Logs and audit history

Open Logs to investigate operational activity. Open Settings → Activity to inspect changes made by people and credentials on your team.

​

Investigate logs

Choose All, API requests, Webhooks, or Sessions. Use Errors only to narrow any view to failures. Rows show precise timestamps, source, summary, details, and status. Request details include duration or a failure code; delivery details include attempt count and HTTP status. API methods have distinct colors. The sidebar contains timeline and property filters. On a phone, open Filters to use the same controls. Search suggests properties supported by the selected log type. Select a suggestion, enter a value, and press Enter to turn it into a filter pill. Click a pill to edit it or use its close button to remove it. Values of the same property match alternatives; different properties must all match. Reset clears the filters, search, and event context and restores the last-day timeline. Filter identifiers appear when supported by the selected source, including request, session, event, webhook, customer, number, and conversation IDs. An identifier is available only when the underlying activity records it. Use Sort or a column heading to add sorting properties. Sort pills appear under search in priority order. Click Sort to hide or show the pills while keeping the active ordering. Click a pill to change its direction or remove it with its close button. Drag column edges to resize them; the browser remembers those widths.

​

Timeline and live mode

The calendar button on the left opens date selection. Click a start date, then an end date. Click the month or year to jump to another month or year. Select Local or UTC, then Apply. Dates before the first retained log, dates after today, and days without recorded activity are disabled. The dropdown on the right selects a relative period: the last 30 minutes, hour, 12 hours, day, three days, week, or two weeks. It also replaces a custom date range with a relative period. The calendar remains available beside a selected period. Live refreshes every three seconds. A live-mode banner appears above the rows, and the refresh icon spins while a refresh is running. Relative windows advance with each refresh; custom windows keep their selected dates. Refresh fetches new results on demand. Hover or focus a timestamp to see UTC, local time, the ISO timestamp, and elapsed time that updates every second while the popup is open. The server returns the latest 500 matching logs in the selected window, with 50 rows per table page. Narrow the timeline or filters when the view reaches its limit. A selected range covers at most 366 days.

​

Details and context

Select a row for its recorded fields. On wide screens, the detail stays beside the table so you can inspect another row without closing it. Smaller screens open the same detail in a drawer. Close the detail to return to the full table. View in context opens activity within five minutes on either side of that record, across sources. Records with a session ID also constrain the context to that session. Clear context to return to the last-day window. Session updates include recorded connection states, disconnect reasons, temporary-ban expiry, phone-offline deadlines, and restriction changes. These facts remain available independently of message-body retention. Pairing data and message contents are excluded from these state facts. When your team uses the campaign follow-up beta, its follow-ups appear in All as Campaign rows, one for each follow-up state change, such as campaign.followup.scheduled or campaign.followup.cancelled. Details include the campaign, recipient, follow-up, number and command IDs and a reason such as reply or opt_out, never phone numbers or message text. Failed follow-ups and those with an unknown outcome also appear under Errors only. Log drains do not forward these rows. See Send a follow-up after delivery or read. Webhook details show recorded attempts, HTTP status, failure code, and redacted failure-response excerpts. The linked event body loads only when you open the detail, and only while that payload remains available under the source number’s message storage setting. The detail explains unavailable or expired payloads. Project logs exclude request payloads, credentials, and request headers. Failed API requests and webhook deliveries can include a response excerpt of up to 8 KB after common credential fields are redacted. Unsupported response content types are omitted. Raw operational records use syntax highlighting. A failed API request returns a request_log_url in its error body. That link filters API requests to the request ID over the last seven days. The ID matches the X-Request-Id response header. Show all events removes that linked-request constraint.

​

Inspect audit history

Settings → Activity lists up to 500 actions for your team or selected project. Filter by actor, action, source, result, date range, or search. Actor photos and display names appear when the actor’s account supplies them; initials provide a fallback. Open a row for the actor’s email, action, resource, outcome, recorded request information, and before/after field changes. Audit details present structured fields without a raw-record view.

​

Export or forward

The export menu opens immediately. Copy visible logs, Export to CSV, and Export to JSON use the loaded table’s filtered, sorted rows. Audit history also exports its filtered, sorted records as CSV or JSON. Project owners and admins use Trace sampling to configure sampling of forwarded operational records and Add drain in the export menu to configure a destination. Sampling leaves stored logs and audit history complete. See Log forwarding for setup, sampling rules, and delivery verification. See the Logs product overview for a visual introduction.