

The pager at the bottom walks the entire log, not just a recent slice: the counter in the header tells you how many actions exist in total, and the range indicator shows which ones you are looking at. Since rows are ordered newest first, "what changed just now" is always on page 1, and an investigation into an older change is a matter of paging back to the day in question.