Every action in the system is recorded in the activity log with a timestamp, the user who performed it, a description, and structured metadata. The activity log provides a complete audit trail of all operations.
Navigate to /activity to access the activity log page.
Use the level tabs at the top of the page to filter entries:
- All — every log entry
- Info — routine operations (order created, stock adjusted, etc.)
- Warning — events that may need attention
- Error — failures and issues requiring investigation
Click the tag filter buttons to show only entries from a specific area:
| Tag | Covers |
|---|---|
| sales | Orders, allocation, shipments, dispatch, refunds, payments, stock reservations |
| purchase | Purchase orders, receiving, returns, invoicing |
| inventory | Product creation and updates, bulk operations, component changes |
| stock | Adjustments, transfers (dispatch and receive), manufacturing production in/out, reservations |
| sync | WooCommerce and Xero synchronisation events |
| settings | All configuration changes |
| auth | Profile updates, password changes, passkey registration and deletion |
| import | CSV imports with record counts |
| manufacturing | Production orders and assembly operations |
| system | Database reset, backup create/restore/upload/delete, scheduled tasks |
Search the activity log by description, action, entity ID, or user name using the search field.
Click on any row to expand it and view additional details:
- Entity type — the type of record affected (e.g. SalesOrder, Product)
- Entity ID — the unique identifier of the affected record
- Action — the specific action performed (e.g. CREATE, UPDATE, DELETE)
- Metadata — full JSON metadata showing exactly what changed
The activity log displays 50 entries per page. Use the pagination controls to navigate through older entries.
- Order creation and status changes
- Stock allocation and auto-allocation
- Shipment creation, status progression, and tracking
- Dispatch and shipping
- Refunds and credit notes
- Payment recording
- Stock reservation changes
- Purchase order creation and updates
- Goods receiving
- Returns to suppliers
- Supplier invoice recording
- Product creation and updates
- Bulk operations
- Component additions and changes
- Stock adjustments (add/remove with reason)
- Transfer dispatch and receipt
- Manufacturing production in and production out
- Stock reservations
- All configuration changes across every settings section
- Profile updates (name, email, avatar)
- Password changes
- Passkey registration and deletion
- User creation, update, and deletion (admin)
- Role changes
- CSV imports with counts of records created, updated, and skipped
- Database reset
- Backup creation, restoration, upload, and deletion
- Scheduled task execution
- Cost-layer snapshot revaluation events (when retrospective landed costs rewrite historical FIFO layers)
- Connection-test fingerprint events (a SHA256 fingerprint of credentials, recorded each time a "Test Connection" is run for WC/Xero/Mintsoft — useful for spotting silent credential rotation)
- Cron rate-limit hits (when a per-route cron quota is exceeded, the rejection is logged so you can spot misconfigured schedules)
The activity log redacts sensitive values at write time — they never reach the database in cleartext, so there is no way to retrieve the original value from the log after the fact. Redacted fields include:
- Passwords and password hashes
- TOTP secrets and recovery codes
- Webhook signing secrets
- OAuth client secrets, refresh tokens, and bearer tokens
- API keys for WooCommerce, Xero, Mintsoft, and SMTP
- Connection-test credential payloads (the SHA256 fingerprint is logged, never the credential itself)
In metadata, these values are replaced with [REDACTED] plus a length hint where useful (e.g. [REDACTED:32]). If you see a redacted value where you expected real data, check the underlying setting page directly — the activity log is intentionally a one-way audit trail for secrets.
Activity log retention is configurable per level in System Settings. Entries older than the configured period are automatically deleted.
| Level | Default Retention |
|---|---|
| Info | 30 days |
| Warning | 60 days |
| Error | 90 days |
Set the retention period to 0 for any level to keep those entries indefinitely.
A daily cron job calls /api/cron/activity-cleanup at 03:00 to purge entries that have exceeded their retention period. No manual intervention is required.