Docs Administration Audit log

Audit log

The record of what the wallet did. Open it when you review activity or investigate a problem.

Dashboard Statistics

Viewing System Statistics

The Dashboard provides at-a-glance metrics:

Counts on the dashboard:

  • Identities: organizational identifiers
  • Keys: cryptographic keys
  • Credentials: credentials in the wallet
  • GS1 Licenses: when the GS1 plugin is enabled

These numbers update as you use the wallet. Status (active, revoked, suspended) is shown on each credential, not as a separate dashboard total.

Using the Audit Log

What is the Audit Log?

The Audit Log records every significant action in the wallet:

  • DID creation and deletion
  • Key creation, export, deletion, and usage
  • Credential issuance, revocation, suspension
  • Secret operations
  • Status changes

This provides full traceability of wallet operations.

Accessing the Audit Log

  1. Click Audit Log in the navigation menu
  2. See chronological list of all operations
  3. Most recent actions appear first

Audit Entry Information

Each entry shows:

  • Timestamp: When the action occurred
  • Operation Type: What was done (e.g., “DID Created”, “Credential Issued”)
  • User: Who performed the action (your email or user ID)
  • Entity: What was affected (DID, credential, key)
  • Status: Success or failure
  • Details: Additional operation-specific information

Filtering the Audit Log

Filter by:

  • Date range: Show only specific time period
  • Operation type: Filter by action (DID, credential, key operations)
  • User: See actions by specific administrators
  • Entity ID: Find all operations on a specific DID/credential/key

Using filters:

  1. Enter criteria in filter fields
  2. Log updates automatically
  3. Clear filters to show all entries

Understanding Operation Types

Common entries (the label you see in the log):

  • Created DID / Added Key to DID: an identity or a key was added
  • Created Credential / Signed Credential: a credential was created or signed
  • Revoked Credential / Suspended Credential / Resumed Credential: status changed
  • Shared Key / Rearranged Key / Updated Key: controller groups were changed
  • Deleted Key Access: someone removed their own access to a key
  • Initiated Key Request / Approved Key Request: a pending key or group change
  • Created Credential Offer / Deleted Credential Offer: an offer was created or removed

Many audit entries are clickable:

  1. Click on an audit entry
  2. Navigate directly to the relevant item
  3. View full details of the DID, key, or credential

This helps investigate operations quickly.

Investigating Issues

When something unexpected happens:

  1. Go to Audit Log
  2. Filter by relevant time period
  3. Look for failed operations (error status)
  4. Check who performed the action
  5. View detailed error messages

Example: Finding when a credential was revoked

  1. Filter by operation type: “Credential Revoked”
  2. Enter credential ID in entity filter
  3. Find the revocation entry
  4. See who revoked it and when
  5. View revocation reason (if provided)

Regular Audit Reviews

  • Daily: Check for any unexpected operations
  • Weekly: Review credential issuance patterns
  • Monthly: Comprehensive security audit

What to look for:

  • Operations at unusual times
  • Unexpected user activities
  • Failed operation patterns
  • High revocation rates
  • Suspicious key usage

Exporting Audit Data

If you need to analyze or archive audit data:

  1. Use the audit log filters to select data
  2. Contact your system administrator for export options
  3. Audit data may be available via API or database queries