---
title: Activity log in WatchFor
description: A per-organization audit trail of who changed what and when, across monitors, alerting, incidents, status pages, members and API keys.
canonical: https://watchfor.io/docs/organization/activity-log
---

# Activity log in WatchFor

A per-organization audit trail of who changed what and when, across monitors, alerting, incidents, status pages, members and API keys.

The **activity log** is your organization's audit trail — a readable record of
every meaningful change, with who made it (a team member, or an API key) and
when. Open it from **Settings → Activity log**; viewing it is limited to
**owners and admins** because it reveals the organization's configuration
history.

## What's recorded

| Area | Events |
| --- | --- |
| Monitors | created, updated, paused, resumed, deleted, cloned, history reset, bulk-created (imports), check run now, alerts muted / unmuted. Bulk pause / resume / delete write one entry **per monitor** |
| Alert rules | created, updated, deleted (shown with the monitor they belong to) |
| Notification channels | created, updated, deleted |
| Contacts & contact groups | created, updated, deleted, imported, bulk-deleted; group members added / removed |
| Incidents | acknowledged, resolved (with who and why), marked as maintenance, marked as a false positive / counted as downtime again |
| Internal notes | created, deleted, pinned / unpinned |
| Post-mortems | created, deleted, published / unpublished; action items created, completed, deleted |
| Maintenance windows | created, updated, deleted |
| On-call | schedules created / updated / deleted, overrides created / deleted, escalation policies created / updated / deleted |
| Status pages | page created / updated / deleted; announcements created / updated / deleted |
| Report emails | cadence and recipients created / updated / deleted |
| Members | invited, invitation revoked, joined, removed, role changed (attributed to the owner or admin who changed it) |
| API keys | created, renamed, revoked |
| Organization | settings updated, free workspace allowance claimed |

Changes made through the [REST API](/docs/api), the [MCP server](/docs/api/mcp)
or [A2A](/docs/api/a2a) are recorded exactly like dashboard changes, attributed
to the API key (`API key: <name>`) or to the user behind the OAuth token.

## Readable, not raw

The log is written in plain language, not opaque identifiers:

- each entry shows the **before → after** values of what changed,
- locations show as names (for example 🇩🇪 Frankfurt), not ids,
- intervals and thresholds show with proper units,
- incident events include the **incident number**,
- rule changes show **which monitor** they belong to,
- secrets — passwords, tokens, webhook URLs with credentials — are redacted
  before the entry is written, so the log never becomes a place to read them.

## Filtering and searching

Filter by **entity type** (monitors, alert rules, channels, incidents, …) or
by **who** made the change, and use the free-text search to match an action,
an actor, or a name that appears in the change details — "resolved", the name
of a channel, a monitor's URL.

Entries are kept for as long as the organization exists; there is no
retention cutoff today.

> **Also via API**
>
> Read the log with [`GET /v1/activity`](/docs/api/activity) (filter by
> entity type, action and time range) or the `list_activity`
> [MCP tool](/docs/api/mcp) — useful for compliance exports and for AI agents
> answering "who changed this?".

> **Info**
>
> The activity log answers **"who changed what"**. For **"what alerts were
> sent"** — every notification, with delivery status — use
> [notification history](/docs/notifications/history).

---

Canonical page: https://watchfor.io/docs/organization/activity-log · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt