# The audit log

The chronological history of administration actions, NFC scans and API calls, filterable and paginated.

Source: https://docs.sealtrust.io/en/console/journal-audit/

---

This screen gathers into a single list what has happened on your account: actions taken from the console, tag scans and partner API calls. It answers the question "who did what, when, and from where". You open it to reconstruct a sequence of events, or to check what an account did over a period.

![The audit log, with its filter card and its event table](/console/journal-audit.en.webp)

## What the screen shows

The "Security Audit Trail" header, subtitled "Complete history of security actions and system events".

A filter card with four fields: event type, start date, end date, actor.

The total number of results above the table, followed by "event(s)".

A table with six columns: Date, Type, Actor, Action, Details, IP. Each type carries its colour pill: Authentication in teal, Mint in green, Burn in red, Transfer in amber, NFC Scan in grey, API Call outlined.

A pagination bar, "Page {page} of {totalPages}", with the "Previous" and "Next" buttons.

## What you can do here

Filter by type, among seven choices: All types, Authentication, Mint, Burn, Transfer, NFC Scan, API Call. "All types" applies no filter.

Restrict to a date range with the two pickers.

Search for an actor by email address, the field's placeholder being "Search by email...". Spaces around your entry are stripped.

Move from page to page. The buttons are disabled on the first and the last page. Changing a filter takes you back to page 1.

## What governs access

You must be signed in and an administrator. Otherwise the console replaces the page with "Unauthorized. Please log in at www.sealtrust.io." and a sign-in button. No plan feature is required.

This screen is not in the side menu: you reach it through the "Audit reports" shortcut card on the security dashboard.

A brand administrator sees three things only: the actions of users who share one of their brands, the scans of their products and the calls made by their API keys.

## What the screen refuses

The list is paginated by 25 events. That value is set by the screen, you cannot change it. Events are sorted by descending date before being cut into pages.

IP addresses are never shown in full. An address in dotted notation keeps its first two numbers, followed by three asterisks. Any other value, an IPv6 address included, is replaced entirely by three asterisks, and a missing address shows a dash.

The type of an administration event is deduced from the text of the action: a label containing login becomes Authentication, mint becomes Mint, burn becomes Burn, transfer becomes Transfer, and everything else falls back to Authentication.

For an NFC scan, the actor shown is the author of the scan, failing that the wallet address, failing that the word anonymous. For an API call, it is the name of the key used, or the word key# followed by the key identifier when that key has no name, the details carrying the status code of the response.

On failure, the page shows "Failed to load audit events" in a red banner. With no matching event, it shows "No events" and "No audit events match the selected filters".