How to Check Kintone Audit Logs / Log List

Article Number:04054

Using audit logs of Kintone, you can check who performed what kind of action on Kintone and when it was performed.
Audit logs can be checked on Users & System Administration.

Checking the audit log

  1. Click the Settings button Settings button at the upper right of the screen and then click Users & System Administration. Screenshot: Clicking the "Settings" button and then "Users & System Administration"

  2. Click View & Download under Audit Logs.

  3. Specify filter conditions to the extent you can and click View. Screenshot: The "View & Download Audit Logs" screen

    Audit log entries that meet the specified conditions are displayed at the lower area of the screen.

  4. To check the details of an audit log entry, click the i icon. Screenshot: The 'i' icon displayed on the left end of the log list

  5. If necessary, configure the settings for audit logs or export audit logs.

Audit logs

The following sections describe the audit logs that are generated when actions are performed on Kintone.

App Settings

The table below describes audit logs that are generated when actions are performed on App Settings.

Level Module Action Log details Description of the action
Notice App management App update app id: [app ID], app name: [app name], record comment: [true/false] The Comment feature for records was enabled/disabled.
Notice App management App update app id: [app ID], app name: [app name], record history: [true/false] The Change History feature was enabled/disabled.
Notice App management App update app id: [app ID], app name: [app name], bulk delete: [true/false] The Bulk Deletion feature was enabled/disabled.
Information App management App create app name: [app name], app group id: [app group ID] An app was created.
Information App management App create from template file file name = [app name], template name: [comma-separated list of template names], app group id = [app group ID] An app was created via importing of an app template file on the Marketplace.
Information App management App delete If only one app was deleted:
app id: [app ID], app name: [app name]
If multiple apps were deleted in bulk:
app id: [app ID], app name: [app name], (app id: [app ID], app name: [app name]), (.....
An app(s) was deleted.
Information App management App restore If only one app was restored:
app id: [app ID], app name: [app name]
If multiple apps were restored in bulk:
app id: [app ID], app name: [app name], (app id: [app ID], app name: [app name]), (.....
An app(s) was restored.
Information App management App update app id: [app ID], app name: [app name], target: general The Appearance setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: form The Form setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: view A view was added, edited, or duplicated.
Information App management App update app id: [app ID], app name: [app name], target: notification The Notifications setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: title The Title Field setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: category The Categories setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: report A graph was added, edited, or duplicated.
Information App management App update app id: [app ID], app name: [app name], target: status The Process Management setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: action An app action was added, edited, or deleted.
Information App management App update app id: [app ID], app name: [app name], target: app acl The Permissions for App setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: record acl The Permissions for Records setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: field acl The Permissions for Fields setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: info The Misc Settings were changed.
Information App management App update app id: [app ID], app name: [app name], record duplication: [true/false] The Duplicate Record feature was enabled/disabled.
Information App management App update app id: [app ID], app name: [app name], target: resource The Localization setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: customize The JavaScript and CSS Customization setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: plugin A plug-in was added, deleted, enabled, or disabled; or its setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: api token The API Token setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: webhook The Webhooks setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: theme The Color Theme setting was changed.
Information App management App update app id: [app ID], app name: [app name], target: icon The app icon was changed*2
Information App management App report delete app id: [app ID], app name: [app name], report id: [graph ID], report name: [graph name] A graph was deleted.
Information App management App view delete app id: [app ID], app name: [app name], view id: [view ID], view name: [view name] A view was deleted.
Information App management App change discard app id: [app ID], app name: [app name] Changes to App Settings were discarded.
Information App management App change deployed app id: [app ID], app name: [app name] Changes to App Settings were deployed.
Information App management Add slack integration app id: [app ID], app name: [app name], slack workspace: [URL of the integrated Slack] An app was integrated with a Slack workspace.
Information System administration Template download If the download was successful:
The following two logs are generated.
  • app id: [app ID], template name: [template name]
  • filename: [file name]
If the download failed:
app id: [app ID], template name: [template name]
An app was downloaded as an app template.
Information App management App move started

If an app that belonged to a space was moved to a different space:
app id: [app ID], app name: [app name], source space id: [source space ID], source space name: [source space name], destination space id: [destination space ID], destination space name: [destination space name]

If an app that belonged to a space was moved outside of any spaces:
app id: [app ID], app name: [app name], source space id: [source space ID], source space name: [source space name], destination space: none

If an app that did not belong to any space was moved inside a space:
app id: [app ID], app name: [app name], source space: none, destination space id: [destination space ID], destination space name: [destination space name]

Which space an app belongs to was changed.

