How can I find changes to specific users with the audit log?

<h2 id="h_01HBTZ2KMDZS21ST26MRV2MFVX">Question</h2><p>How can I find changes to specific users with the audit log?</p><h2 id="01JG3BNC43T7CBSZZ9EE633NFW">Answer</h2><p>On Enterprise plans, you can see changes to specific users in your <a href="https://support.zendesk.com/hc/en-us/articles/4408828001434-Viewing-the-audit-log-for-changes-to-your-account" target="_blank" rel="noopener noreferrer">audit log</a>. Audit logs serve as a powerful troubleshooting tool, allowing you to track changes made to a specific user and the exact times these changes occurred. By utilizing audit logs, you can effectively monitor user activity and identify any modifications that may impact performance or security.</p><p>To find changes related to a specific user, open the audit log and use the following settings in the audit log filter. See <a href="https://support.zendesk.com/hc/en-us/articles/4408828001434#topic_lvh_mft_jsb" target="_blank" rel="noopener noreferrer">Filtering the audit log</a> for details.</p><ul>
<li data-list-item-id="e3e4c323157d89647a71bc7f1d7d63804">
<strong>Activity type</strong> = <strong>Updated</strong>
</li>
<li data-list-item-id="ec836257a1b74c170dcfa0fc53d7605f3">
<strong>Item &gt; Type</strong> = <strong>Customer</strong> for end-user role or <strong>Team member</strong> for agent or admin roles</li>
<li data-list-item-id="e65939f386629a33fd2cdc8385cc970e5">
<strong>Item &gt; Names</strong> = The name of the user</li>
</ul><p><img src="https://support.zendesk.com/hc/article_attachments/11015771121050" width="431" height="776"></p><p>Audit logs are also available from the <a href="https://developer.zendesk.com/api-reference/ticketing/account-configuration/audit_logs/" target="_blank" rel="noopener noreferrer">API</a>. You can use the API request to retrieve audit logs. For example the following API request: <code>https://<em>yoursubdomain</em>.zendesk.com/api/v2/audit_logs?filter[source_type]=user&amp;filter[source_id]=379921250014</code></p><p>The API request returns JSON results with details such as the following:</p><ul>
<li data-list-item-id="ec96fdaf033b9b33412cfefacb0850db1">Source type</li>
<li data-list-item-id="ee32ac787aec5e4a42e7f4e9b8df96392">Source ID</li>
<li data-list-item-id="eaca1c73db7c11e2350b0fc2aa38c4b6c">Action performed</li>
<li data-list-item-id="e5711c8f6671c969de68b5097692d1200">Timestamp of the action</li>
<li data-list-item-id="ec66b1fd193b70e5d3c73b8eae216a04e">User who performed the action</li>
</ul><p><img src="https://support.zendesk.com/hc/article_attachments/11015786323994" alt="Screenshot 2024-12-23 at 3.52.48 PM.png"></p><p>For more information, see the article: <a href="https://developer.zendesk.com/documentation/api-basics/best-practices/audit-logs/" target="_blank" rel="noopener noreferrer">Using audit logs to track activity</a>.</p><div class="p">
<div class="note"><strong>Note these important implications:</strong></div>
<ul>
<li data-list-item-id="e478281a5b86d870aa9b7ebd6fdf595d7"><div class="note">Some user changes, such as suspension, have a unique Type value and will not be returned by the above methods. User suspension events will have a Type value of User Setting, but the ID is no longer the user's ID.</div></li>
<li data-list-item-id="e134d36a22a0df9f3e841475023a2cbe5"><div class="note">Updates to custom fields are not supported in the audit logs</div></li>
</ul>
</div><style>
.ai-only {
position: absolute !important;
width: 1px !important;
height: 1px !important;
padding: 0 !important;
margin: -1px !important;
overflow: hidden !important;
clip: rect(0, 0, 0, 0) !important;
white-space: nowrap !important;
border: 0 !important;
}
</style><div class="ai-only" aria-hidden="true"><details><summary>THIS SECTION IS AI CONTENT. DON'T EDIT OR DELETE.</summary><h2 id="h_01KXKQ3P5KXY4Y5C5RHJ50C5KK">What is the audit log? Why should I use audit logs to monitor user activity? How do audit logs help troubleshoot changes to a customer or team member?</h2>
<p>Audit logs serve as a powerful troubleshooting tool that tracks changes made to a specific customer or team member and the exact times these changes occur. You use them to monitor user or client activity and identify any modifications that impact performance or security.</p>
<h2 id="h_01KXKQ3P5M9N1WVBV10NCQCBNN">Can I find changes to specific users with the audit log? How do I track modifications to a customer or team member? How do I filter the audit log for a specific user?</h2>
<p>Yes, you can track changes to specific users or clients in your audit log. To find changes related to a specific user, open the audit log and use the following settings in the audit log filter: </p>
<ol>
<li>
<strong>Activity type</strong> = <strong>Updated</strong>
</li>
<li>
<strong>Item Type</strong> = <strong>Customer</strong> for an end-user role or <strong>Team member</strong> for an agent or admin role</li>
<li>
<strong>Item Names</strong> = The name of the user</li>
</ol>
<p> </p>
<h2 id="h_01KXKQ3P5M10C766GNWM24YK7A">Can I retrieve audit logs from the API? How do I connect to other apps or push data to get audit logs? How do I request audit logs for a specific user ID?</h2>
<p>Yes, audit logs are also available from the API to connect to other apps or push data. You can use the API request to retrieve audit logs, for example the following request: <code>https://yoursubdomain.zendesk.com/api/v2/audit_logs?filter[source_type]=user&amp;filter[source_id]=379921250014</code>. The API request returns JSON results with details such as the <strong>Source type</strong>, <strong>Source ID</strong>, <strong>Action performed</strong>, <strong>Timestamp of the action</strong>, and <strong>User who performed the action</strong>.</p>
<h2 id="h_01KXKQ3P5M4EJFZG6BPCNTD4PP">What are the limitations of the audit log? Which plan type or pricing tier includes user audit logs? Can I track updates to a custom field or extra dropdown?</h2>
<p>You can see changes to specific users in your audit log only on Enterprise plans or suite versions. Note these important implications and boundaries: some user changes, such as suspension, have a unique Type value and the regular methods do not return them. User suspension events have a Type value of <strong>User Setting</strong>, but the ID is no longer the user's ID. The audit logs do not support updates to a custom field or extra dropdown.</p></details></div>