Using the access log to monitor agent activity (ADPP add-on)

<body>
<p id="docs-hc-snippet" style="display: none;">The access log, part of theAdvanced Data Privacy and Protection add-on, is a powerful tool that enhances data security and administrative control of your account. It's a record of access events for your account related to tickets, user profiles, and searches. This differs from theaudit log, which provides a detailed log of changes to settings or fields.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_adpp">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Advanced Data Privacy and Protection (ADPP)</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Use the access log to monitor which tickets, user profiles, and searches agents and admins view in the last 90 days. It helps you spot security risks, support compliance, filter events by actor or activity, review event details, generate AI descriptions, export logs with the API, and send real-time updates to webhook or SIEM tools.</p>
</div>

<div class="body">

<div class="note fastpath" id="ac_security_access_log__note_enz_qfm_rdc">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Logs &gt; Access log</span>
</div>
<p class="p">The access log, part of the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6561144266906" target="_blank">Advanced Data Privacy and Protection add-on</a>, is a powerful
tool that enhances data security and administrative control of your account. It's a
record of access events for your account related to tickets, user profiles, and
searches. This differs from the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408828001434" target="_blank">audit log</a>, which provides a detailed log of changes to
settings or fields.</p>
<p class="p">The access log is currently available as an <a class="xref" href="https://developer.zendesk.com/api-reference/ticketing/account-configuration/access_logs/" target="_blank">API</a> and in Admin Center, and captures what
data an agent or admin has accessed in your account within the last 90 days. It doesn't
capture end-user activity. </p>
<p class="p">Access logs can help you answer the following questions:</p>
<ul class="ul" id="ac_security_access_log__ul_ybx_5mh_xyb">
<li class="li">What tickets are agents accessing?</li>
<li class="li">What information are agents searching for?</li>
<li class="li">What user profiles are agents viewing?</li>
</ul>
<p class="p">Admins and <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank">agents with permission</a> can view the access
log. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/9972142485530" target="_blank">Access logs use cases and workflows</a> for
examples of how to use the access log to detect security risks and help ensure
compliance.</p>
<div class="p">This article covers the following topics:<ul class="ul" id="ac_security_access_log__ul_bmm_psq_kwb">
<li class="li"><a class="xref" href="#topic_d1k_vph_xyb">Turning on the access log</a></li>
<li class="li"><a class="xref" href="#topic_c4g_23m_pdc">Viewing the access log in Admin Center</a></li>
<li class="li"><a class="xref" href="#topic_zk2_s4v_njc">Generating an AI description for an access log event</a></li>
<li class="li"><a class="xref" href="#topic_mdl_fy5_3hc">Filtering access log data to refine search results</a></li>
<li class="li"><a class="xref" href="#topic_lkj_dmm_pdc">Using the API to export access logs</a></li>
<li class="li"><a class="xref" href="#topic_qfl_gpz_1kc">Delivering access logs in real time with webhooks</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_d1k_vph_xyb">
<h2 class="title topictitle2" id="ariaid-title2">Turning on the access log</h2>
<div class="body">
<p class="p">Before you can view access logs, you must turn on the Access Log API in Admin Center.
When you do, Zendesk begins capturing access events. Access events that occurred
before you turned on the API aren't captured.</p>
<p class="p">Only admins can turn on the access log. After you turn it on, data may take up to 60
minutes to populate.</p>
<p class="p"><strong class="ph b">To turn on the access log</strong></p>
<ol class="ol" id="topic_d1k_vph_xyb__ol_jvc_bnh_xyb">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_d1k_vph_xyb__d9e505" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span></li>
<li class="li">Select <strong class="ph b">Turn on the Access Log API</strong>.</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_c4g_23m_pdc">
<h2 class="title topictitle2" id="ariaid-title3">Viewing the access log in Admin Center</h2>
<div class="body">
<p class="p">The Access log page in Admin Center lets you view a detailed list of access events in
your account. You must first <a class="xref" href="#topic_d1k_vph_xyb">turn on
the access log</a> before viewing it in Admin Center.</p>
<div class="p">
<strong class="ph b">To open the access log in Admin Center</strong><ul class="ul" id="topic_c4g_23m_pdc__ul_fjq_4rm_pdc">
<li class="li">
<span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_c4g_23m_pdc__d9e505" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span><p class="p">The Access logs page appears. </p>
<p class="p"><img class="image img-screenshot" id="topic_c4g_23m_pdc__image_lgd_lll_jhc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_log_event_detail_phase3_marked.png" width="1000"></p>
</li>
</ul>
</div>
<p class="p">Each row in the access log represents a single access event by an agent or admin in
your Zendesk account. Log entries are sorted by time (newest entry first). Click an
event to display its details in the right panel. From the right panel, you can
review the event and <a class="xref" href="#topic_zk2_s4v_njc">generate an AI
analysis</a>.</p>
<p class="p">Use the <strong class="ph b">Show and hide columns</strong> menu icon (<img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_log_column_icon.png" width="15">) in the upper-right corner of the
table to adjust the columns that are visible in the log.</p>
<p class="p"><img class="image img-screenshot" id="topic_c4g_23m_pdc__image_zhz_gh4_mhc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_log_show_columns_phase2.png" width="500"></p>
<p class="p">The following information appears for each event in the access log. </p>
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_c4g_23m_pdc__table_ymx_gkr_slb" rules="all" summary="">
<colgroup>
<col style="width:27.624309392265197%">
<col style="width:72.37569060773481%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry nocellnorowborder" id="d89e232" style="vertical-align:top;">Column</th>
<th class="entry cell-norowborder" id="d89e235" style="vertical-align:top;">Description</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Time</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The time and date when the page or record was accessed, displayed
in <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887059866#topic_dil_hnc_xe" target="_blank">your account's time zone</a>.