*1: The log is generated when the Save button is clicked on the "Appearance" setting screen.
*2: The log is not generated when the app icon is changed via the Appearance setting.

Actions on app records

The table below describes audit logs that are generated when actions are performed on app records.

Level Module Action Log details Description of the action
Information App operation Record file upload app id: [app ID], app name: [app name], record id: [record ID], filename: [file name] A file was attached to a record.
Information App operation Record file download app id: [app ID], app name: [app name], record id: [record ID], filename: [file name]
An attachment was downloaded.
Information App operation Record comment delete app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment number] A comment was deleted.
Information App operation Record delete app id: [app ID], app name: [app name], record id: [[comma-separated list of record IDs]] A record was deleted.
Information App operation Record bulk delete app id: [app ID], app name: [app name] Records were deleted in bulk.*1
Information App operation Record import registered app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name]
A file to be imported into an app was registered.
Information App operation Record import started app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name]
The import of record data from a file started.*1
Information App operation Record import finished*3 app id: [app ID], app name: [app name], number of file lines: [number of file lines*2], file size: [file size], filename: [file name]
The import of record data from a file was completed.*1
Information App operation Record export app id: [app ID], app name: [app name] Record data was exported to a file.*1
Information App operation Report export app id: [app ID], app name: [app name] A graph was exported to a file.*1
Information App operation Exported file download app id: [app ID], app name: [app name], filename: [file name] A file that contains exported record data was downloaded.
Information App operation Webhook notify

If the notification was successfully sent:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS / DELETE_RECORD}, server url: [destination server URL], status code: [notification status code]

If the notification could not be sent due to an error attributable to Kintone:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS / DELETE_RECORD}, server url: [destination server URL], error type: CLIENT_ERROR, error message: [error message]

If the notification could not be sent due to an error attributable to the web service that receives the notification:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS / DELETE_RECORD}, server url: [destination server URL], error type: SERVER_ERROR, status code: [HTTP status code of the notification]
A Webhook notification was sent.
Information App operation Send slack dm

If the notification was successfully sent:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], status code: [response status code from Slack API]

If the notification could not be sent due to an error attributable to Kintone:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: CLIENT_ERROR, error message: [error message]

If the notification could not be sent due to an error attributable to Slack that receives the notification:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: SERVER_ERROR, status code: [response status code from failed Slack API], error message: [error message]
A Slack notification was sent.

*1: The Accessed section of the log details displays "127.0.0.1" regardless of the device on which the action was performed.
*2: If the user who performs the action sets the first row of the file as the header when importing a file, the number of file lines specified in the log will be 1 less than the actual number of lines in the file.
*3: The actions performed before the August 2021 update are logged as "Record import".

Portal

The table below describes audit logs that are generated when actions are performed on Portal.

Level Module Action Log details Description of the action
Information Portal operation Portal announcement file download filename: [file name] A file or image attached to the Announcement section was downloaded or displayed in a slide show.

People

The table below describes audit logs that are generated when actions are performed on People pages.

Level Module Action Log details Description of the action
Information People operation People comment file download user: [login name], comment url: [post/comment URL], filename: [file name] A file or image attached to a post or comment was downloaded or displayed in a slide show.

Messages

The table below describes audit logs that are generated when actions are performed on messages.

Level Module Action Log details Description of the action
Information Message operation Message comment file download users: [[comma-separated list of login names]], comment url: [post URL], filename: [file name] A file or image attached to a post was downloaded or displayed in a slide show.

Spaces

The table below describes audit logs that are generated when actions are performed on spaces.

