Audit Logs (Early Access)

Audit Logs help account admins maintain oversight of their mParticle organization by recording what changes are made, who made them, and what resources are affected. Audit Logs capture a wide range of features and activity, from updates to warehouse sync configurations to added API credentials.

This visibility makes it easier to troubleshoot unexpected behavior and provides an auditable record for security and compliance purposes.

Accessing Audit Logs

To access Audit Logs:

1. Log into your mParticle account.
2. Hover your cursor over the Settings icon in the left hand navigation, and select Platform.
3. Select the Audit tab.

Viewing Audit Logs

The Audit Logs tab displays the 100 most recent actions taken in your mParticle organization, sorted from most to least recent by default.

Each row pertains to a log for a single action, and includes the following details:

• Timestamp: the date and time when the action was performed.
• Actor: the email address of the mParticle user who performed the action.
• Actor Type: indicates if the action was made by a user in the UI, an mParticle support agent, an API call, or a system change.
• Action: indicates the type of action performed on the resources. Can be either created, updated, or deleted.
• Resource: the specific resource that was impacted.
• Result: indicates if the action resulted in a success or failure.
• Scope: indicates if the action impacts resources within the scope of a single workspace, account, or the entire org.

See Resources and actions included in Audit Logs below for a complete list of the actions and resources recorded in audit logs.

Search for a specific audit log

Use the search bar to look for a specific audit log. You can also search for information in the details for each log, allowing you to look for logs related to specific resources.

Sorting audit logs

To sort the list of logs, click the column name for the attribute (for example: Timestamp, Resource, or Actor) you want to sort by.

Filter audit logs by date range

To only view audit logs within a specific date range, click Date Range and select the start and end date.

If you download your audit logs as a CSV, only logs within the set date range will be included in the CSV file.

Audit log details

You can see more technical information for a specific log by clicking on any row in the list.

This opens a panel labeled Details containing a JSON formatted object that lists the following information about the request:

• http_method: The type of request your action used, such as GET, POST, PUT, or DELETE.
• url: The full web address of the request.
• user_agent: Information about the browser, SDK, or tool that sent the request.
• content_type: The format of the request body, such as JSON.
• content_length: The size of the request body in bytes. This includes the action arguments, payload, and any entity changes.
• action_arguments: The specific parameters that were passed in with the request.
• status_code: The result of the request, shown as a standard HTTP status code (for example, 200 for success or 404 if something wasn’t found).
• response_content_type: The format of the data that was returned in the response.
• latency_ms: How long it took to process the request, measured in milliseconds.
• payload: The full body of the request and response, which may include details about what was submitted to mParticle and what was returned.
• entity_changes: The changes that were made to a resource (like an audience or output configuration) as a result of the action.

If any of the above fields aren’t applicable to the particular log you are viewing, they will be omitted from the log details.

The log details for each action is included in audit log CSV exports.

Exporting audit logs

To export your audit logs to a comma separated values formatted file, click Download CSV.

The CSV will contain all logs within the selected date range.

Use cases and best practices

You can use Audit Logs to monitor changes, help diagnose issues, and maintain a trusted record for compliance and security.

Track configuration changes

Audit Logs provide a complete history of configuration changes across your mParticle account over the previous 12 months. For example, if a data pipeline stops behaving as expected, you can review the logs to see whether a teammate recently deactivated a connection or updated a data plan.

By monitoring these changes, you can maintain consistency across workspaces and prevent accidental misconfigurations from disrupting your data flow.

Troubleshoot issues

When something breaks (such as a connection unexpectedly failing, an audience not updating, or a data feed behaving differently), Audit Logs can help you identify the root cause. You can see who made changes, what was changed, and whether the action succeeded or failed. This context reduces the time it takes to diagnose problems and allows you to resolve them without unnecessary guesswork.

Support compliance and security audits

Many organizations need to demonstrate that data systems are being properly managed and monitored. Audit Logs give you an auditable trail of who accessed or updated critical settings and when. You can use this history to confirm that your team is following internal governance processes, and to provide evidence during external compliance reviews or security audits. Regularly exporting logs can also help you maintain a long-term archive beyond the retention window in the mParticle platform.

Resources and actions included in Audit Logs

Audit Logs covers a wide range of resources across Customer 360, Data Platform, Oversight, Segmentation, Settings, and Warehouse Sync. The table below lists every resource and the actions that are tracked.

Platform Area	Resource	Actions Logged
Customer 360	Calculated Attribute	Creating, updating, or deleting a calculated attribute. Updating includes cloning a calculated attribute.
	Group Definition	Creating, updating, or deleting a group definition.
	Predictive Attribute	Creating, updating, or deleting a predictive attribute.
	User Profile	Updating a user profile. This includes creating, updating, and deleting any attribute, identity or consent value for user profile via the UI or IDSync API.
Data Platform	Bulk Profile Deletion Request	Creating a bulk deletion request.
	Connection	Creating, updating, or deleting a connection. Updating includes activating and deactivating a connection.
	Data Plans	Creating, updating, or deleting a data plan. Updating includes activating, deactivating, assigning a version to (and changing the version of) a data plan.
	Data Points	Creating, updating, or deleting a data point. Updating includes updating the description, tags, or tier of a datapoint in the Data Catalog.
	Filters	Creating, updating, or deleting a filter.
	Input Configuration	Creating, updating, or deleting an input configuration. Updating includes activating or deactivating an input configuration.
	Output Configuration	Creating, updating, or deleting an output configuration. Updating includes activating or deactivating an output configuration.
	Rules	Creating, updating, or deleting a rule. Updating includes applying a rule to, or removing a rule from, a connection.
Oversight	Apple ATT Setting	Updating your Apple ATT settings, including updating your opt-in, opt-out, and default ATT settings.
	Data Subject Request	Creating a data subject request.
	DSR Setting	Enabling or disabling Data Subject Requests.
	Trace Configuration	Creating, updating, or deleting a trace configuration.
Segmentation	Audience	Create, updating, or deleting an audience. Updating includes activating, deactivating, and connecting an audience.
	Audience Group	Creating, updating, or deleting an audience group.
Session	Session	User log-ins and log-outs on your mParticle account.
Settings & Configuration	Account	Creating, updating, or deleting an account in your mParticle org.
	API Credential	Creating or deleting an API credential.
	Audience Setting	Updating your default audience sharing settings.
	Custom Role	Creating, updating, or deleting a custom role.
	Key	Creating or deleting an SSH key.
	Notification Destinations	Creating, updating, or deleting a notification destination.
	User	Creating, updating, or deleting a user. Updating includes assigning a standard or custom role to a user.
	Workspace	Creating, updating, or deleting a workspace in your mParticle account.
Warehouse	Composable Audience	Creating, updating, or deleting a composable audience.
	Connection	Creating, updating, or deleting a connection with a warehouse.
	Data Model	Creating, updating, or deleting a data model.
	Field Transformation	Creating, updating, or deleting a field transformation.
	Pipeline	Creating, updating, or deleting a pipeline.