The Audit Logs module empowers admin users on Ubidots to keep track of relevant actions within the platform. For example, if a device's description is changed, that action is logged along with important context about who made the change, when, and from where.
Audit Logs is split into two tabs, each answering a different question:
Events: "Who changed this device/dashboard/variable, and what changed?"
Requests: "What HTTP request made that change, from which IP, and how?"
Audit Logs is a great tool to:
Monitor and respond to suspicious activities.
Detect and track changes in key entities within your apps.
Ensure compliance with security and audit standards.
Requirements
An Ubidots account with an Enterprise plan.
1. How do Audit Logs Work?
The Audit Logs module tracks all the actions that change any of the tracked entities (see section 2):
Creation: Whenever a new entity is created (for example, a device or dashboard), a log is generated. These actions equate to HTTP POST methods.
Update or modification: If an entity undergoes a full or partial modification, this action is recorded. These actions equate to HTTP PUT/PATCH methods.
Deletion: Each time an entity is deleted, the action is recorded. These actions equate to HTTP DELETE methods.
Additionally, end-user logins are also registered.
Notes:
|
2. Tracked entities
Actions performed on the following entities generate logs:
Apps
Dashboards
Devices
Device Groups
Device Types
Events
Global Properties
Incidents
Organizations
Pages
Reports
Roles
Tokens
Users
Variables
3. Accessing the Audit Logs Module
Go to your Ubidots account, click on your profile picture, then click the Audit logs option:
4. The Events tab
The Events tab shows entity lifecycle activity — who created, modified, or deleted a device, dashboard, variable, incident, and so on.
4.1. Columns
Each row shows:
Date: When the action took place.
Entity: The name of the affected record. If no name is available, the record's ID is shown instead. If the entity has since been deleted, a placeholder such as "Deleted incident" is shown.
Event: A colored badge combining the entity type and the action taken (for example, "incident: Create" or "dashboard: Update").
Actor: The user who performed the action. Shown as a dash (—) for system or automated actions.
Source: Whether the event was triggered by a Service (an internal, automated process) or a Request (an HTTP call made by a user).
4.2. Filtering and search
Above the table:
Search by ID: Find a specific event by the ID of the entity, the actor, or the request.
Date range: Filter events between two dates.
5. The Requests tab
The Requests tab shows the raw HTTP API calls captured by the platform — which endpoint was called, by whom, from which IP, and with what result.
5.1. Columns
Each row shows:
Date: When the request was made.
Method: The HTTP method used (GET, POST, PUT, PATCH, DELETE).
Host: The server's address.
Path: The endpoint that was called.
Status: The HTTP status code returned.
Actor: The user who made the request.
Client IP: The IP address the request originated from.
Note: Not every request is logged. 'GET' requests generally aren't audited, and credential-related or bulk data-ingestion endpoints are logged without storing their request body, due to sensitivity and volume. |
5.2. Filtering and search
Above the table:
Search by ID: Find a specific request log by the ID of the actor or the request.
Date range: Filter requests between two dates.
6. Checking the logs
6.1. Event details
Click an event's Entity value, or open the row's overflow menu (⋮) and select View details, to open the Event detail drawer. Here you'll find:
Created at and the event badge.
Entity: The affected record's name (or its deletion placeholder).
Actor and Source.
Changes: A before/after diff of the fields that were modified. Added fields are highlighted in green; on updates and deletions, removed or changed fields are highlighted accordingly.
Object: An expandable section showing the entity's full current-state data, beyond just what changed.
6.2. Request details
Open a request row's overflow menu (⋮) and select View details to open the Request detail drawer. Here you'll find:
Created at, the Method badge, and a host → path breadcrumb.
Status code.
Details: Actor, Host, and Client IP.
Auth method: How the request was authenticated (for example, "session").
Query: Any query parameters sent with the request.
User agent: The browser or client that made the request.
Email: The email address of the user who made the request, if applicable.
Request payload and Response payload: Expandable sections showing the request body and the server's response, including size and timing.