---
title: Platform user audit log 
description: The audit log is a permanent record of who was added to or removed from your site, who was given or lost administrator rights, and who made each change. It exists so that a site administrator can hand an auditor the evidence for access control, for example for ISO 27001.
---

[Skip to content](https://guide.contentcatalyst.com/platform-user-audit-log#main-content)

![CC logo blue-1 (1)](https://guide.contentcatalyst.com/hs-fs/hubfs/CC%20logo%20blue-1%20(1).png?width=200&height=89&name=CC%20logo%20blue-1%20(1).png)

- [Guide & Help](https://guide.contentcatalyst.com/)
- [Main Website](https://contentcatalyst.com/)
- [Go to Customer Portal](https://guide.contentcatalyst.com/tickets-view)

Open main navigation

Close main navigation

- [Guide & Help](https://guide.contentcatalyst.com/)
- [Main Website](https://contentcatalyst.com/)
- [Go to Customer Portal](https://guide.contentcatalyst.com/tickets-view)
- [Main Website](https://contentcatalyst.com/)

[Main Website](https://contentcatalyst.com/)

 Learn all about the platform

- There are no suggestions because the search field is empty.

1. [Guide & Help](https://guide.contentcatalyst.com/?hsLang=en)
2. [Account & User Management](https://guide.contentcatalyst.com/account-user-management?hsLang=en)

# Platform user audit log

The audit log is a permanent record of who was added to or removed from your site, who was given or lost administrator rights, and who made each change. It exists so that a site administrator can hand an auditor the evidence for access control, for example for ISO 27001, without asking Content Catalyst for a data pull. You reach it in the admin app under **Site administration → User audit**, where you can produce and download the log; the page appears only once the audit log is switched on for your site.

This guide covers what is recorded, how to download the log, and how to read the file you get.

---

### 1. Who can use it

Site administrators can download the audit log. Account administrators cannot see or download it.

The audit log is switched on for your site by Content Catalyst. Content Catalyst can also take a fresh baseline snapshot on demand (see section 2).

### 2. The baseline snapshot

The audit log is enbabled for your site by Content Catalyst. Nothing is recorded before it is switched on, and history cannot be reconstructed afterwards.

When the log is enabled, the platform takes a **baseline snapshot**: one record for every user who exists at that moment, with their current status and the administrator roles they hold. The snapshot is what lets a later "role revoked" record be matched to a "role held" starting point, so the question "who was an administrator, and when did that change" can be answered from the day the log was enabled with no gap.

For existing sites, this initial baseline snapshot is being taken in November 2026; for a site first commissioned after then, it is taken when the site is commissioned.

The snapshot:

- includes disabled users and users on disabled accounts, with their status recorded
- includes internal Content Catalyst users on the site
- records current state at the moment each row was read, not history
- is bracketed by a `SnapshotStarted` record and a `SnapshotCompleted` record, so an incomplete run is visible as a start with no matching completion

If the log is switched off and later switched on again, a new snapshot is taken.

### 3. What is recorded

Each row in the log is one event about one subject. The subject is a user, an account, every user on an account, or the site itself.

