Audit Log
An immutable, queryable record of every meaningful change in your Account: who did what, when, and to what.
Overview
Every meaningful action in Canopy (a role assigned, a permission changed, an identity activated, a node moved) is recorded as an audit entry capturing the actor, the action, the target, and a precise timestamp. Entries are append-only: nothing edits or deletes history. The audit log is the authoritative record you reconcile webhooks against, investigate incidents with, and hand to a compliance reviewer.
Two surfaces
Admin events and identity events are separate surfaces
Canopy keeps two audit tiers. Admin events are operational and configuration changes made by your team: creating roles, editing permissions, moving nodes. Identity events are things that happen to or by your end users: sign-ins, profile changes, membership. The split is a privacy boundary: the public API's GET /api/v1/audit-events exposes identity events only, so your application can show end users their own activity without ever leaking your team's internal operational trail.
Finding events
The Console's Audit Log page narrows a large trail quickly:
Correlation & related events
Every event carries a correlation ID
A single operation often produces a cascade of events: a bulk assignment writes one entry per identity, a node move re-evaluates inheritance. Each event carries a correlation ID that ties the whole cascade back to the originating request, and the related-events sidecar groups them together. When you're reconstructing exactly what one action did, follow the correlation ID.
Retention
How long entries are kept is set by your plan: 7 days on Free, 30 days on Pro, and a contracted window on Enterprise. A nightly sweep removes entries past that window. Because webhook replay and the change feed read from the same audit entries, your effective replay window matches your retention window. If a gap could outlast it, re-sync rather than replay.
The audit of the auditor
Reading the audit log is itself audited
Querying the audit log is a privileged action, so it leaves its own trail: who ran which query, and when. This "audit of the auditor" means even read access to sensitive history is accountable, a control that regulated reviewers specifically look for.
Tell us how we can improve this guide.