Audit Trail

The Audit Trail is a comprehensive log of every action that happens in your RTILA X installation. Every time a record is created, updated, or deleted, every time a user logs in, every time settings change, and every time a backup is created or restored — it’s all recorded in the Audit Trail.

Think of the Audit Trail as a security camera for your RTILA X installation. It answers the questions: “Who did what, when, and what changed?”

To open the Audit Trail:

1. Click your profile name in the bottom-left corner of the sidebar.
2. Click Preferences → Administration → Open Administration Tools.
3. Click the Audit Trail tab.

Viewing the Audit Trail

The Audit Trail displays a table of all logged events, newest first.

Audit Trail Table Columns

Column	Description
User	The user who performed the action (or “System” for system events)
Event	The type of event (e.g., record.create, user.login.success)
Collection	The database collection affected (e.g., projects, users, queue)
Record ID	The unique ID of the affected record
Date	When the event occurred
Actions	View Details button

Filters

The Audit Trail has five filters to help you find specific events:

Filter	Type	Description
Event	Text	Filter by event type. Type part of an event name (e.g., “record.create” or “login”).
Collection	Text	Filter by collection name. Type part of a collection name (e.g., “projects” or “queue”).
User	Dropdown	Filter by user. Select a specific user from the dropdown.
Start Date	Date	Show only events after this date.
End Date	Date	Show only events before this date.

How to use filters:

1. Type in the Event or Collection fields to filter by event type or collection.
2. Select a user from the User dropdown to see only their actions.
3. Set a date range to narrow results to a specific time period.
4. The table updates automatically as you type or select.

Tip: Combine filters for precise results. For example: filter by Collection “projects” + Event “record.delete” + a date range to see all project deletions in the last week.

Logged Events

The Audit Trail logs the following event types:

Record Events

Event	Description
record.create	A new record was created (project, session, log, etc.)
record.update	An existing record was modified
record.delete	A record was deleted

Authentication Events

Event	Description
user.login.attempt	A login attempt was made (before password verification)
user.login.oauth2.attempt	An OAuth2 login attempt was made
user.login.success	A login was successful
user.token.refresh	A user’s authentication token was refreshed

System Events

Event	Description
system.bootstrap	The application hooks were initialized
system.settings.update	Application settings were updated
system.collections.import	Database collections were imported
system.backup.create	A backup was created
system.backup.restore	A backup was restored
system.terminate	The application is shutting down

Realtime Events

Event	Description
realtime.connect	A realtime connection was established
realtime.subscribe	A realtime subscription was created

File Events

Event	Description
file.download	A file was downloaded
file.token.request	A file access token was requested

Event Details

Each audit log entry stores detailed information about the event. Click the View Details button (eye icon) next to any log entry to see the full details.

What’s in the Details

The details modal shows the complete data associated with the event:

For record.create events	Shows the full data of the created record
For record.update events	Shows both the “from” (before) and “to” (after) data
For record.delete events	Shows the data of the deleted record
For user.login events	Shows the login method and identity
For system events	Shows system-level details

Example: Record Update Details

When you view details for a record.update event, you’ll see:

{
  "from": {
    "name": "Old Project Name",
    "status": "draft",
    "commands": [...]
  },
  "to": {
    "name": "New Project Name",
    "status": "active",
    "commands": [...]
  }
}

This shows you exactly what changed — the “from” data is what the record looked like before the update, and the “to” data is what it looks like after.

Example: Record Create Details

{
  "data": {
    "name": "New Project",
    "status": "draft",
    "commands": [...],
    "datasets": {...}
  }
}

Sensitive Data Protection

The Audit Trail automatically masks sensitive data in log entries:

Data Type	How It’s Protected
Passwords	Always masked as ••••••••
Secrets	Always masked
API tokens	Always masked
API keys	Always masked
Credentials	Always masked
Connection strings	Always masked

Important: Sensitive data is masked in the audit log itself. Even if someone gains access to the audit trail, they cannot see passwords, API keys, or other credentials.

Pagination

The Audit Trail shows 15 entries per page. Use the pagination controls at the bottom to navigate through pages:

Control	Description
Previous	Go to the previous page
Next	Go to the next page
Page X of Y	Shows current page and total pages

Audit Trail Use Cases

Use Case	How to Use the Audit Trail
Who deleted my project?	Filter by Collection “projects” + Event “record.delete” + date range
What changed in this project?	Filter by Collection “projects” + Event “record.update” + the project’s Record ID
Who logged in recently?	Filter by Event “user.login.success” + date range
When was the last backup?	Filter by Event “system.backup.create”
What settings were changed?	Filter by Event “system.settings.update”
Who created this project?	Filter by Collection “projects” + Event “record.create” + date range

Audit Trail Best Practices

Practice	Why It Matters
Review the audit trail periodically	Catch unauthorized access or unexpected changes
Filter by date range for investigations	Narrow results to the relevant time period
Check record.update events for changes	See exactly what changed and when
Monitor user.login events	Detect unauthorized login attempts
Review system.backup events	Verify backups are being created
Export audit data for compliance	Use the data for security audits or compliance requirements

Audit Trail vs. Execution Logs

Feature	Audit Trail	Execution Logs
What it logs	Database changes, logins, system events	Automation execution steps
Who generates it	Database hooks (automatic)	Automation engine during runs
Purpose	Security, compliance, change tracking	Debugging automation issues
Location	Administration → Audit Trail	Execution Logs page
Retention	Permanent (until manually deleted)	Stored per session

Tip: Use the Audit Trail for “who changed what” questions. Use the Execution Logs for “why did my automation fail” questions.