Level Module Action Log details Description of the action
Information Space management Space add space id: [space ID], space name: [space name] A space or guest space was created.
Information Space management Space update space id: [space ID], space name: [space name] The Space Settings were changed.
Information Space management Space delete If there were no apps placed in the space:
space id: [space ID], space name: [space name]
If there were any apps placed in the space:
space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (.....
A space was deleted.*1
Information Space management Space restore If there were no apps placed in the space when the space was deleted:
space id: [space ID], space name: [space name]
If there were any apps placed in the space when the space was deleted:
space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (.....
A space was restored.
Information Space operation Space join space id: [space ID], space name: [space name] A user joined a space.*1
Information Space operation Space leave space id: [space ID], space name: [space name] A user left a space.*1
Information Space operation Space body file download space id: [space ID], space name: [space name], filename: [file name]
A file uploaded to the body of a space was downloaded, or an image attached to the body of a space was displayed in a slide show.
Information Space operation Thread body file download space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], filename: [file name]
A file uploaded to a thread body was downloaded, or an image attached to a thread body was displayed in a slide show.
Information Space operation  Thread comment file download  space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], comment url: [post/comment URL], filename: [file name]
A file uploaded to a post or comment in a thread was downloaded, or an image attached to a post or comment in a thread was displayed in a slide show.
Information Space template Space Template add space template id: [space template ID], space template name: [space template name] A space template was created.

*1 This log is generated also when the action to change space members or delete a space is performed via the Space Management setting in Kintone Administration.

Guest spaces

The table below describes audit logs that are generated when actions are performed on guest spaces.

Level Module Action Log details Description of the action
Notice Guest management Invite guest space id: [space ID], space name: [space name], Email: [[comma-separated list of e-mail addresses]] A guest invitation e-mail(s) was sent.
Notice Guest operation Integrate account domain id: [domain ID of the guest space that was joined] A user joined a guest space in a different domain.
Notice Guest operation Guest download file login name: [login name of the guest user], app id: [app ID], app name: [app name], record id: [record ID], filename: [file name], space id: [space ID], space name: [space name]
A guest user downloaded an attachment.*1
Notice Guest operation Guest export record login name: [login name of the guest user], app id: [app ID], app name: [app name] A guest user exported record data to a file.*2
Notice Guest operation Guest integrate account login name: [login name of the guest user], domain id: [home domain ID] An invitee registered an account (signed up with the invitee's own Kintone account).*3
Information Space management Space add space id: [space ID], space name: [space name] A space or guest space was created.
Information Guest operation Guest sign up login name: [login name of the guest user], space id: [space ID], space name: [space name] An invitee registered an account (registered a new guest account).*3
Information Guest operation Guest join space login name: [login name of the guest user], space id: [space ID], space name: [space name] A guest user joined a space.
Information Guest operation Guest withdraw login name: [login name of the guest user], space id: [space ID], space name: [space name] A guest user left a space.
Information Guest operation Guest login login name: [login name of the guest user] A guest user logged in.
Information Guest operation Guest logout login name: [login name of the guest user] A guest user logged out.
Information Guest operation Guest Email update login name: [login name of the guest user], new login name: [login name of the guest user] A guest user changed the e-mail address.
Information Guest operation Guest password update login name: [login name of the guest user] A guest user changed the password.
Information Guest operation Guest send email login name: [login name of the guest user] An e-mail for a guest user to reset the password was sent.
Information Guest operation Guest reset password login name: [login name of the guest user] A guest user reset the password.

*1: After the update on December 10, 2017, the same logs as those generated for standard users are generated.
*2: The Accessed section of the log details displays "127.0.0.1" regardless of the device on which the action was performed.
*3: For details, refer to the "Audit logs generated when a guest user's account is registered" section.

Kintone Administration

The table below describes audit logs that are generated when actions are performed on Kintone Administration.

