You need to be an owner or admin of the whole organisation, or a Tech member (or token) limited to one client, who sees that client's entries. See Audit log.
Read the latest entries
Select Audit log in the sidebar. Each row shows the time, actor, action and target; Show data opens the details, including the reason and version of a zone change. Filter the loaded entries by Category or search by actor, target or action, and select Load more for older ones.
openwaf-cloud ctl audit
openwaf-cloud ctl audit --limit 200 --jsoncurl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/audit?limit=100" \
-H "Authorization: Bearer $OPENWAF_TOKEN"{
"items": [
{
"id": 5120,
"org_id": "…",
"actor": "token:…",
"action": "record.create",
"target": "…",
"data": {"record": {"name": "www.example.com", "type": "A"}, "version": 8, "from_version": 7, "reason": "Add www"},
"at": "2026-10-27T10:14:21Z"
}
]
}Ask your assistant who changed a zone recently; it calls audit_log.
Page back
Entries come newest first, 100 per page by default and at most 500. To get older entries, pass the id of the last entry you received as before:
openwaf-cloud ctl audit --limit 500 --before 5020curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/audit?limit=500&before=5020" \
-H "Authorization: Bearer $OPENWAF_TOKEN"An empty items list means you reached the beginning of the log.
Find who changed a zone
For one zone's configuration, its history is quicker: it lists only that zone's versions with actor, action and reason, and lets you compare and revert. See View history and compare versions. The audit log adds what is not zone configuration, such as cache purges (zone.cache.purge), origin certificates (zone.origin_cert.issue, zone.origin_cert.revoke) or API tokens (token.create, token.revoke).
Map an actor to a person
user:<id> is a member signed in to the dashboard; the dashboard shows the member's name. token:<id> is an API token; API tokens in the dashboard lists your organisation's active tokens with their names. system:<name> is OpenWAF acting on its own, for example system:acme when it issues or renews a certificate.