Audit Trail

The Audit Trail is a tamper-evident log of every admin action in the system — who did what, when, and from where. Every create, update, delete, and view operation performed by an admin is recorded with full before/after field values and a SHA-256 integrity checksum.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/audit-trail/overview.png

What Is Logged

Every action performed by an admin through the Kiwire panel generates an audit record. This includes creating a user, editing a profile, deleting a device, changing settings, and even read-only page views.

Audit records are stored in the tenant's audit log. Superuser-level actions (tenant switching, data resets, notification broadcasts) are additionally stored in a separate system-level audit log.

Audit Record Fields

Field	Description
event	The type of action: created, updated, deleted, or viewed.
user_type / user_id	The fully-qualified class name and ID of the admin who performed the action.
auditable_type	The model class that was changed (e.g., App\Models\KiwireUser).
auditable_id	The primary key of the affected record.
old_values	JSON snapshot of the record's fields before the change. Empty for created events.
new_values	JSON snapshot of the fields after the change. For viewed events: {"module":"...", "action":"list|show|edit", "subject_id":"..."}. Empty for deleted events.
url	The full URL of the HTTP request that triggered the event.
ip_address	The IP address of the admin's browser at the time of the action.
user_agent	The browser and OS string from the request headers.
tags	Comma-separated categorisation tags. Common values: view (read-only page loads), superuser (superuser elevation actions), notification, destructive.
checksum	SHA-256 hash computed over 10 record fields at creation time. Used for tamper detection — see Tamper Detection below.
created_at	Exact UTC timestamp when the audit record was written.

View Events

Read-only access is also logged. When an admin opens a list page, detail panel, or edit form, a viewed event is recorded using the LogsViewActivity trait. The new_values field stores the module name, action type (list, show, or edit), and the subject record ID if applicable.

View events are tagged with view and can be filtered out if you only want to see data-change events.

Superuser Events

Actions performed by superuser accounts are tagged with superuser for easy filtering. Superuser-specific events include:

• superuser_login — recorded on every superuser login.
• superuser_tenant_switch — recorded when a superuser switches to a different tenant context.
• notification_broadcast — recorded when a push notification is sent to admins.
• tenant_data_reset — recorded when a tenant's data is reset.

Filters

• Date Range — narrow to a specific time window
• Admin — show actions by a specific admin account
• Event Type — filter by created, updated, deleted, viewed
• Module / Tag — filter by module name or tag (e.g., superuser, view)
• IP Address — show actions from a specific IP

Export

Click Export CSV to download the current filtered view as a CSV file. The export respects all active filters and date range.

Tamper Detection

Every audit record is written with a checksum — a SHA-256 hash computed over the 10 most important fields. If any field in a stored record is modified after creation (whether in the database directly or via an application bug), the checksum will no longer match.

Run the verification command to check all records:

php artisan kiwire:verify-audits
php artisan kiwire:verify-audits --month=202604
php artisan kiwire:verify-audits --tenant=default
php artisan kiwire:verify-audits --all-months

The command exits with a non-zero code if any tampering is detected, making it suitable for use in cron jobs or monitoring scripts. See Audit Integrity in the Security section for the full integrity workflow.

Required Permissions

view-audit-trail