#### 3.1 Events

| `event_type` | What happened | Extra detail in the `detail` column |
| --- | --- | --- |
| `UserAdded` | A user was created, on any path: admin UI, API, self-registration, SSO or CRM sync, or bulk import. | For bulk imports: `accountId`, `accountName` |
| `UserRemoved` | A user was deleted, on their own or because their account was deleted. The user's name and email are captured before the record is scrubbed. | None. A cascade marker when caused by an account deletion (see 3.4) |
| `UserEmailChanged` | A user's email address actually changed. Written only when the address differs. | `oldEmail`, `newEmail` |
| `UserEnabled` | A user's status changed to enabled. Not written when their whole account is enabled. | None |
| `UserDisabled` | A user's status changed to disabled. Not written when their whole account is disabled. | None |
| `AccountEnabled` | An account's status changed to enabled. One record for the account, not one per user. | None |
| `AccountDisabled` | An account's status changed to disabled. One record for the account. | None |
| `AdminRoleGranted` | An administrator role was granted to one user, or to everyone on an account. One record per role. | `role` |
| `AdminRoleRevoked` | An administrator role was revoked from one user, or from everyone on an account. One record per role. | `role` |
| `UserMovedBetweenAccounts` | A user moved to a different account, individually or because two accounts were merged. | Individual move: `fromAccountId`, `fromAccountName`, `toAccountId`, `toAccountName`. Merge: `sourceAccountId`, `sourceAccountName`, `destinationAccountId`, `destinationAccountName` |
| `SnapshotStarted` | A baseline snapshot run began. Subject is the site. | `runId`, `note`, `triggeredBy`, `userIdBound`, `previousRunId` |
| `UserSnapshot` | One existing user at the moment of the snapshot. Marked pre-existing. | `runId`, `preExisting` (always `true`), `status`, `accountId`, `accountName`, `accountStatus`, `adminRoles`, `accountAdminRoles`, `createdDate` |
| `SnapshotCompleted` | A snapshot run finished. Subject is the site. | `runId`, `userCount`, `adminRoleCount`, `durationSeconds` |
| `AuditLogExported` | An export of the log was produced. The actor is the administrator who requested it. | `exportKey` |
| `AuditLogDownloaded` | A download link for an export was issued. One record per link, because one export can be downloaded many times. | `exportKey` |

Every `detail` value also carries `"v":1`, the version of the detail format.

Where an event is written only when something actually changed, re-saving a user with no change writes nothing. A sync that saves thousands of unchanged users adds no rows.

#### 3.2 Administrator roles

The `role` value in `AdminRoleGranted`, `AdminRoleRevoked` and the snapshot's `adminRoles` lists is the role's internal key:

| Key | Role |
| --- | --- |
| `SiteAdmin` | Site administrator |
| `Admin` | Administrator |
| `ClientAdmin` | Account administrator |
| `ReadOnlyClientAdmin` | Read-only account administrator |
| `EditClientAdmin` | Account editor |
| `AccountManager` | Account manager |
| `ReportAdmin` | Report administrator |
| `ReportAccountAdmin` | Report account administrator |
| `AnalysisAdmin` | Analysis administrator |
| `Analyst` | Analyst |

#### 3.3 Subjects

| `subject_type` | Meaning | Populated columns |
| --- | --- | --- |
| `User` | One named user. | `subject_user_id`, `subject_username`, `subject_email`, plus `subject_account_id` and `subject_account_name` for the account they were in at the time |
| `Account` | The account itself, for account enable and disable. | `subject_account_id`, `subject_account_name` |
| `AccountAllUsers` | Every user on an account, for a role granted or revoked at account level rather than to a named user. | `subject_account_id`, `subject_account_name` |
| `Tenant` | The whole site, for snapshot and export events. | None |

In a `UserSnapshot` record, roles granted at account level appear in `accountAdminRoles` on every user of that account. In live events the same grant appears once, as an `AccountAllUsers` record.

#### 3.4 Cascades

When an account is deleted, every user in it is hard-deleted, and the log records one `UserRemoved` per user. When two accounts are merged, every user moves, and the log records one `UserMovedBetweenAccounts` per user. All the records from one such operation carry the same actor and are marked in two columns so they can be grouped:

| `cascade_operation` | `cascade_account_id` |
| --- | --- |
| `AccountDeleted` | The account that was deleted |
| `AccountMerged` | The account the users were moved out of |

An individual user deletion or move has both columns empty.

- **Bulk delete and bulk disable from the admin area** are run as background jobs. Each record they produce is attributed to the administrator who started the job, as they were at that moment. The records carry **no cascade marker**, so a bulk action on fifty users appears as fifty records that share an actor and a timestamp rather than as one grouped operation.

