The audit log is the organisation's record of changes, newest first. Zone versions cover one zone's configuration; the audit log covers everything: every zone version, and also changes that are not versioned, such as members, API tokens, clients, brand, cache purges and origin certificates.
What an entry contains
| Field | Meaning |
|---|---|
id | Increasing number of the entry; used for paging. |
at | When it happened. |
actor | Who did it: user:<id>, token:<id> or system:<name> (automatic changes, such as certificate issuance by system:acme). |
action | What happened, such as record.create, zone.cache.purge or token.create. |
target | The object it applied to: usually a zone, record, client or token id. |
data | Details of the change. |
For a change that created a zone version, data also has version, from_version and reason, plus restored_from for a revert. Writes that changed nothing carry "unchanged": true. Changes made through the MCP server carry "channel": "mcp".
Who can read it
| Credential | What it sees |
|---|---|
| Owner or admin of the whole organisation | Every entry of the organisation. |
| Tech member or token limited to one client | The entries about that client's zones. |
| Any other role or scope | Nothing: the API answers 403. |
Audit log and zone history
Every zone version is written to the audit log in the same transaction, with the same actor, action and reason: there is no version without its audit entry. A change that writes several records at once (a batch or an import) creates one version and one audit entry per record. The zone history is the place to compare configurations and revert; the audit log is the place to see everything that happened in the organisation, in order.
How to read and page through it: Read the audit log.