# Read the audit log

> Read and page through your organisation's audit log from the dashboard, the CLI, the API or an AI assistant.

You need to be an owner or admin of the whole organisation, or a Tech member (or token) limited to one client, who sees that client's entries. See [Audit log](https://developers.openwaf.dev/change-control/audit-log/#who-can-read-it).

## Read the latest entries

**Dashboard**

Select **Audit log** in the sidebar. Each row shows the time, actor, action and target; **Show data** opens the details, including the reason and version of a zone change. Filter the loaded entries by **Category** or search by actor, target or action, and select **Load more** for older ones.
**CLI**

```sh
openwaf-cloud ctl audit
openwaf-cloud ctl audit --limit 200 --json
```
**API**

```sh
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/audit?limit=100" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```
```json
{
  "items": [
    {
      "id": 5120,
      "org_id": "…",
      "actor": "token:…",
      "action": "record.create",
      "target": "…",
      "data": {"record": {"name": "www.example.com", "type": "A"}, "version": 8, "from_version": 7, "reason": "Add www"},
      "at": "2026-10-27T10:14:21Z"
    }
  ]
}
```
**MCP**

Ask your assistant who changed a zone recently; it calls `audit_log`.


## Page back

Entries come newest first, 100 per page by default and at most 500. To get older entries, pass the `id` of the last entry you received as `before`:

**CLI**

```sh
openwaf-cloud ctl audit --limit 500 --before 5020
```
**API**

```sh
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/audit?limit=500&before=5020" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```


An empty `items` list means you reached the beginning of the log.

## Find who changed a zone

For one zone's configuration, its history is quicker: it lists only that zone's versions with actor, action and reason, and lets you compare and revert. See [View history and compare versions](https://developers.openwaf.dev/change-control/view-history/). The audit log adds what is not zone configuration, such as cache purges (`zone.cache.purge`), origin certificates (`zone.origin_cert.issue`, `zone.origin_cert.revoke`) or API tokens (`token.create`, `token.revoke`).

## Map an actor to a person

`user:<id>` is a member signed in to the dashboard; the dashboard shows the member's name. `token:<id>` is an API token; **API tokens** in the dashboard lists your organisation's active tokens with their names. `system:<name>` is OpenWAF acting on its own, for example `system:acme` when it issues or renews a certificate.