### 4. Who did it: the actor

Every record names who performed the action. The actor is never blank.

| Column | Meaning |
| --- | --- |
| `actor_kind` | How the person or process was signed in. See the table below |
| `actor_user_id`, `actor_username`, `actor_email` | The person. Empty for a `System` actor |
| `actor_label` | A fixed name for a system process, for example `audit-snapshot` or `audit-export` |
| `actor_login_id` | The session the action was performed in |
| `is_impersonated` | `true` when an administrator was acting as another user |
| `impersonated_user_id`, `impersonated_username`, `impersonated_email`, `impersonated_login_id` | The user being impersonated. The actor columns hold the real administrator |

The actor kind comes from how the session was authenticated, not from which page or endpoint was used.

| `actor_kind` | Meaning |
| --- | --- |
| `Website` | A person signed in to the website or admin area with a password, two-factor code or remembered session |
| `Sso` | A person signed in through single sign-on |
| `ApiKey` | An API call authenticated with an API key |
| `Api` | Reserved for API calls authenticated with a username and password. Not produced at present; those calls appear as `Website` |
| `Integration` | A machine integration holding a long-lived key, such as the webservice, plugin or RSS keys |
| `SelfRegistration` | The subject registering themselves, through the registration form or the registration API. The actor and the subject are the same person, and there is no session behind the record |
| `InstantAccess` | Someone following a shared instant-access link |
| `Anonymous` | An anonymous session |
| `System` | No person at all: a background job, a sync or a script. `actor_label` says which |
| `Unknown` | There was a person, but how they signed in can no longer be established, because their session record has since been purged |

Where users are managed by an integration such as Salesforce, Paragon or an SSO provider, the log records the integration's user and an API or SSO actor kind. The platform does not identify the person operating the integration on your side.

### 5. The record fields

Every row has the same 23 columns, in this order.

| Column | Meaning |
| --- | --- |
| `record_id` | A unique id for the record |
| `occurred_at_utc` | When it happened, in UTC to the millisecond, for example `2026-09-27T09:15:42.123Z` |
| `event_type` | One of the events in section 3.1 |
| `subject_type` | `User`, `Account`, `AccountAllUsers` or `Tenant` |
| `subject_user_id` | The user the event is about |
| `subject_username` | Their username at the time |
| `subject_email` | Their email address at the time |
| `subject_account_id` | The account the event is about, or the subject user's account at the time |
| `subject_account_name` | That account's name |
| `actor_kind` | See section 4 |
| `actor_user_id` | Who did it |
| `actor_username` | Their username |
| `actor_email` | Their email address |
| `actor_label` | Name of the system process, when there is no person |
| `actor_login_id` | The actor's session |
| `impersonated_user_id` | The user being impersonated, if any |
| `impersonated_username` | Their username |
| `impersonated_email` | Their email address |
| `impersonated_login_id` | Their session |
| `is_impersonated` | `true` or `false` |
| `cascade_operation` | `AccountDeleted` or `AccountMerged`, when part of a cascade |
| `cascade_account_id` | The account the cascade came from |
| `detail` | Event-specific detail as JSON. See section 3.1 |

Empty means not applicable. Booleans are `true` or `false`. Text is quoted where needed following standard CSV rules, so the JSON in `detail` opens cleanly in Excel.

### 6. Downloading the log

On the **Site administration → User audit** page:

1. Click **New export**. The export is prepared in the background; the page shows it as in progress. Only one export can be in progress at a time.
2. The page refreshes itself every few seconds. When the export is ready, a **Download** button appears against it.
3. Click **Download**. You receive a zip file named `audit-export-<date and time>Z.zip` containing one CSV file of the same name.
4. Open the CSV in Excel or any spreadsheet tool. For a single timeline, sort by `occurred_at_utc`.

Points to know:

- **The export is the whole log.** There is no date range and no filtering. Filter and sort in your spreadsheet.
- **The download link is short-lived.** It is valid for 15 minutes and only works for a signed-in site administrator. If it expires, click **Download** again. Each link issued is itself recorded in the log.
- **Previous exports are listed on the page** and can be downloaded again while they are retained. Each export is a snapshot of the log at the time it was produced.
- **Recent events may not be in the latest export.** Records are added to the downloadable log in batches, so an event typically becomes exportable within about fifteen to twenty minutes of happening. An export taken sooner will not include it.
- **Rows are not guaranteed to be in strict time order.** A record that reaches the log after its batch has been written is appended in a later batch. Every row carries `occurred_at_utc`, so sort on that column.
- **The export's own record appears in the next export,** not in the one it describes.