Level Module Action Log details Description of the action
Notice System administration Admit creation space granted users: [[login name, department code, group code]], revoked users: [[login name, department code, or group code]] The "Create Guest Spaces" permission was configured.
Notice System administration Guest user two-step verification enabled / disabled The Guest Authentication setting was changed.
Notice System administration New feature update changes in design and layout of app settings screen disabled: {true/false}, changes in design and layout of plug-ins setting screen disabled: {true/false}, split acl transactions on deployment disabled: {true/false}, drag-and-drop reordering of attachments on new record screen and edit record screen disabled: {true/false}, new feature disabled by default: {true/false}, show multiple record import errors enabled: {true/false} The Update Options setting was changed.
Notice System administration Feature update mail notification: {true/false} (include official api: {true/false}), space: {true/false}, allow create apps out of space: {true/false}, guest space: {true/false}, people: {true/false}, mail type: {text/html}, allow mail type personalization: {true/false}, mail personal setting:{none/mention} The Feature Activation setting was changed.
Notice System administration Mobile setting update default view: [PC/MOBILE], user setting: [true/false] The Default View for Mobile Browsers setting was changed.
Information System administration App group delete app group id: [app group ID], app group name: [app group name] An app group was deleted.
Information System administration Template import (template id: [template ID], template name: [template name]), filename: [file name] An app template was added via importing of an app template file.
Information System administration Template export (template id: [template ID], template name: [template name]), filename: [file name] An app template was exported to a file.
Information System administration Plug-in installed plugin id: [plug-in ID], plugin name: [plug-in name] A plug-in was installed.
Information System administration Plug-in removed plugin id: [plug-in ID], plugin name: [plug-in name] A plug-in was uninstalled.
Information System administration Plugin list export filename: [file name] The list of plug-ins was downloaded.
Information System administration App list export filename: [file name] The list of apps was downloaded.
Information System administration Space list export filename: [file name] The list of spaces was downloaded.
Information System administration User usage list exported filename: [file name] The list of user access was downloaded.
Information Space template Space Template import name: [template name] A space template was added via importing of a space template file.
Information Space template Space Template export name: [template name] A space template was exported to a file.
Information Space template Space Template delete name: [template name] A space template was deleted.
Information Guest management Guest status update login name: [login name of the guest user], status: [true/false] A guest user's status (active/inactive) was changed.
Information Guest management Delete guest login name: [login name of the guest user] A guest user was deleted.

Inviting someone

The table below describes audit logs that are generated when actions to invite someone are performed.

Level Module Action Log details Description of the action
Notice System administration Invite users user names: [[comma-separated list of user names]], Emails: [[comma-separated list of e-mail addresses]] An invitation(s) was sent via the user invitation dialog.

Actions performed via API

The table below describes audit logs that are generated when actions are performed via API.

Level Module Action Log details Description of the action
Information API operation App create app id: [app ID], app name: [app name] The Add Preview App API was executed.
Information API operation App deploy app id: [comma-separated list of app IDs], revert: {true/false} The Deploy App Settings API was executed.
Information API operation App update app id: [app ID], app name: [app name]
The Update General Settings API was executed.
Information API operation App permission update Actual environment:
app id: [app ID], app name: [app name]

Test environment:
app id: [app ID], app name: [app name], preview
The Update App Permissions API was executed.
Information API operation Form update app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] The Add Form Fields API was executed.
Information API operation Form update app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] The Update Form Fields API was executed.
Information API operation Form update app id: [app ID], app name: [app name], field code: [comma-separated list of field codes] The Delete Form Fields API was executed.
Information API operation Form update app id: [app ID], app name: [app name] The Update Form Layout API was executed.
Information API operation Field permission update Actual environment:
app id: [app ID], app name: [app name]

Test environment:
app id: [app ID], app name: [app name], preview
The Update Field Permissions API was executed.
Information API operation App view update app id: [app ID], app name: [app name], views: [comma-separated list of existing views] The Update Views API was executed.
Information API operation App report update app id: [app ID], app name: [app name], reports: [comma-separated list of existing graphs] The Update Graph Settings API was executed.
Information API operation App customize update app id: [app ID], app name: [app name] The Update Customization API was executed.
Information API operation Record add app id: [app ID], app name: [app name], record id: [record ID] The Add Record API was executed.
Information API operation Record add app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] The Add Records API was executed.
Information API operation Record update app id: [app ID], app name: [app name], record id: [record ID] The Update Record API was executed (using the record number as the key for the update).
Information API operation Record update app id: [app ID], app name: [app name], field: [field code], value: [key value] The Update Record API was executed (using a value other than the record number as the key for the update).
Information API operation Record update app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs], record key: [comma-separated list of UpdateKey values] The Update Records API was executed.
Information API operation Record permission update Actual environment:
app id: [app ID], app name: [app name]