If you're unsure what time the access log is using, hover over the
information icon in the <strong class="ph b">Time</strong> column heading.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Event ID</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The unique ID for the access event.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Actor</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The team member or user who accessed the page or record in
Zendesk. This helps track which users are interacting with a
specific account.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">IP address</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The IP address of the user who made the request.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Authorization type</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The method used for user authorization. Examples: Basic, Session,
Digest, Bearer</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Client</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The client software that is initiating the request. Example: a
web browser</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Category</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The type or classification of access that occurred, related to
the performed operation or API call, such as Users, Profiles API, or
Phone numbers. This helps identify the function or system component
involved.<p class="p">Some access events don't have an associated
category, so this field may be empty.</p>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Summary</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">A brief and easy-to-understand description of the access event,
related to the performed operation or API call, such as Show user,
Get profile by identifier, or List phone numbers. Summarizes the
purpose of the access entry.<p class="p">Some access events don't have an
associated summary, so this field may be empty.</p>
</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">HTTP Status</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The HTTP status code of the response.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Method</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The HTTP method of the request. Possible values are GET, POST,
PUT, and DELETE.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">HTTP Response byte size</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The total amount of data, measured in bytes, sent as part of the
HTTP response.</td>
</tr>
<tr class="row">
<td class="entry nocellnorowborder" headers="d89e232" style="vertical-align:top;">Browser URL</td>
<td class="entry cell-norowborder" headers="d89e235" style="vertical-align:top;">The specific URL that the agent accessed when performing the
operation. <p class="p">The Browser URL might not indicate the operation that
was performed. The field is empty when a direct API call is
performed.</p>
</td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" headers="d89e232" style="vertical-align:top;">Accessed API</td>
<td class="entry cellrowborder" headers="d89e235" style="vertical-align:top;">The API called to perform the specific operation.</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_zk2_s4v_njc">
<h2 class="title topictitle2" id="ariaid-title4">Generating an AI description for an access log event</h2>
<div class="body">
<p class="p">You can use AI to describe and analyze an access log event using language that’s
easier to understand. This helps less technical users figure out what happened in a
log event, why it might matter, and what to check next. </p>
<p class="p">You must have <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10013995711386#topic_rwb_5dt_fjc" target="_blank">admin copilot conversational assistance</a>
turned on to view AI summaries.</p>
<p class="p"><strong class="ph b">To generate an AI description for an access log event</strong></p>
<ol class="ol" id="topic_zk2_s4v_njc__ol_uxv_krv_njc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_zk2_s4v_njc__d9e505" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span></li>
<li class="li">Locate and click the event you'd like to generate a description for.<p class="p">Event
details appear in the right panel.</p>
</li>
<li class="li">Click <strong class="ph b">Generate AI description</strong>. <p class="p"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10013995711386#topic_jqy_st2_m2c" target="_blank">Admin copilot</a> opens with a
description and analysis of the event.</p>
<p class="p"><img class="image img-screenshot" id="topic_zk2_s4v_njc__image_fby_msv_njc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_log_AI_analysis.png" width="250"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested1" id="topic_mdl_fy5_3hc">
<h2 class="title topictitle2" id="ariaid-title5">Filtering access log data to refine search results</h2>
<div class="body">
<p class="p">Since the access log can include a large volume of events, filtering makes it easier
to find what you’re looking for.</p>
<div class="note tip" id="topic_mdl_fy5_3hc__note_dh1_pdh_4xb">
<span class="tiptitle">Tip:</span> If you repeat the same access log filters,
bookmark them in your web browser after you apply them. The filter displays in the
URL.</div>
<p class="p"><strong class="ph b">To filter the access log</strong></p>
