---
type: reference
title: Account audit log
summary: Every action the account-level audit log records, by name, and where to find it.
---

The account log is the top of the three audit levels. It records account-wide changes, the ones that sit above any single troop. Find it in **account settings**, on the Apex plan. For how an entry reads, filtering, export, and retention, see [how audit logs work](/docs/audit-logs/overview).

## Recorded actions

Each row's action is one of the names below. They are the same names you filter by in the log panel.

| Action | What it records |
|---|---|
| `session.sign-in.magic-link` | Signed in with an email magic link. |
| `session.sign-in.oauth` | Signed in with a connected provider (GitHub or Google). |
| `session.sign-out` | Signed out of a session. |
| `session.revoke.one` | Revoked a single session. |
| `session.revoke.all-others` | Revoked every session except the current one. |
| `account.email.change-requested` | Requested an email change (confirmation link sent). |
| `account.email.change-completed` | Completed an email change by clicking the link. |
| `account.support-access.set` | Turned [support access](/docs/account-management/account-settings#support-access) on or off. |
| `account.pat.mint` | Minted the [account access token](/docs/account-management/account-settings#account-access-token). |
| `account.pat.rotate` | Rotated the account access token's secret. |
| `account.pat.revoke` | Revoked the account access token. |
| `account.seat.grant` | A seat was granted. |
| `account.plan.change` | The plan tier changed. |
| `account.plan.freeze-start` | A plan freeze began (after a downgrade). |
| `account.plan.thaw` | A plan freeze ended. |
| `troop.delete` | A troop was deleted. Recorded here because the troop's own log goes with it. |

### Caputchin support actions

When you have [support access](/docs/account-management/account-settings#support-access) on, actions Caputchin staff take in your account are recorded here too, under their own identity, with names beginning `admin.` (for example locking or unlocking the account, changing the plan or seats, cancelling the subscription, granting or revoking a role, revoking a session, and starting or ending an impersonation session). They are on the record whether or not you currently have an audit-log view, so staff activity is always traceable.

## Where to find it

Open **account settings** and go to the audit log there. It is an Apex-plan surface; on other plans the section is not available.

## See also

- [How audit logs work](/docs/audit-logs/overview): the shared model, filtering, export, and retention.
- [Account settings](/docs/account-management/account-settings): the account-level controls this log records.
- [Troop log](/docs/audit-logs/troop-log): the next level down.