> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebila.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Trail

> Monitor every action, login, and API request made within your Bila account.

The **Audit Trail** gives you complete visibility into everything that happens inside your account. Every login, setting change, and API request is logged, giving you a full, tamper-evident record for security reviews, compliance checks, and incident investigation.

<Info>
  Only a **Merchant Admin** can access the Audit Trail.
</Info>

## Step 1: Open the Audit Trail

1. Click **Settings** at the bottom of the left sidebar.
2. Select the **Audit Trail** tab from the top navigation bar.

The dashboard displays a chronological list of all account activity, including the timestamp, acting admin, HTTP method, endpoint accessed, and request status.

## Step 2: Search and Filter Logs

Use the filters at the top of the dashboard to narrow down entries:

| Filter          | How to Use                                                            |
| --------------- | --------------------------------------------------------------------- |
| **Search bar**  | Search by keyword, endpoint, or action description                    |
| **Admin email** | Filter to see all actions performed by a specific team member         |
| **IP address**  | Track activity originating from a specific device or network location |
| **Date range**  | Set a Start date and End date to isolate a specific time window       |
| **HTTP method** | Filter by action type: view, create, update, or delete                |

<Tip>
  For security investigations, combine Admin email with a Date range to reconstruct exactly what a specific team member did during a given period.
</Tip>

## Step 3: Understand HTTP Methods

Every log entry includes a **Method** that describes the type of action performed:

| Method   | Action Type      | What It Means                                                                                  |
| -------- | ---------------- | ---------------------------------------------------------------------------------------------- |
| `GET`    | View / Read      | The user viewed information - checking a balance, loading a list, or opening a record          |
| `POST`   | Create           | The user added something new - creating a payment, inviting an admin, or generating an API key |
| `PUT`    | Update / Replace | The user replaced an existing setting or record entirely                                       |
| `PATCH`  | Modify           | The user made a targeted edit to part of an existing record or setting                         |
| `DELETE` | Remove           | The user deleted a record, API key, or team member from the system                             |

<Warning>
  `DELETE` and `PUT` actions are the highest-risk entries in your audit log. Review these immediately if you notice unexpected changes to settings, team members, or API keys.
</Warning>

## Step 4: View Detailed Log Entries

To inspect the full details of any specific action:

1. Click the **eye icon** in the **Actions** column next to the log entry.
2. The **Audit log details** side panel opens.

### Request Summary

| Field            | Description                                            |
| ---------------- | ------------------------------------------------------ |
| **Method badge** | The HTTP method used (e.g., `GET`, `POST`, `DELETE`)   |
| **Endpoint**     | The full API path accessed                             |
| **Duration**     | How long the request took to complete, in milliseconds |
| **IP Address**   | The network address the request originated from        |
| **Timestamp**    | The exact date and time the action occurred            |
| **User Agent**   | The browser and operating system used                  |

### Response Body

The **Response body** tab shows the raw API response returned for that request. This is the most detailed view available for any logged action.

```json theme={null}
{
  "data": [
    {
      "recipient": "+2609***000",
      "event": "payment.received",
      "status": "DELIVERED",
      "messagePreview": "You received ZMW 250 from 0960000001. Ref: DEP-abc123-001. Balance: ZMW 1,250.",
      "providerRef": "MTN-ZM-00123456"
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 4,
    "totalPages": 1
  }
}
```

<Info>
  A `providerRef` of `null` means the message was rejected before it reached the mobile network. Verify the recipient's contact details in **Admins** or **Cashiers**.
</Info>

### Location

Switch to the **Location** tab to see the geographic and network origin of the action:

| Field       | Description                                             |
| ----------- | ------------------------------------------------------- |
| **City**    | The city associated with the request's IP address       |
| **Country** | The country the request originated from                 |
| **ISP**     | The Internet Service Provider linked to that IP address |

<Warning>
  If you see a City, Country, or ISP that doesn't match your team's known locations, treat it as a potential security incident. Review the admin's account, reset their password, and consider deactivating the account while you investigate.
</Warning>

## Security Investigation Reference

| What You See                                                | What to Do                                                                      |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `DELETE` action on an admin or API key you didn't authorise | Check User Info for the acting admin and reset their credentials immediately    |
| `POST` to a payments endpoint at an unusual time            | Cross-reference with Location to verify the request came from a known device    |
| Multiple `GET` requests from an unfamiliar IP               | Check ISP and City - could indicate credential sharing or a compromised session |
| `providerRef: null` on critical alerts                      | Verify the recipient's phone number is correct in their profile                 |
| Actions from an admin who has left the business             | Deactivate their account immediately via **Settings → Admins**                  |

## Next Steps

<CardGroup cols={2}>
  <Card title="SMS Logs" icon="bell" href="/docs/guide/sms-logs/overview">
    Monitor SMS alert delivery for your team and customers.
  </Card>

  <Card title="Team Members" icon="users" href="/docs/guide/team-members/team-member-feature">
    Manage who has access to your account and at what level.
  </Card>
</CardGroup>