<ol class="ol" id="topic_mdl_fy5_3hc__ol_j1y_z3t_jsb">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_mdl_fy5_3hc__d9e505" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Logs &gt; Access log</strong>.</span></li>
<li class="li">Click <strong class="ph b">Filter</strong>.<p class="p">Filters appear in a panel.</p>
</li>
<li class="li">To filter by date, set the fields <strong class="ph b">Start date</strong>, <strong class="ph b">Start time</strong>, <strong class="ph b">End
date</strong>, and <strong class="ph b">End time</strong>.<p class="p">The default date reflects the maximum
number of days the log can capture data (90 days). The time reflects the
local time for your account in your <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887059866" target="_blank">localization settings</a>.</p>
</li>
<li class="li">Enter a name or email address in the <strong class="ph b">Actor</strong> field to filter by the people
or systems responsible for the access events. </li>
<li class="li">Apply an activity filter for a more refined search:<ul class="ul" id="topic_mdl_fy5_3hc__ul_irr_bhl_jhc">
<li class="li">
<strong class="ph b">Category</strong>: Type or select a category to filter events by type
(such as Users, Permissions, or Tickets). The drop-down shows a limited
number of categories and displays suggestions after typing three
characters.<p class="p">After you select a category, you can narrow your
results by selecting one or more items from the <strong class="ph b">Summary</strong>
drop-down list. For example, if you selected the Users category, you
can add the <strong class="ph b">Show User</strong> and <strong class="ph b">Update User</strong> summary items to
display only those access events.</p>
</li>
<li class="li">
<strong class="ph b">Accessed API</strong>: Use this field to filter by the accessed API
endpoint path. Example:
<code class="ph codeph">/api/v2/users/6649960843290/related.json</code>
</li>
<li class="li">
<strong class="ph b">GraphQL logs</strong>: Select this option to exclude GraphQL logs, which
track Zendesk component interactions, from the results. Applying this
filter removes these events from the access log to reduce noise, without
stopping event collection or storage, or impacting access log API
endpoints.</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Apply filters</strong>.</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_lkj_dmm_pdc">
<h2 class="title topictitle2" id="ariaid-title6">Using the API to export access logs</h2>
<div class="body">
<p class="p">Use the Access Logs API to export access logs to a CSV file. The API lets you filter
the logs using the same filters as the Admin Center user interface, as described in
<a class="xref" href="#topic_mdl_fy5_3hc">Filtering the data to refine
search results</a>. You can also use scripting to filter the returned
data.</p>
<p class="p">You’ll need to work with a developer or other technical resource at your company to
export the data. See <a class="xref" href="https://developer.zendesk.com/documentation/ticketing/using-the-zendesk-api/exporting-access-logs/" target="_blank">Exporting access logs to a CSV file</a> and
<a class="xref" href="https://developer.zendesk.com/api-reference/ticketing/account-configuration/access_logs/" target="_blank">Zendesk API Reference: Access Logs</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested1" id="topic_qfl_gpz_1kc">
<h2 class="title topictitle2" id="ariaid-title7">Delivering access logs in real time with webhooks</h2>
<div class="body">
<p class="p">You can monitor access log changes by sending access log events to a configured
webhook endpoint in your system, making it easier to stream log data into your
Security Information and Event Management (SIEM) tool or other security and
monitoring tools in real time or near real time. This helps teams reduce manual
polling, improve visibility, and automate audit and compliance workflows more
efficiently. </p>
<p class="p">Admins can create an access log webhook subscription, configure the destination URL
and authentication, and send access log data automatically when relevant events
occur. Contact your web team about setting up the webhook endpoint and providing you
with the URL.</p>
<p class="p">For more information on creating webhooks in Zendesk, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408839108378" target="_blank">Creating webhooks to interact with third-party
systems</a>.</p>
<p class="p">For a description of the access log event data sent to your webhook endpoint, see
<a class="xref" href="https://developer.zendesk.com/api-reference/webhooks/event-types/access-log-events" target="_blank">Access log events</a> in the developer
docs.</p>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/6066010357530",
"url": "https://support.zendesk.com/hc/en-us/articles/6066010357530",
"headline": "Using the access log to monitor agent activity (ADPP add-on)",
"description": "You learn how to turn on and use the access log to review recent agent and admin access events, filter results, and export or send them through webhooks.",
"articleSection": "Protecting your customer's data",
"datePublished": "2023-08-23T16:56:28+00:00",
"dateModified": "2026-08-13T16:13:20.923634+00:00",
"inLanguage": "en",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/6066010357530"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Security",
"@id": "https://support.zendesk.com/hc/en-us/sections/9641715451034"
}
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>