> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rxscale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> See every API request, failed attempt and configuration change recorded for your organisation.

# Audit log

The audit log in the admin tool (**Settings → Audit log**) records what happens in your
organisation: configuration changes, webhook deliveries, GDPR exports, and every request
your integrations make to the Management API and the Public API.

## What is recorded for API requests

Every request that can be tied to your organisation gets one entry, whether it succeeds or
fails:

* **Time, method and endpoint**, for example `GET /v1/management/prescriptions/<prescription_uid>`.
* **The requested path.** Query parameter names are kept; their values never are.
* **The API key** that made the request: its identifier, never its secret.
* **Outcome and status code.** For a failed request, the error response your integration
  received (up to 2,000 characters).
* **Client IP address, user agent and duration.**
* **An execution ID** that RxScale support can use to find the request in our logs.

Each API entry has one of these events:

| Event                     | Meaning                                                                                      |
| ------------------------- | -------------------------------------------------------------------------------------------- |
| API read                  | A read that returns no patient data, such as products or doctors                             |
| API read of patient data  | A read that can return patient data, such as patients, prescriptions, orders or appointments |
| API write                 | A request that creates, changes or deletes data                                              |
| API authentication failed | A rejected request (see below)                                                               |

## Failed attempts

Two kinds of rejected requests are recorded as **API authentication failed**:

* A request with the identifier of one of your API keys but the wrong secret (`401`).
* A request with a valid API key that lacks the required permission (`403`).

A request with a missing, malformed or unknown API key cannot be tied to an organisation,
so it does not appear in your audit log. A request rejected by rate limiting (`429`) is not recorded either.

<Note>
  Anyone who knows one of your API key identifiers can cause failed-attempt entries. Repeated
  failed attempts for a key usually mean an integration has the wrong secret, or that someone
  is trying to guess it. If in doubt, replace the key.
</Note>

## What is never recorded

* Request bodies.
* Query parameter values. Search terms can contain patient data.
* Response bodies of successful requests.
* API key secrets.
* Credentials in a request path, such as a waiting room queue ID. They are replaced by
  `[REDACTED]`.

## Retention

| Entries                                                                                   | Kept for |
| ----------------------------------------------------------------------------------------- | -------- |
| Successful API reads that return no patient data                                          | 90 days  |
| All other API entries: reads of patient data, writes, failed requests and failed attempts | 1 year   |

Configuration changes, webhook deliveries and GDPR exports are kept as before.

## Timing and completeness

Entries usually appear within a few seconds of the request. Recording never makes an API request
fail, so in rare cases, such as an infrastructure outage, an entry can be missing.

## Filtering

The audit log shows the last 7 days by default. You can filter by type, event, outcome, API
key and date range. When more than 10,000 entries match, you can page through the newest
10,000; narrow the filters to reach older ones.

## Related topics

* [Management API](/for-telemedicine-providers/management-api)
* [Authentication](/authentication)
* [Public API overview](/api-reference/public/overview)