### 7. Current limitations

These are the known gaps in what the log captures. They are stated here so that an auditor does not assume more than the log can show.

- **Forward-only.** Nothing before the log was switched on can be recovered. The baseline snapshot is current state at enablement, not history.
- **Integration boundary.** For users managed through Salesforce, Paragon, SSO or another integration, the actor is the integration's user. The person operating the integration on your side is not identified.
- **Not recorded at all:** licence changes; account creation or deletion as events in their own right (an account deletion appears only as one `UserRemoved` per user); sign-ins and failed sign-ins; report views and downloads; and content edits. Changes to a user's name, phone, job title or other profile fields are also not recorded.

### 8. Retention

Audit records are kept for the length of your contract. They are not expired on a schedule and are not removed when a user is deleted. They are deleted only when your site is decommissioned, after you have been offered a final export.

- [Setting Up Your Content Catalyst Subscriber Portal](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#main-content)

    - [Onboarding](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#onboarding)
    - [Site Options](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#site-options)
    - [Showcase Page](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#showcase-page)
    - [Export Template Customisation & Branding](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#export-template-customisation-branding)
    - [Site Design & Branding](https://guide.contentcatalyst.com/setting-up-your-content-catalyst-subscriber-portal?hsLang=en#site-design-branding)
- [Site Authentication & User Registration](https://guide.contentcatalyst.com/site-authentication-user-registration?hsLang=en#main-content)

    - [Site Access](https://guide.contentcatalyst.com/site-authentication-user-registration?hsLang=en#site-access)
    - [User Registration](https://guide.contentcatalyst.com/site-authentication-user-registration?hsLang=en#user-registration)
    - [SSO](https://guide.contentcatalyst.com/site-authentication-user-registration?hsLang=en#sso)
- [Account & User Management](https://guide.contentcatalyst.com/account-user-management?hsLang=en#main-content)

    - [Account Creation & Management](https://guide.contentcatalyst.com/account-user-management?hsLang=en#account-creation-management)
    - [User Creation & Management](https://guide.contentcatalyst.com/account-user-management?hsLang=en#user-creation-management)
    - [Security](https://guide.contentcatalyst.com/account-user-management?hsLang=en#security)
    - [Account Manager Creation & Management](https://guide.contentcatalyst.com/account-user-management?hsLang=en#account-manager-creation-management)
    - [Guest Access](https://guide.contentcatalyst.com/account-user-management?hsLang=en#guest-access)
- [Licensing & Access Management](https://guide.contentcatalyst.com/licensing-access-management?hsLang=en#main-content)

    - [Creating & Managing Licenses](https://guide.contentcatalyst.com/licensing-access-management?hsLang=en#creating-managing-licenses)
    - [Prevent Full Downloads](https://guide.contentcatalyst.com/licensing-access-management?hsLang=en#prevent-full-downloads)
    - [Remote Access](https://guide.contentcatalyst.com/licensing-access-management?hsLang=en#remote-access)
    - [Restrict Export Formats](https://guide.contentcatalyst.com/licensing-access-management?hsLang=en#restrict-export-formats)
- [Organise, Categorise, and Link Content](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#main-content)

    - [Creating & Managing Category Trees](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#creating-managing-category-trees)
    - [Configuring Category Landing Pages](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#configuring-category-landing-pages)
    - [Category & Report Covers](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#category-report-covers)
    - [Chapters & Sections](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#chapters-sections)
    - [Analysts](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#analysts)
    - [Tags](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#tags)
    - [Report Series & Linked Reports](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#report-series-linked-reports)
    - [Promote Categories](https://guide.contentcatalyst.com/organise-categorise-and-link-content?hsLang=en#promote-categories)
- [Create & Deliver Content and Data](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#main-content)

