Reference
Audit event fields
What every field in an audit event means, on the Organisation and Authentication tabs and in CSV and JSON exports of the audit log.
OwnerAdmin
Organisation events
| Field | Meaning |
|---|---|
| Timestamp | When it happened. |
| User, User ID | The person who did it, by email and by ID. For share-link downloads, the person who created the link. |
| Action | What happened, like PUT (upload), GET (download), DELETE, LIST, ROLE_UPDATED, or MEMBER_REMOVED. |
| Result | allowed or denied. |
| Bucket, Prefix, Key | Which bucket, folder, and file, when the event is about storage. |
| Resource type, Resource ID | Which quickS3 item was affected, like a role or a connection. |
| Target user | The person affected, for membership and role changes. |
| Event ID | A unique ID for this event. |
| Details | Extra context that depends on the action. For example, via: share_link on share-link downloads, or which AI client acted. |
Authentication events
| Field | Meaning |
|---|---|
| Timestamp | When it happened. |
| User, User ID | The account’s email and ID, when known. |
| Action | Like MAGIC_LINK_REQUESTED, MAGIC_LINK_VERIFY_SUCCESS, MAGIC_LINK_VERIFY_FAILED, LOGIN, LOGOUT, or INVITE_ACCEPTED. |
| Result | Success or Failed. |
| IP address, User agent | Where the request came from and which browser sent it. |
| Event ID | A unique ID for this event. |
A “link requested” event doesn’t mean someone signed in. Requested links can go unused.
What an event never contains
File contents, passwords, storage keys, sign-in tokens, or signed links. If you ever see one of these in an audit event, report it as a security issue.
Events are kept for 14 days. See the audit log.