The Audit Log is one record of who did what and when across the whole certificate suite. When an auditor asks who revoked a credential, a registrar asks when a template changed, or a dispute turns on whether a certificate was ever downloaded, the answer is one filter away. This article covers what the log records and how to read it; Audit Retention covers turning it on and how long entries are kept.

What Is Recorded

The log combines two kinds of entry in one view:

• Administrative actions, recorded by Enterprise: templates created, updated, published, unpublished, duplicated, trashed, or moved to another issuer; settings changed (with which settings); issuers created, updated, or archived, and members added, removed, or given a new role; directory listing changes; fonts registered, renamed, or deleted; bulk and retroactive batches started and completed; licenses activated or deactivated; API keys created or revoked, and daily API verification counts per key; user role changes; and the audit log’s own exports, cleanups, and purges.
• Certificate lifecycle events, recorded by PressPrimer Certificate itself: issued, verified, downloaded, viewed, shared, printed, revoked, reinstated, resent, expired, deleted, and duplicates suppressed. Enterprise shows them alongside the administrative actions so a certificate’s whole story is in one place.

What Is Never Recorded

The log never stores IP addresses, browser user agents, or secrets such as license keys and API keys. This is a design rule, not a setting: if anything tries to record one, it is stripped before the entry is written and a note says so. The log answers “who and when,” not “from where.”

The Audit Log Screen

Navigate to Certificates > Audit Log (administrators only). Each row shows When (in your site’s timezone; hover for UTC), Source (which plugin recorded it), Category, Event, Object (the template, certificate, issuer, user, font, batch, or key it concerns), Actor (the signed-in user, or System for automatic events), and a one-line Details summary such as “Now 90 days (was 365)” or “Issuer #4 (was #2)”.

Filter by source, category, event type, object type, and a date range in site time, or search the events and details. A line above the table counts the matching rows, and Clear filters resets everything. If logging is turned off, the screen says so.

Reading an Entry

Click a row to open its Record panel: the recorded details in plain language and, below them, the raw JSON with a Copy JSON button for pasting into a ticket or a report. Entries with nothing beyond the summary say so.

Following a Thread

From any entry, Show this user’s activity filters the log to everything that actor did. A certificate’s History view lists its lifecycle from issue onward, and a user’s Activity view lists their actions, so “what happened to this credential” and “what did this person do” are each a single click.

Exporting

Export CSV downloads the current filtered view with a column for the UTC date and another for the date in your site’s timezone, plus source, category, event, object, actor, details, and the raw metadata as JSON. Exports are capped at 100,000 rows; if a view is larger, the screen says so and asks you to narrow the date range or filters. Each export is itself recorded in the log.