Activity reports

Admin → Activity shows what happened in your organization: sign-ins, user and settings changes, billing events, files opened and saved, editor actions and every step of signing requests.

The report

• Summary for the last 30 days (or from the From date): number of events, number of active people, the five most frequent actions, and a chart of events per day.
• The list: when, who (a user, Signer, Stripe or System), what, the item (file or document name) and the IP address. Actions reported by the browser are marked editor. 100 events load at a time; choose Load more for older ones.

Filters

Filter	What it does
Search	Matches the person’s email, the item name or the action.
Type	All activity, Sign-ins, User administration, Organization settings, Billing, Files (OneDrive & Teams), Editor, Signing, Reports & audit.
From / To	Dates, inclusive.

Exporting

Export CSV downloads the events that match the current filters, up to 10,000 rows, with these columns: id, occurred_at (UTC), tenant_id, actor_email, actor_role, actor_type, action, target_type, target_id, target_label, ip, user_agent, source, details (JSON). Values that a spreadsheet would treat as formulas are prefixed with '. The export itself is recorded in the log.

What’s logged

Category	Action	Shown as
Sign-ins	auth.signup	Signed up
	auth.login	Signed in
	auth.login_failed	Failed sign-in
	auth.logout	Signed out
	auth.email_verified	Verified email address
	auth.password_reset_requested	Requested password reset
	auth.password_reset	Reset password
Organization settings	tenant.created	Created organization
	tenant.updated	Updated organization settings
	tenant.microsoft_connected	Connected Microsoft 365 organization
	tenant.microsoft_disconnected	Disconnected Microsoft 365 organization
	tenant.suspended	Suspended organization
	tenant.reactivated	Reactivated organization
	tenant.plan_overridden	Changed plan (super admin)
	tenant.domain_added	Added custom signing domain
	tenant.domain_activated	Custom signing domain became active
	tenant.domain_removed	Removed custom signing domain
	tenant.logo_updated	Updated organization logo
	tenant.logo_removed	Removed organization logo
User administration	user.added	Added user
	user.auto_provisioned	User joined automatically
	user.removed	Removed user
	user.disabled	Disabled user
	user.enabled	Enabled user
	user.role_changed	Changed user role
Billing	billing.checkout_started	Started checkout
	billing.subscription_updated	Subscription updated
	billing.subscription_canceled	Subscription canceled
	billing.payment_failed	Payment failed
	billing.signing_pack_purchased	Bought extra signing requests
	billing.portal_opened	Opened billing portal
Files (OneDrive & Teams)	file.opened	Opened file
	file.saved	Saved file
Signing	envelope.sent	Sent document for signature
	envelope.viewed	Viewed document to sign
	envelope.signed	Signed document
	envelope.declined	Declined to sign
	envelope.completed	Signing completed
	envelope.voided	Voided signing request
	envelope.reminded	Sent signing reminder
	envelope.expired	Signing request expired
	envelope.downloaded	Downloaded signed document
Reports & audit	admin.activity_exported	Exported activity report
	admin.audit_verified	Verified audit log integrity
Editor (reported by the browser)	editor.file_opened	Opened document in editor
	editor.file_saved	Saved document
	editor.file_exported	Exported document
	editor.printed	Printed document
	editor.redaction_applied	Applied redactions
	editor.password_protected	Password protected document

The log is write-only

Entries can’t be edited or deleted, by you or by the service. Each one is chained to the previous by a SHA-256 hash, so tampering can be detected; the platform operator can verify the chain. Removing a user doesn’t remove their history.

Editor actions that happen only in the browser (opening a file from your computer, printing, exporting) are reported by the app and are best effort: if the browser is closed before they’re sent, an event can be missing.