Test environment:
app id: [app ID], app name: [app name], preview
The Update Record Permissions API was executed.
Information API operation Record delete app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] The Delete Records API was executed.
Information API operation Record status update app id: [app ID], app name: [app name], record id: [record ID] The Update Status API was executed.
Information API operation Record status update app id: [app ID], app name: [app name], record id: [comma-separated list of record IDs] The Update Statuses API was executed.
Information API operation Record comment add app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment ID] The Add Comment API was executed.
Information API operation Record comment delete app id: [app ID], app name: [app name], record id: [record ID], comment id: [comment ID] The Delete Comment API was executed.
Information API operation Record comment get app id: [app ID], app name: [app name], record id: [record ID], comment id: [comma-separated list of comment IDs] The Get Comments API was executed.
Information API operation Record assignees update app id: [app ID], app name: [app name], record id: [record ID] The Update Assignees API was executed.
Information API operation Record file download app id: [app ID], app name: [app name], record id: [record ID], filename: [file name] The Download File API was executed.
Information API operation Thread comment add space id: [space ID], space name: [space name], thread id: [thread ID], thread name: [thread name], comment id: [comment ID] The Add Thread Comment API was executed.
Information API operation App status update app id: [app ID], app name: [app name], enable: [Process Management availability], states: [list of status names after the update], actions: [list of action names after the update] The Update Process Management Settings API was executed.
Information API operation Space delete If the specified space ID did not exist, or if "Activate Spaces" in the Feature Activation setting in Kintone Administration was disabled:
space id: [space ID]
If there were no apps placed in the space:
space id: [space ID], space name: [space name]
If there were any apps placed in the space:
space id: [space ID], space name: [space name], (app id: [app ID], app name: [app name]), (....
The Delete Space API was executed.
Information API operation Guests delete guest user code: [comma-separated list of e-mail addresses] The Delete Guests API was executed.
Information API operation Webhook notify

If the notification was successfully sent:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS}, server url: [destination server URL], status code: [status code of the notification]

If the notification could not be sent due to an error attributable to Kintone:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS}, server url: [destination server URL], error type: CLIENT_ERROR, error message: [error message]

If the notification could not be sent due to an error attributable to the web service that receives the notification:
app id: [app ID], app name: [app name], record id: [record ID], notification id: [notification ID], event type: {ADD_RECORD / ADD_RECORD_COMMENT / UPDATE_RECORD / UPDATE_STATUS}, server url: [destination server URL], error type: SERVER_ERROR, status code: [HTTP status code of the notification]
A Webhook notification was sent via API.
Information API operation Send slack dm

If the notification was successfully sent:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], status code: [response status code from Slack API]

If the notification could not be sent due to an error attributable to Kintone:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: CLIENT_ERROR, error message: [error message]

If the notification could not be sent due to an error attributable to Slack that receives the notification:
app id: [app ID], app name: [app name], record id: [record ID], slack subdomain: [receiver Slack subdomain], user: [login name of the user], Email: [e-mail address of the user], error type: SERVER_ERROR, status code: [response status code from failed Slack API], error message: [error message]
A Slack notification was sent via API.
Information API operation Cursor create app id: [app ID], app name: [app name] The Add Cursor API was executed.
Information API operation Notification update app id: [app ID], app name: [app name] An API to change the General Notifications, Per Record Notifications, or Reminder Notifications setting was executed.
Information API operation App action update app id: [app ID], app name: [app name], actions: [comma-separated list of existing app actions] The Update Action Settings API was executed.

Audit logs generated when a guest user's account is registered

Invitees can join a guest space to which they are invited by signing up in either of the following ways.

  • Sign up using the invitee's own Kintone account (if the invitee is a Kintone user in a different domain)
  • Sign up by registering a new guest account

When an invitee signs up with the invitee's own Kintone account, the action is logged as "Guest integrate account".
When an invitee signs up by registering a new guest account, the action is logged as "Guest sign up".
If an invitee signs up with the invitee's own Kintone account, no charge will be incurred for the invitee's guest account.