The two audit trails
Administration and Content Credentials — what is in them and how to find what you are looking for.
Settings → „Audit“ holds two trails, switchable through „Audit-Ansicht wählen“ (Choose audit view):
- „Verwaltung“ (Administration) — what was changed in the workspace.
- „Content Credentials“ — signing, verifying and serving files.
Owners and admins only. For everybody else the surface is not reachable.
The signed-in product speaks German, so its labels are quoted in German throughout, with the English rendering in italics.
Entries stay as they are
Both trails are only added to. Updating and deleting are excluded.
An entry is written together with the change it documents. If it fails, the change fails: there is no change without its entry and no delivery without its row.
Rows outlive their subject. Where an output is deleted, project, folder and file stay empty in the row and the row itself stays readable; the burnt-in label variant sits in the event.
The „Akteur“ and „Veranlasst von“ columns
Where the „Akteur“ (actor) column reads „System“, no human was involved. In the Content Credentials trail that applies to every signature and every verification — the service performs both. In the administration trail „System“ appears for the automatic sweeps of the trash and of deleted projects, and for an operational intervention.
„Veranlasst von“ (originated by) does not name who triggered the event but who created its subject: who produced the output or uploaded the file. A signature therefore never has an actor but always has an originator.
Where „Veranlasst von“ is empty, either nothing was recorded or the output was deleted. Empty fields cannot be filtered for.
What you can filter
The administration trail has three filters — event, actor and a free-text search — plus sorting; the Content Credentials trail has five.
The free-text search „In Details suchen …“ (search in details) searches the details column and the subject's identifier, not the event name.
The events around projects are in the event picker: creating, renaming, deleting, restoring and permanently deleting a project, moving a folder into another project, changing a project’s details and its export template, and creating, renaming and deleting a project field. No entry carries the value of a project field.
So is the access to restricted projects — restricting, opening to everyone, granting and revoking access —, the groups: creating, renaming, deleting, adding and removing a member, and „Projektrechte geändert“ (Project permissions changed), when somebody sets under „Berechtigungen“ (Permissions) what members may do with projects.
The events around single sign-on are there too: adding a domain, confirming it, removing it, reissuing its proof, and a domain that is no longer confirmed. Also linking an SSO sign-in to an existing account. The details column shows the domain. When a check no longer finds the TXT record, it shows that reason as well. The same goes for calibrating a label variant.
Neither trail has a time filter. To narrow a period, use the export.
When an event does not appear at all
From the member area only two events write an entry: „Einladung erstellt“ (invitation created) and „Einladung widerrufen“ (invitation revoked). Role change, deactivation, removal and accepting an invitation do not appear in the trail.
Where a person has been removed from the workspace, they are no longer in the actor picker either — they cannot be filtered for after that.