    - [Report Metadata](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#report-metadata)
    - [Importing Content](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#importing-content)
    - [Instant Insights/Briefings](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#instant-insights-briefings)
    - [Interactive Docs](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#interactive-docs)
    - [DocuViewer](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#docuviewer)
    - [PDF/SlideViewer](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#pdf-slideviewer)
    - [Power BI](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#power-bi)
    - [Video Content](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#video-content)
    - [External Reports](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#external-reports)
    - [Publishing Workflow](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#publishing-workflow)
    - [DataViewer](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#dataviewer)
    - [RSS Feeds](https://guide.contentcatalyst.com/create-deliver-content-and-data?hsLang=en#rss-feeds)
- [Operations & Administration support](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#main-content)

    - [Domain Configuration](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#domain-configuration)
    - [Email Deliverability](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#email-deliverability)
    - [Search Configuration](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#search-configuration)
    - [Chargeback Codes](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#chargeback-codes)
    - [Policies & Notices](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#policies-notices)
    - [API](https://guide.contentcatalyst.com/operations-administration-support?hsLang=en#api)
- [Site Extensions & Integrations](https://guide.contentcatalyst.com/site-extensions-integrations?hsLang=en#main-content)

    - [CRM Integrations](https://guide.contentcatalyst.com/site-extensions-integrations?hsLang=en#crm-integrations)
    - [Integrations](https://guide.contentcatalyst.com/site-extensions-integrations?hsLang=en#integrations)
- [Tracking & Analytics of Subscriber Use](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#main-content)

    - [General](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#general)
    - [Report Access](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#report-access)
    - [Popular Searches](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#popular-searches)
    - [Tracking Snippets](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#tracking-snippets)
    - [Account Statistics](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#account-statistics)
    - [Analytics Sales Leads](https://guide.contentcatalyst.com/tracking-analytics-of-subscriber-use?hsLang=en#analytics-sales-leads)
- [Sales & Marketing](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#main-content)

    - [Email Customisation & Branding](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#email-customisation-branding)
    - [Buy It Now](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#buy-it-now)
    - [Instant Access Links](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#instant-access-links)
    - [Search Engine Verification](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#search-engine-verification)
    - [Trials](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#trials)
    - [Personalised Content Notifications](https://guide.contentcatalyst.com/sales-marketing?hsLang=en#personalised-content-notifications)
- [Content Discovery](https://guide.contentcatalyst.com/content-discovery?hsLang=en#main-content)

    - [Site Navigation](https://guide.contentcatalyst.com/content-discovery?hsLang=en#site-navigation)
    - [End-User Search](https://guide.contentcatalyst.com/content-discovery?hsLang=en#end-user-search)
    - [Categories & Tags](https://guide.contentcatalyst.com/content-discovery?hsLang=en#categories-tags)
    - [MyCatalyst](https://guide.contentcatalyst.com/content-discovery?hsLang=en#mycatalyst)
- [End-User Actions](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#main-content)

    - [Share Briefing](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#share-briefing)
    - [Ask The Analyst](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#ask-the-analyst)
    - [Collate & Export Content](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#collate-export-content)
    - [Share](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#share)
    - [Notes](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#notes)
    - [Translation](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#translation)
    - [User Profile](https://guide.contentcatalyst.com/end-user-actions?hsLang=en#user-profile)
- [RabbitMQ](https://guide.contentcatalyst.com/rabbitmq?hsLang=en#main-content)

    - [How to Use Rabbit MQ](https://guide.contentcatalyst.com/rabbitmq?hsLang=en#how-to-use-rabbit-mq)
    - [RabbitMQ: Events](https://guide.contentcatalyst.com/rabbitmq?hsLang=en#rabbitmq-events)

- [Main Website](https://contentcatalyst.com/)
- [Go to Customer Portal](https://guide.contentcatalyst.com/tickets-view)
- [Release Notes](https://guide.contentcatalyst.com/release-notes)
- [Raise a Ticket](https://guide.contentcatalyst.com/tickets-view/new?)

[![CC logo blue-1 (1)](https://guide.contentcatalyst.com/hs-fs/hubfs/CC%20logo%20blue-1%20(1).png?width=100&height=44&name=CC%20logo%20blue-1%20(1).png "CC logo blue-1 (1)")](http://contentcatalyst.com)

Energise your insights

<https://www.linkedin.com/company/content-catalyst>

Copyright © 2025, Content Catalyst Ltd.